List of Subprocessors
Last updated: 1 October 2026
About this list
A sub-processor is a third party that processes personal data on our behalf when we act as a processor for our customers, for example when we store and send the contact lists and content you upload to EmailOctopus. This list forms part of the Data Processing Schedule at Schedule 2 of our Terms of Use at https://emailoctopus.com/legal/terms.
Capitalised terms on this page, such as Content and Protected Data, have the meanings given in our Terms of Use.
Providers that process personal data for which we are the controller, such as information about our own customers and website visitors, are described in our Privacy and Cookie Policy.
If you use EmailOctopus Connect, the email service provider you connect (such as Amazon SES) is your own processor and not our sub-processor.
Our sub-processors
We use the following sub-processors to provide the Service:
Sub-processor | What they do | Location | Transfer mechanism |
|---|---|---|---|
Amazon Web Services EMEA SARL | Cloud hosting and storage of contact lists, Content and account data, and the AI models we use to screen Content for phishing, fraud and abuse | European Union (EEA), primarily Ireland. AI content screening may run in other AWS regions, including the United States. For EmailOctopus Connect, delivery events pass through the AWS region of the customer's own Amazon SES account. Support access from outside the UK | UK adequacy regulations (EEA); IDTA / UK Addendum for AI screening in other regions, Connect events and support access |
Automattic, Inc. (Gravatar) | Hashed email addresses, to provide contact profile images | United States | UK-approved standard contractual clauses |
Bird B.V. (formerly SparkPost / MessageBird) | Email delivery (our main sending provider) | Sending and contracting infrastructure in the European Union | UK adequacy regulations (EEA); IDTA / UK Addendum |
Cloudflare, Inc. | Content delivery network, DNS and security | United States and global edge network | UK-US Data Bridge, supported by the UK Addendum |
Datadog, Inc. | Infrastructure monitoring and logs. Logs and database query samples can include Protected Data | European Union (EU1 site); support access from the United States | UK adequacy regulations (EEA); UK-US Data Bridge for support access |
Google LLC | Google Workspace (email, documents and spreadsheets used by our team, processing Protected Data only where it is sent to us); reCAPTCHA spam protection on sign-up forms; Google Fonts on forms, landing pages and emails | United States | UK-US Data Bridge, supported by the UK Addendum |
Help Scout PBC | Customer support ticketing. Processes Protected Data only where it is included in a support request | United States | UK-US Data Bridge, supported by the UK Addendum |
Sentry (Functional Software, Inc.) | Error monitoring. Error reports can include Protected Data shown in the app when an error happens | United States and European Union | UK-US Data Bridge, supported by the UK Addendum |
Twilio SendGrid (Twilio Inc.) | Email delivery (used for a small share of sending) | United States | UK-US Data Bridge, supported by the UK Addendum |
Changes to this list
We will give at least 30 days’ notice before appointing a new or replacement sub-processor, by updating this page and, if you have subscribed, by email. To subscribe, email privacy@emailoctopus.com with “Sub-processor updates” in the subject line. You may object to a new sub-processor on reasonable data protection grounds within 15 days of the notice, as set out in the Data Processing Schedule.
Contact us
Questions about our sub-processors can be sent to privacy@emailoctopus.com. This page is published at https://emailoctopus.com/legal/subprocessors.