Last updated
Subprocessors
Mailbay runs on its own server and its own mail software, so this list is short. It is Annex III of the data processing agreement.
DRAFT — for review by a qualified lawyer, not legal advice. Text in [brackets] is a placeholder the operator still has to fill in. Until this notice is removed, this page does not form part of any agreement.
Contents (3)
Current subprocessors
| Subprocessor | Purpose | Location | Transfer basis |
|---|---|---|---|
| OVHcloudOVH Hosting Inc. (OVHcloud Canada) [confirm the contracting OVH entity on the invoice] | Virtual private server that runs every Mailbay service: the API, the mail servers (receiving, sending, IMAP), the database, stored messages and attachments, and backups on the same server. | Beauharnois, Quebec, Canada | Canada: EU adequacy decision (commercial organisations under PIPEDA) |
| [Legal entity name]the operator itself | Remote administration of the server: deployments, maintenance, support and abuse handling. Not a separate company, listed because access from India is a transfer. | India (remote access to the server in Canada) | Standard Contractual Clauses (EU 2021/914) and a transfer impact assessment. no adequacy decision |
The website and dashboard are served from the same server. [If the dashboard is deployed on Vercel, build with MAILBAY_LEGAL_VERCEL=1 so Vercel is listed here]
What is not on the list
- No email delivery provider: mail is received, stored and sent by Mailbay's own mail servers (our SMTP server, KumoMTA and IMAP server) on the server above.
- No analytics, advertising or tracking provider, on the website or in the product.
- Other mail servers and the webhook and forwarding destinations you configure receive data because you ask us to send it there; they work for you or for your correspondents, not for us.
- Spam checks run on our server. They look up the sending server's IP address and domains in public DNS based reputation lists, which see those lookups but no mail content. [confirm the reputation lists enabled in rspamd]
- Billing: [payment processor, once billing is live] will be a controller of payment data in its own right and is listed here when it starts.
Changes and notice
We email workspace owners and update this page at least [30] days before a new subprocessor starts processing customer data. Customers can object as described in the data processing agreement.