Sub-processors
Last reviewed: August 21, 2026
These are the third parties that can process data on behalf of ClearMX, what each one is used for, and where it runs. The list is short because the stack is small, and it is checked against the running production system rather than against our intentions.
| Sub-processor | Purpose | Data it can reach | Location |
|---|---|---|---|
| Hetzner Online GmbH | Application servers, database and backups | All application data at rest and in process | Helsinki, Finland (EU) |
| Amazon Web Services (SES) | Transactional email — confirmations, password resets, team invitations | Recipient address and message body of those emails only. Never an address you are verifying. | eu-west-1, Ireland (EU) |
| Stripe | Payments and invoicing | Billing name, email, and payment details you enter on Stripe's own checkout. Card data never reaches our servers. | Ireland / United States |
| PostHog | Product analytics — which pages and features are used | Account and event identifiers, page paths. No verification results, no uploaded lists, no addresses. | EU Cloud (Frankfurt, Germany) |
| Hatchbox | Deployment and server orchestration | Administrative access to the servers above; it is not sent application data | United States (control plane); servers remain in the EU |
What is not on this list
We use no CDN, no third-party tag manager, no advertising or remarketing pixel, no session-recording tool, and no error-tracking service. The free tools do not store anonymous lookups anywhere, so no sub-processor receives them.
Changes
Adding a sub-processor changes this page and its review date. If you have a contract with us that requires advance notice of a change, email support@clearmx.app and we will add you to the notification list. A data processing agreement is available on request.
How the system itself is run — hosting, encryption, access, and what we do not claim — is on the security page.