MailSolid Subprocessors
The service's providers
These are the providers to which MailSolid sends personal data to provide the service. We give 30 days' notice before adding a new one, as described in the Data processing agreement.
| Provider | What for | What data | Where |
|---|---|---|---|
| Cloudflare, Inc. | The whole application: hosting, databases, file storage, queues, the human check (Turnstile), PDF reports and DNS | All the data of the service | Cloudflare's global network; the data of each workspace preferably in the United States |
| IONOS | Our mail node: receives DMARC and TLS reports and mail-test messages, and checks messages with our own filter | The reports and messages received; messages are deleted within 24 hours | United States |
| OVH | Additional mail node, with the same role as the one above when it is active | The same as the node above | United States |
| Resend | Sending the service's email (sign-in codes, invitations, alerts and summaries) | The recipient's address and the content of the email | United States |
| Brevo (Sendinblue SAS) | Sending email, as a backup | The same as Resend | European Union (France) |
| Emailit | Sending email, as a backup | The same as Resend | Available on request |
| Reoon | Checking that an email address can receive mail before writing to it | The email address | Available on request |
| Anthropic, PBC | The AI second opinion in message analysis, only if a workspace turns it on | The visible text of the message, with personal data masked, and our engine's findings; never attachments | United States |
| Stripe, Inc. | Payments and invoices, when there are paid plans | The owner's email and name, the plan and the payment details (collected by Stripe; MailSolid does not see them) | United States and Ireland |
Sign-in providers
If you choose to sign in with Google or Microsoft, that provider verifies your identity. MailSolid receives the identifier of your account and its email address, and keeps no token, name or photo.
Public lookups
To check a domain MailSolid queries public services with the domain names and IP addresses involved, not with account data: public DNS resolvers (Cloudflare and Google), domain registries (RDAP) and the IP-to-network lookup of Team Cymru.
Services the customer connects
A workspace can send its alerts to Slack, Microsoft Teams, Telegram, its own webhooks and the PSA services it connects (HaloPSA, SuperOps and Alga PSA). MailSolid sends them only what the workspace chose, with the credentials it provided. The customer is responsible for those services and for having a lawful basis to send them data.