Legal
Subprocessors
The third parties Aethon Systems OÜ uses to run DeliverSight, what each one processes, where, and under which transfer safeguard.
The list, and what it commits us to
This page is the authoritative list of providers we use to run DeliverSight. The first group are Subprocessors under our Data Processing Agreement, and that group forms part of it. It is published separately from our other policies so that a change to it is unmistakable.
Before we add or replace a Subprocessor, we publish the change here and email customers at least 30 days in advance. You may object during that period on reasonable grounds relating to data protection; if we cannot avoid using the provider for you or offer a reasonable alternative, you may terminate the affected Service before that provider begins processing, and we will refund the unused portion of your prepaid fees. Objecting costs you nothing. The full mechanism, including the narrow exception for urgent replacement, is in §7 of the DPA.
Change notices go to the account email address on file. Keep it current, or write to us to nominate a different address for legal and data-protection notices.
The list is short on purpose. Almost everything the Service is made of — the database, the object storage that holds submitted messages, the mail gateway that receives your test email, the sign-in system, error tracking — we run ourselves on our own hosting. Those are not subprocessors, because there is no other company involved; they are our software on our servers.
Subprocessors under the DPA
These process personal data on behalf of our customers, and are the group covered by the 30-day notice and objection right above.
1. Hetzner Online GmbH
Purpose — hosting. Every server the Service runs on is rented from this provider, which makes it the entry on this list that holds the content of your test material at rest.
Data categories — all categories of Customer Personal Data described in Annex A of the DPA: submitted messages and their analysis, DMARC data, monitoring history, report and webhook data, sending-infrastructure identifiers and the related operational logs. Hetzner also hosts the account, authentication and billing data we process separately as an independent controller under the Privacy Policy — that processing is not governed by the DPA.
Processing location — Finland. The provider is a German company and the data centre is in Finland; both are in the EEA.
Transfer mechanism — none required. Controller and processor are both established in the EU and the data does not leave the EEA.
Date added — at launch.
2. Cloudflare, Inc.
Purpose — content delivery, DNS, and protection of the website and API against attack and abuse.
Data categories — the IP address, request metadata and TLS connection details of every visitor, and the content of API and report responses in transit. Cloudflare proxies our authenticated API, which means it terminates TLS and can see personal data contained in responses as they pass through. We list it as a Subprocessor for that reason rather than treating it as neutral infrastructure.
What it does not hold — inbound test email does not pass through Cloudflare. Message content reaches our mail gateway directly, so Cloudflare sees it only where it is served back to you in a report or an API response. Cloudflare is not configured to cache authenticated report or API responses; it processes their content transiently in transit, and limited request and security metadata may be retained under Cloudflare’s own terms. Cloudflare’s visitor analytics is switched off, so it injects no measurement script into our pages.
Processing location — globally distributed edge network, including the United States.
Transfer mechanism — the Standard Contractual Clauses with supplementary measures, together with certification under the EU–U.S. Data Privacy Framework; its terms provide that the Clauses continue to apply if that certification lapses.
Date added — at launch.
Other providers — our own processing
These are not Subprocessors under the DPA, because they do not process personal data on behalf of our customers. They process data for which we are the independent controller, and they are disclosed here for completeness and in our Privacy Policy. The 30-day notice and objection right above does not extend to them; the DPA’s machinery is for data we hold on your behalf.
3. Stripe
Purpose — payments, subscriptions, invoicing and tax calculation, for our own billing relationship with you.
Legal entity — Stripe Payments Europe, Limited, Dublin, Ireland, which engages Stripe, Inc. (United States) as its own subprocessor.
Data categories — billing name and email address, country, VAT identification number where you supply one, subscription and invoice records, and the payment details you enter directly into Stripe’s own hosted fields. Card numbers reach Stripe without passing through us, and we never store them.
What it does not hold — no submitted message content, no report data, no DMARC data. Stripe knows what you bought, not what you tested.
Processing location — Ireland and the United States.
Transfer mechanism — the European Commission’s Standard Contractual Clauses, together with certification under the EU–U.S. Data Privacy Framework, and a UK addendum for UK transfers.
Date added — at launch.
4. Google
Purpose — website analytics (Google Analytics 4), to understand which pages are useful.
Legal entity — Google Ireland Limited (Ireland), which engages Google LLC (United States) as its own subprocessor.
Data categories — the page viewed, approximate location derived from IP address, and general device and browser information. Page addresses are redacted before they are sent: report share links, password-reset links, invitation links and email addresses appear in our URLs and are stripped, so Google records that a report was viewed but not which one.
What it does not hold — no submitted message content, no account identifiers, no report tokens.
Conditional — this is the only entry on the page that is not always engaged. Nothing loads and no request is made unless you accept analytics cookies; declining means Google receives nothing at all, and withdrawing consent expires the cookies already set.
Processing location — Ireland and the United States.
Transfer mechanism — the Standard Contractual Clauses set out in Google’s data processing terms.
Date added — at launch.
Obtaining the safeguards
If you need to see a transfer safeguard rather than take our word for it — a copy of the Standard Contractual Clauses as concluded with a given provider, or that provider's current certification — email [email protected] and we will send it, subject to redactions protecting confidential information and other customers. This is your right under Art. 46(1) GDPR and we treat it as one; there is no charge and you do not need to explain why.
Our typefaces are deliberately not on this page: they are served from our own servers rather than a font CDN, so loading a page does not disclose your IP address to a font provider. It is a small thing, but it is the kind of thing that ends up on a list like this by default rather than by decision.