1Overview
A subprocessor is a company we engage that processes personal data on our behalf, or on behalf of our customers, as part of running ExitoMail. We keep this list deliberately short, choose providers that keep customer content in the European Union, and bind each of them by a data processing agreement with obligations at least as protective as our own Data Processing Agreement.
We, EXITO Media LLC, are a US company. Where a provider is established outside the EEA, or makes data available to us in the United States, the transfer safeguard shown for it applies. Cloudflare, Inc. and Stripe, LLC are certified under the EU–US Data Privacy Framework; Wasabi Technologies LLC is not, so we rely on the Standard Contractual Clauses for it.
This page is the authoritative list referred to in our Privacy Policy and in Annex III of the DPA. It was last updated on 23 October 2026.
Where your content lives
Mail and Exito Vault files: Wasabi, region EU-Central-2 (Frankfurt, Germany). Backups: Wasabi, region EU-Central-1 (Amsterdam, Netherlands). Exito Transfer files: Cloudflare R2, in the EU jurisdiction. Application and mail server: netcup GmbH, Nuremberg, Germany.2Current subprocessors
netcup GmbH· All products
- Purpose
- Infrastructure hosting: the server that runs our web app, mail server, databases and cache
- Personal data
- All service data while it is processed: account data, mail metadata and search index, transfer metadata, logs
- Processing location
- Nuremberg, Germany (EU)
- Established in
- Germany
- Transfer safeguards
- Established and hosting in the EU. None needed for the provider itself
- Status
- Active
- Privacy information
- netcup.com/en/contact/data-privacy (se abre en una pestaña nueva)
Wasabi Technologies LLC· Mail, Vault, backups
- Purpose
- Encrypted object storage for mail messages and attachments, Vault files and backups
- Personal data
- Mail content and attachments, Vault files, encrypted database backups; IP addresses of browsers that upload or download files directly
- Processing location
- EU-Central-2, Frankfurt (Germany); backups in EU-Central-1, Amsterdam (Netherlands)
- Established in
- United States
- Transfer safeguards
- Stored in the EU. Standard Contractual Clauses for any access from outside the EEA (Wasabi is not certified under the EU–US Data Privacy Framework)
- Status
- Active
- Privacy information
- wasabi.com/legal/privacy-policy (se abre en una pestaña nueva)
Cloudflare, Inc.· Transfer
- Purpose
- Object storage for Exito Transfer files (R2, bucket restricted to the EU jurisdiction)
- Personal data
- Transfer files and their technical metadata (file names, sizes); IP addresses of people who upload or download transfers
- Processing location
- European Union (EU jurisdiction bucket)
- Established in
- United States
- Transfer safeguards
- Stored in the EU. EU–US Data Privacy Framework (Cloudflare is certified), with Standard Contractual Clauses as a fallback
- Status
- Active
- Privacy information
- cloudflare.com/privacypolicy (se abre en una pestaña nueva)
Cloudflare, Inc.· Website and web app
- Purpose
- DNS for exitomail.com; reverse proxy, CDN and DDoS protection for the website and web app at exitomail.com. Mail delivery and mail apps (SMTP, IMAP, JMAP on mail.exitomail.com) never pass through Cloudflare
- Personal data
- Visitors' IP addresses and request metadata (URL, browser, time), and the web traffic it relays between your browser and our server, which includes mail and files you open in the web app
- Processing location
- Global edge network (the data centre closest to the visitor)
- Established in
- United States
- Transfer safeguards
- EU–US Data Privacy Framework (Cloudflare is certified), with Standard Contractual Clauses as a fallback
- Status
- Active
- Privacy information
- cloudflare.com/privacypolicy (se abre en una pestaña nueva)
Cloudflare, Inc.· Sign-up, sign-in, password reset, Transfer, report forms
- Purpose
- Turnstile bot protection on sign-up, password reset, sign-in after repeated failed attempts, transfer and report forms, to tell people from automated abuse
- Personal data
- Signals from the visitor's browser and connection: IP address, TLS fingerprint, user agent, and the page the form is on
- Processing location
- Global edge network
- Established in
- United States
- Transfer safeguards
- EU–US Data Privacy Framework (Cloudflare is certified), with Standard Contractual Clauses as a fallback
- Status
- Active
- Privacy information
- cloudflare.com/turnstile-privacy-policy (se abre en una pestaña nueva)
Twilio Inc.· Copyright agent phone line
- Purpose
- The telephone number of our copyright agent: callers hear where to send written notices and can leave a voicemail, which is emailed to us and then deleted at Twilio
- Personal data
- Callers' phone numbers, call times and the voicemail they leave
- Processing location
- United States
- Established in
- United States
- Transfer safeguards
- EU–US Data Privacy Framework (Twilio Inc. is certified), with Standard Contractual Clauses as a fallback
- Status
- Active
- Privacy information
- twilio.com/en-us/legal/privacy (se abre en una pestaña nueva)
Stripe, LLC· Paid plans
- Purpose
- Billing records for paid plans: the customer and subscription records in our Stripe account, the customer portal, and the plan changes and refunds we make
- Personal data
- Name, account email and internal account ID (sent by us to start checkout); plan, subscription status, amounts, tax and payment history; billing address and tax ID if given; limited payment method details such as type and expiry date (never the full card number)
- Processing location
- United States and other countries where Stripe operates
- Established in
- United States
- Transfer safeguards
- EU–US Data Privacy Framework (Stripe, LLC is certified), with Standard Contractual Clauses as a fallback
- Also acts in its own right
- Purchases are sold through Link (Stripe Managed Payments). For checkout, payment, tax, receipts and invoices, Link accounts, transaction support, refunds requested from Link, disputes and fraud prevention, Stripe and its affiliate Sold through Link, LLC act as merchant of record and process the data as independent controllers under the Link Privacy Policy, not as our subprocessor.
- Status
- Active
- Privacy information
- stripe.com/privacy (se abre en una pestaña nueva)
3Who is not a subprocessor
Some parties receive data in the course of the Service but are not our subprocessors:
- People you correspond with. When you send an email or a transfer, it is delivered, at your instruction, to the recipients' own mail or download providers. They act for the recipient, not for us.
- Your DNS provider. If you connect a custom domain with Domain Connect or API credentials, we talk to your DNS provider on your behalf, under your account with that provider.
- Stripe and Link as merchant of record. Paid plans are sold through Link (Stripe Managed Payments). For the purchase itself (checkout, payment, tax, receipts and invoices, Link accounts, payment support, refunds requested from Link and chargebacks), Stripe and its affiliate Sold through Link, LLC act as merchant of record and independent controllers under the Link Privacy Policy (se abre en una pestaña nueva). Stripe also acts as an independent controller for fraud prevention and its own legal obligations (for example anti-money-laundering rules). Stripe is our subprocessor only for the billing records it keeps for us, as listed above.
- Let’s Encrypt. Issues our HTTPS certificates. It sees only the hostnames a certificate is for, including hostnames on customers' custom domains, which are also published in public Certificate Transparency logs. It never sees mail or files.
- NCMEC and authorities. They receive data from us only where the law requires it, for example reports of child sexual abuse material to NCMEC. They are independent recipients, not subprocessors.
4Changes and notifications
Before we add or replace a subprocessor, we update this page and notify Business customers by email at least 30 days in advance. Business customers may object on reasonable data-protection grounds during that period, as described in section “Subprocessors” of the DPA.
Anyone can subscribe to these notifications: email privacy@exitomail.com with the subject “Subprocessor updates”. We use the address only for this purpose, and you can unsubscribe at any time.
Change log
5Contact
Questions about our subprocessors, or a request for a copy of the transfer safeguards we rely on: write to privacy@exitomail.com.