Subprocessors
Last updated: July 7, 2026
To provide EmailFlow AI we engage a small number of third-party vendors ("subprocessors") that may process personal data on our behalf. This page is the complete, current list. It is generated from the same configuration our engineering team maintains, and an automated test fails our build whenever a new vendor credential is added to the codebase without being classified here — so this list cannot silently drift from reality.
Current subprocessors
| Subprocessor | Purpose | Location | Data protection terms |
|---|---|---|---|
| Amazon Web Services, Inc. | Email delivery (Amazon SES), media and blog asset storage and delivery (S3, CloudFront) | United States (us-east-1) | View terms |
| Hetzner Online GmbH | Application and database hosting (dedicated cloud server) | Falkenstein, Germany (EU) | View terms |
| Cloudflare, Inc. | TLS termination, content delivery, and DDoS protection in front of the application | Global edge network (US headquarters) | View terms |
| Stripe, Inc. | Subscription payment processing (PCI-DSS Level 1); card numbers never touch EmailFlow AI servers | United States | View terms |
| OpenRouter, Inc. | AI inference routing for all AI features (email generation and editing, subject lines, images, segments, analytics chat, support chatbot) | United States | View terms |
| Firecrawl (SideGuide Technologies, Inc.) | Website crawling for brand import and AI live web research, on customer-supplied URLs | United States | View terms |
| BulkEmailChecker | Email address verification (deliverability checks on subscriber addresses) | United States | View terms |
| Google LLC | Bot protection on sign-in and embedded subscription forms (reCAPTCHA) and web-font delivery on the marketing site | United States | View terms |
Integrations you connect are not subprocessors
When you connect your own account on a third-party platform — for example exporting a template to your Mailchimp, Klaviyo, or HubSpot account, importing a design from your Figma account, connecting a Shopify store or Stripe account as an event source, or linking an advertising platform — data flows to or from that platform at your direction, under your own agreement with that vendor. Those vendors act on your instructions, not ours, so they are not EmailFlow AI subprocessors. The full set of available integrations is listed on our integrations directory.
What subprocessors may receive
Each subprocessor receives only the data required for its function. Our email delivery provider processes the emails you send and their recipient addresses. Our AI inference provider processes the prompts and content you submit to AI features. Our email verification provider processes subscriber email addresses you ask us to verify. Our hosting and network providers process data because the service runs on their infrastructure. None of them may use your data for their own purposes, and none of them receive data for advertising or profiling. See our Privacy Policy and Data Processing Addendum for the commitments that bind us and them.
Changes to this list
We update this page before engaging a new subprocessor. If you have signed our Data Processing Addendum, you may object to a new subprocessor as described there. Questions about this list can be sent to privacy@emailflow.ai.