Trust center · updated 2026-07-28

Every supplier
in the chain.

A sub-processor is any third party that processes personal data on our behalf. We use three, and all three are established in the EU. This page lists them in full, including what each one receives.

Email.eu sub-processors as of 2026-07-28
Sub-processorRoleWhat it processesEstablished in
OVHcloud
OVH SAS · since 2026-01
Infrastructure hosting (compute, storage, network)All Customer Data at rest and in transit within the Service: mailboxes, files, calendars, contacts, chat and meeting metadata, on infrastructure we operate ourselves.Paris, France
France (EU)
Mollie
Mollie B.V. · since 2026-01
Payment processingBilling contact details and payment instrument data for subscription payments. No Customer Data from inside the Workspace.Amsterdam, Netherlands
Netherlands (EU)
Moneybird
Moneybird B.V. · since 2026-01
Invoicing and accountingBilling contact and invoice data required to issue and archive invoices. No Customer Data from inside the Workspace.Enschede, Netherlands
Netherlands (EU)

No sub-processor is established outside the EU/EEA, and no Customer Data is transferred to a third country. This page publishes Annex III of our Data Processing Agreement. The DPA is the document that binds us.

The other half of the list

What is not a sub-processor,
and why.

A list this short raises a fair question: what was left off it? Below is what people expect to find here, and why it is not on the list.

Stalwart, Bulwark, La Suite Drive, La Suite Docs, La Suite Meet, Zulip, Authentik, ONLYOFFICE
Open-source software we self-host on the OVHcloud infrastructure above. The upstream projects operate no service for us and never receive Customer Data, so they are suppliers of software, not sub-processors.
Transactional and outbound email
Handled on our own mail infrastructure within the Remails B.V. group. No third-party sending provider is involved.
Billing engine (Lago)
Self-hosted on the OVHcloud infrastructure above, so it is covered by that entry rather than being a separate sub-processor.
Website analytics (Umami)
Self-hosted on our own EU infrastructure and cookieless. It processes website-visitor data where we are the controller, covered by the Privacy Statement, and never touches Workspace data.
AI and machine-learning providers
None. The Service has no AI features, and Customer Data is never sent to a model provider or used for training. That is a contractual commitment in the DPA.
Changes

Thirty days notice,
before anything moves.

Under section 6 of the DPA we give at least 30 days advance notice before adding or replacing a sub-processor. Notice is published here and in the change feed, and customers may object on data-protection grounds within that window.

Subscribe to the feed in any reader, or write to privacy@email.eu to be notified by email.

2026-07-28
First publication of the sub-processor list. Contents are unchanged from Annex III of the DPA in force since launch (OVHcloud, Mollie and Moneybird), so no new sub-processor is being introduced and the 30-day objection window does not apply.

Read the terms
behind the list.

The DPA sets out the processing terms, the security measures and the audit rights. The Privacy Statement covers the data we handle as controller.

Read the DPAPrivacy Statement