Subprocessors

This list names every provider that processes customer data on our behalf as a subprocessor under the data processing agreement, including the providers they engage in turn (Article 28(2) and (4) GDPR). It forms Annex 3 of that agreement.

Customer data is the data we process for customers: their messages, attachments, events, suppression lists, domains and configuration. The data we process for our own purposes, such as sign-in, is described in the privacy policy.

Three providers process customer data for us: OVH hosts our server in the EU; Neon runs our application database in Frankfurt; and Amazon Web Services provides Neon’s infrastructure there. Neon and Amazon Web Services belong to US groups.

Neon may use further providers for its database service, for example Grafana Labs for monitoring. We list every one that applies to the service we use. [To verify: which of Databricks’ subprocessors (list updated 9 June 2026) apply to Neon Platform Services]

Message bodies and attachments are encrypted with keys held on our OVH server, not by Neon or Amazon Web Services. Addresses, subjects and events are not encrypted in the database. The security measures describe what is encrypted and what is not.

These providers and parties are involved in running Letterpier, but do not process customer data for us:

Vercel Inc.

Registrar and DNS provider for letterpier.com only. It does not host Letterpier and never sees messages. Customers’ DNS stays with their own providers. Vercel processes our own registrant and account data, so it is listed in the privacy policy as a recipient.

Let’s Encrypt

Issues the TLS certificates for our domains. It receives no customer data.

Recipients’ mail servers

Independent recipients to which customers instruct us to deliver their messages. They are not engaged by us.

Cloudflare R2

Supported by the software, not in use. If we enable it, we will use an EU-jurisdiction bucket and update this list first, with 30 days’ notice.

We email the owners of every customer organisation at least 30 days before we add or replace a subprocessor, and record the change below.

A customer may object within that period by writing to mail@michael-ketzer.com with its reasons. If we cannot resolve the objection, the customer may terminate before the change takes effect, as set out in the data processing agreement.

Earlier versions of this list are kept in the version history at the end of this page.

Letterpier’s infrastructure is subject to the jurisdiction of the European Union and its Member States (OVH, France and EU) and, for the application database, of the United States as well (Neon and AWS, US groups that may be subject to US law such as the CLOUD Act).

Our measures against unlawful international government access to non-personal data: message bodies and attachments are encrypted with keys held on our OVH server, not by the database provider; data processing agreements with our providers; and we review every request for access and push back on requests that lack a valid legal basis.

For personal data, the transfer safeguards are described in the data processing agreement.