Trust Center
Subprocessors
Everyone other than us who can see any part of your data, what they see of it, and whether you can turn them off.
Two different things get called a subprocessor and conflating them makes a vendor look either more exposed or less exposed than it is. The first table is companies we contract with to handle your data — our responsibility, and not optional. The second is accounts you open in your own name: you hold the contract, you set the terms, and you can decline entirely. We add no markup to either.
Our subprocessors
Engaged by MailThreatZero. You cannot opt out of these and keep the service.
| Company | Purpose | Data involved | Required | Region |
|---|---|---|---|---|
| Hosting provider (Nodes Direct) | Runs the machines the gateway, database and console execute on. | All mail in transit through the gateway, the quarantine store, the archive and the database, at rest on their infrastructure. | Required | United States |
| Determined from the ARIN registration of the addresses the gateway and website actually answer on: AS19531, Nodes Direct, United States. Both machines are virtual (KVM). That identifies the operator of record for the network; if the service is bought through a reseller the contracting entity may differ, and the owner should confirm the billing entity and the specific data center region before this line is treated as contractual. Data residency is United States. | ||||
| PayPal (opens in a new tab) | Takes subscription and storage payments. | Billing contact and payment details, entered on PayPal's side. Card numbers never reach MailThreatZero. | Required for paid accounts | United States and worldwide |
| The only payment method currently confirmed. | ||||
| DNS blocklist operators | Reputation lookups on the connecting mail server. | The IP address of the sending server. Not content, recipients or subjects. | Required | Various, operator-dependent |
| Inherent to how blocklists work and true of every gateway that uses them. | ||||
| Self-hosted analytics (Matomo) | Usage analytics for the administration console. | Console page views and browser metadata for signed-in administrators. No message content. | Required | Operated by us on our own infrastructure |
| Self-hosted rather than a third-party analytics service, so no visitor data is sent to another company. Listed anyway because a procurement reviewer should not have to discover it from the page source. | ||||
Accounts you control
Optional integrations where the provider relationship is yours, not ours. Every one is off by default.
| Company | Purpose | Data involved | Required | Region |
|---|---|---|---|---|
| OpenAI, Anthropic or Google (AI analysis) | Optional AI analysis of message content. | Governed by the privacy mode you choose, up to and including sending nothing. | Optional, off by default | Provider-dependent |
| You supply the key and the account is yours. The data-processing relationship is between you and the provider; MailThreatZero is not a party to it and adds no markup. | ||||
| VirusTotal (opens in a new tab) | Optional attachment reputation and multi-engine analysis. | File hashes, and file content if you enable upload. | Optional, off by default | United States |
| Your account, your terms with them. | ||||
| Joe Sandbox, or a CAPE host you operate | Optional behavioral attachment analysis. | Attachments submitted for detonation to a provider account you supply, or to your own analysis host. | Optional, off by default, requires setup | Provider-dependent, or your own infrastructure for CAPE |
| MailThreatZero does not operate a hosted detonation sandbox. Either you hold the provider account or you run the analysis host yourself. | ||||
| Microsoft 365 or Google Workspace | Optional mailbox remediation and identity signals. | Read and, where you grant it, modify access to your own tenant's mailboxes. | Optional, off by default | Your tenant's region |
| Your own tenant, reached with permissions you grant and can revoke. Not a subprocessor: we are acting on your systems, not sending your data to a third party. | ||||
What this page is
A factual list of who touches what, published because a procurement reviewer should be able to read it rather than ask for it. It describes data handling, not an audit finding. Related: security and data handling, and the maturity of every capability.
If a subprocessor changes we will update this page. There is no notification list to join yet; if you need advance notice of a change as a contractual term, raise it through the contact form and it can be written into your agreement.