Documentation Navigation
Subprocessors
Last updated: September 18, 2026
Summary: These are the companies we rely on to run InflowMail, and what each one receives. Anyone who can touch customer data is listed. If you are reviewing us for your firm, this is the page your security questionnaire is asking about.
Infrastructure
| Company | What it does | What it receives | Where |
|---|---|---|---|
| Amazon Web Services | Servers, database, backups, logs | Everything we store: account details, message metadata and message bodies within your plan's history window | United States (N. Virginia) |
| Cloudflare | DNS, TLS, the tunnel that fronts our servers, bot checks on sign-up forms | Traffic in transit, IP addresses. Message content passes through encrypted but is not stored there | Global edge network |
AI processing
Which one applies depends on your settings. If you bring your own API key, requests go to your own account with that provider, under your agreement with them, and we are not in the middle.
| Company | When it is used | What it receives | Where |
|---|---|---|---|
| Amazon Bedrock | Default: classification, summaries, the in-app assistant | Sender, subject, and message text for the message being processed | United States |
| Anthropic, OpenAI, Google | Only if you choose that provider, or bring your own key | Same as above, for the provider you pick | United States |
We do not train models on your mail, and we use these providers under API terms that do not permit training on it either. Those are their policies, and we link them rather than restate them.
Business operations
| Company | What it does | What it receives | Where |
|---|---|---|---|
| Stripe | Payments and subscriptions | Your name, email address and billing details. We never see or store your card number | United States |
| Zoho | Sends our own mail to you: sign-in links, receipts, alerts | Your email address and the content of those messages. Not your mailbox | United States |
Your own mail providers
Google, Microsoft and any IMAP host you connect are not our subprocessors. They are your providers, and they held your mail before InflowMail existed. We read from them with the access you grant, and you can revoke it from their settings or ours at any time.
Changes
If we add a subprocessor that handles customer data, we will update this page and note the date. If you have a signed DPA with us, we will also tell you at least 30 days beforehand, so you have time to object.
Questions about anything here go through the support form.