Sub-processors
Our data processing agreement commits us to keeping a current list and to telling you before it changes. This is that list.
Last updated 6 October 2026
Service sub-processors
These process data you entrust to us as part of running the product. The commitments in our DPA apply to every one of them.
| Sub-processor | What it does | Data it can reach | Where it runs |
|---|---|---|---|
| Amazon Web Services, Inc. | Sending infrastructure and delivery event ingestion. Every message you send leaves through Amazon SES. | Recipient addresses, message content and headers, delivery event metadata. | The AWS region you select per sending domain. |
| Cloudflare, Inc. | DNS, CDN, and the hosting layer in front of this site. Turnstile checks that form submissions come from a person. | Request metadata and IP addresses in transit, and anything typed into a form on this site. | Global edge network, nearest location to the visitor. |
| Payment processor — not named here yet | Subscription billing and invoices. | Billing contact details and card data. We never see or store card numbers. | United States. |
One gap, stated plainly: we have not named our payment processor on this page yet. If you need it for a vendor review, ask and we will tell you in writing.
Website analytics
This applies to the marketing site only. It never touches data you send through the product.
| Sub-processor | What it does | Data it can reach | Where it runs |
|---|---|---|---|
| Google LLC | Google Tag Manager and Google Analytics, loaded on getoutsend.com in production. | Pages visited, referrer, approximate location, device and browser, IP address. | United States. |
Not sub-processors
Receiving mail providers — Gmail, Outlook, Yahoo and the rest — are not our sub-processors. They are independent controllers, and handing a message to them is the whole point of sending an email. We record the response each one gives us, which is what the event log shows you.
Changes and your right to object
We will give you notice before a new sub-processor starts processing your data, and you may object. Every change to this page is dated here and recorded in the changelog, so you can check what the list said on any given day rather than taking our word for what it says now.
To be told directly rather than having to check, email privacy@getoutsend.com and ask to be on the notice list.