Posthawk
Legal

Subprocessors

Last updated — April 12, 2026

What is a subprocessor

A subprocessor is a third-party company we use to help deliver the Posthawk cloud service — the infrastructure providers, payment processor, and analytics tools we rely on to run the product. Each one handles a specific, limited slice of your data under a contract that binds them to the same confidentiality and security standards we commit to. This page is the current list.

Self-hosted Posthawk deployments do not use any of these vendors for your email data — you choose your own infrastructure. This list applies only to the managed cloud at app.posthawk.dev.

Current subprocessors

Outbound email delivery and inbound receiving
Email envelope, headers, body, attachments, recipient addresses
EU (Stockholm eu-north-1, Ireland eu-west-1)
Managed PostgreSQL database, authentication, and encrypted secret storage
Account data, workspace data, API keys, email logs and metadata
EU (Frankfurt)
Compute infrastructure for the worker API, SMTP relay, and BullMQ/Redis queue
All data in transit through the worker; no long-term storage on Hetzner
EU (Nuremberg, Germany)
Hosting for the marketing site, dashboard, and documentation
Web request logs, no application data at rest
Global edge network (US primary)
DNS, DDoS protection, bot mitigation (Turnstile), and Email Routing
Web request logs, bot-challenge tokens, inbound email routing metadata
Global edge network
Payment processing, subscription billing, invoicing, and tax compliance
Billing email, company name, billing address, card details (held by Stripe, not Posthawk)
Global (EU data center for EU customers)
Marketing site analytics (opt-in only, disabled until consent)
Anonymized IP, page views, referral source, coarse geography
Global
Privacy-respecting aggregate analytics for the marketing site (opt-in only)
Page views, referrer, country — no personal identifiers, no cookies by default
Self-hosted (EU)
PaaS deployment tooling running on our Hetzner servers — no data leaves our infrastructure
Deployment configuration and build logs only
EU (runs on our Hetzner hosts)

Changes to this list

When we add a new subprocessor — or swap one out — we will update this page and, where your DPA requires it, notify account owners at least thirty days before the change takes effect. You can subscribe to change notifications by emailing privacy@posthawk.dev with the subject line "subprocessor updates". If you object to a new subprocessor, you can terminate your subscription for a pro-rata refund of the unused portion of your current billing period.

Questions

For data processing agreements (DPAs), standard contractual clauses, security questionnaires, or any other vendor-review material, reach out at privacy@posthawk.dev and we will get back to you within two business days.

Cookie Preferences

We use analytics cookies to understand how you use our site and improve your experience. Privacy Policy