A subprocessor is a company we engage that may process personal data on our customers' behalf. Each one below is bound by a written agreement imposing protections no less strict than our own Data Processing Addendum, and we remain fully responsible to you for what they do.
1. Current subprocessors
| Provider | What it does | Data it can touch | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting for the application, the primary database, object storage for uploaded assets, load balancing, DNS, and content delivery. Outbound email delivery through Amazon Simple Email Service. | All customer data, including recipient addresses and message content | United States |
| Scaleway SAS | Hosting for our fallback outbound mail server. The mail server is ours and we operate it; Scaleway provides the machine it runs on. It sends only when a message is routed to it instead of Amazon Simple Email Service. | Recipient addresses and message content, while such a message is being sent | France |
| Stripe, Inc. | Payment processing and subscription billing. Card details go to Stripe directly and are never stored by us. | Billing contact and payment details of account owners. No contact data. | United States |
| DeepSeek | Running the platform AI assists by default: drafting and editing campaign copy and templates, building segments, subject lines, summarising send performance, and SentientSplit. Only when you use one of those and only on the content of that request. An assist your account routes to another provider, or runs on its own key, skips DeepSeek; SentientSplit follows the same rule. DeepSeek's terms let it keep that text and use it to improve its models, with no opt-out. | Whatever appears in the prompt: what you write or upload for that task, which means copy, templates and briefs, audience descriptions for segment building, your brand kit and asset names, emails you upload to SentientSplit, aggregate performance figures, and your account's AI notes and learned insights (these can include a teammate's name, email address and comment when they reject a draft). It never receives your contact list, contact records or data extension rows. Anything you type or paste into an AI assist is sent as written. | China |
| Anthropic, PBC | Running the in-app assistant (chat); any AI assist an account chooses to run on Anthropic under Settings, AI Models; and the quality check on finished poster images. With your account's own Anthropic key, chat and routed assists run under your agreement with Anthropic instead; the poster quality check always runs on our key. Anthropic processes this data only to provide the service on our instructions, keeps it for a limited period for abuse and safety review under its commercial terms, and does not use it to train its models. | The in-app assistant's conversations, including anything it reads for you with its tools within your role's permissions; the content of any AI assist your account routes to Anthropic (the same kinds of content listed for DeepSeek); and finished poster images. | United States, and any other location Anthropic processes in, under the Standard Contractual Clauses in its Data Processing Addendum |
| SpaceXAI LLC (xAI) | Generating images for emails and poster heroes when you or the in-app assistant ask for one, and any AI assist an account chooses to run on xAI under Settings, AI Models. SpaceXAI uses this content to provide the service, does not train its models on it, and deletes it within 30 days. Its terms also allow it to create and use de-identified or aggregated data derived from it. Not when your account uses its own xAI key: that traffic is under your agreement with xAI. | The text of the image prompt, written by you or the assistant from your brief, and the content of any AI assist your account routes to xAI (the same kinds of content listed for DeepSeek). We do not attach contact lists, contact records or data extension rows to these requests, but anything written into a prompt is sent as written, so keep personal information out of image prompts. | United States, and any other location SpaceXAI processes in, under the Standard Contractual Clauses in its Data Processing Addendum |
AI assists
The in-app assistant runs on Anthropic, as do any AI assist your account chooses to run on Anthropic (under your own agreement if you add your own Anthropic key), and the quality check on finished poster images, which always runs on our key. Anthropic works under the same terms as every other provider on this page: it processes what we send only to provide the service, keeps it for a limited period for abuse and safety review, and does not train on it. The assistant can only do and read what your own role allows.
Generated images come from SpaceXAI (xAI) unless your account picks another image provider with its own key, and SpaceXAI also runs any AI assist your account chooses to run on xAI. For images SpaceXAI receives the text of the prompt; we attach no contact data, but whatever the prompt says is sent as written. It does not train on what it receives and deletes it within 30 days, and its terms allow it to create and use de-identified or aggregated data derived from it. On our key each image counts as one AI assist against your plan; with your own xAI key it does not, and SpaceXAI is then your provider rather than our subprocessor.
The other platform AI assists, SentientSplit included, run on DeepSeek by default. Unlike every other provider on this page, DeepSeek processes that text under its own terms rather than ours: it stores it in China, which has no European Commission adequacy decision, and may use it to improve its models, with no opt-out. Our Data Processing Addendum sets out that exception in section 7.
It only ever sees the content of an AI assist request, never your contact list or contact records. To keep your content out of it entirely, route each AI assist, SentientSplit included, to your own provider key or endpoint in Settings, or do not use the platform AI assists. If that is not enough, section 4 explains how to object.
This is separate from bringing your own key. If you configure your own AI provider, your prompts go to that provider under your agreement with them, they bill you directly, and they are not our subprocessor. SentientMail runs its own key only for the providers on this page (Anthropic, DeepSeek and SpaceXAI). Every other AI provider in Settings, including OpenAI, Google Gemini and Perplexity, and any image provider other than xAI, works only with your own key or endpoint, so it is always your provider and never our subprocessor.
Planned, not yet in use
These are listed early so the notice period in section 3 is never the first you hear of them. None is processing any customer data today.
| Provider | What it will do | Data it will touch | Location |
|---|---|---|---|
| Twilio Inc. | Delivering one-time SMS codes for phone verification at signup. | The phone number of the person verifying. No contact data. | United States |
2. What we do not use
Worth stating plainly, because for most platforms the list below would be long:
- Google Analytics on the marketing site only, and only after the visitor allows it (Europe, the UK and Switzerland opt in; elsewhere it runs by default with a one-click off switch in every footer). It counts page views with a truncated IP address and never touches customer data or the application. No advertising pixels, no session recording. Google LLC, United States.
- No data enrichment or list-brokerage provider. We do not append data to your contacts from outside sources, and we do not buy data about anyone.
- No AI training on your data by us, or by any provider above except DeepSeek, as described in section 1.
3. Notice of changes
Before a new subprocessor begins processing customer data we give at least 30 days' notice: we update this page and email account owners who have subscribed to subprocessor notifications.
To subscribe, write to privacy@sentientmail.com with the subject "subprocessor notifications". There is no charge and you do not need to be on a particular plan.
4. Objecting to a subprocessor
You may object to a new subprocessor on reasonable data-protection grounds within the 30-day notice period, by writing to legal@sentientmail.com and explaining the concern. We will work with you to find an alternative.
If we cannot resolve it, you may terminate the affected part of the Service and we will refund the unused portion of any prepaid fee, as set out in section 7 of the Data Processing Addendum.