Subprocessors

A subprocessor is a company we hand data to in order to run the service. This page lists every one of them, what each does, and where it does it.

It is a list rather than a category. “Industry-standard cloud infrastructure providers” is the sentence a policy writes when it does not want you to count them, and counting them is the only thing this page is for.

1. Who processes what

Two of these see message content and seven do not. Amazon Web Services holds every byte of mail, because it is the mail provider and the object store; its Bedrock service also reads each inbound message once, in Ireland, to screen it, with retention set to none, so nothing it reads is kept or seen by the model's maker. Fly.io runs the process that external clients submit and fetch mail through, so message bytes pass through it in transit. Supabase holds message bodies and metadata in the database. Everything below that line — Vercel, Upstash, Sentry, Plausible, Stripe, Cloudflare — is deliberately kept away from correspondence, and §2 says how.

2. What the others are prevented from seeing

Sentry and Plausible are the two that would ordinarily drift into holding correspondence, and both are configured against their own defaults.

• No session recording, anywhere. Sentry Session Replay is not installed and Plausible has no such feature to turn off. On this product the DOM is other people’s mail, so anything that records the screen is exfiltration with a dashboard.
• Plausible never sees a URL inside the application. It runs in the browser, but page views are captured on the public pages only — the signed-in application mounts it with page capture switched off, because a URL in a mail client is /app/inbox/<conversation id> and a list of those is a list of your conversations. What it receives from inside the product is six named steps — signed up, added a domain, verified it, created an address — carrying no path, no id and no address.
• Plausible sets no cookies and builds no profile. There is nothing to join one visit to the next, which is why it needs no consent and why it replaced a product-analytics vendor that did.
• Sentry gets stack traces with the sensitive parameters redacted, sendDefaultPii off, and the account’s email address removed before send. The mail service reports into a project of its own with an allow-list of attributes, message contents excluded outright, and addresses reduced to [address]@domain in error strings.
• Sentry’s browser events go through our own origin, so no third-party host is added to the page’s connection policy.

Cloudflare sees only the sign-in and sign-up page: the visitor's IP address and the browser signals Turnstile reads to tell a person from a script, and the verdict we ask it for. It runs nowhere else in the product, so it never sees an address you sign in with, a message or anything inside the application.

Upstash holds counters keyed by a hash, not by an address. Stripe receives what a payment needs — a billing identity and an amount — and never anything about mail.

3. Which of those regions we can prove

Every region in the table is one we have checked, and this section says how, because it is the part a careful reader should push on.

Four are pinned in source, so you can check them without asking us. eu-west-1 is enforced in the application’s configuration and inbound mail fails loudly if the region is wrong. Vercel’s execution region is dub1 — Dublin, which is eu-west-1 — set in vercel.ts; the platform’s default is Virginia, and leaving it at the default would have meant European mail being read and written from the United States on every request. The mail service’s region is declared in its deployment file. Plausible is an Estonian company processing in the European Union, with no region of ours to set.

Supabase, Upstash and Sentry are configured in their own dashboards rather than in our source, so we read them from each provider’s live configuration instead: the Supabase project is in eu-west-1, Sentry ingests into its EU region, and the Upstash database is in the European Union. Those were checked on 26 October 2026. A dashboard setting can change without a change to our code, so if your decision to use Pidgeon depends on one of them, write to privacy@pidgeon.ai and we will tell you what is configured on the day you ask.

We would rather publish that paragraph than a table that reads as finished.

4. Transfers outside the EEA

Two transfers leave the European Economic Area, and both are named rather than buried:

• The United Kingdom, where the SMTP and IMAP service runs. The UK has an adequacy decision from the European Commission, so this transfer needs no further mechanism.
• The United States, for the US-incorporated companies above where support or administration may reach them; processing itself is in the regions above. Each is covered by the European Commission’s Standard Contractual Clauses through that company’s own data processing agreement, and several are additionally certified under the EU–US Data Privacy Framework.

The mail itself is in Ireland. The one region that decides where your correspondence sits is the one we pinned first.

5. Changes to this list

We will give at least 30 days’ notice before adding a subprocessor or changing what an existing one does, by updating this page and its version date. Customers with a data processing agreement in place can subscribe to be told directly — write to privacy@pidgeon.ai — and may object on reasonable data-protection grounds under clause 6 of that agreement.

An emergency replacement — a provider failing, or being removed for a security reason — may happen faster than 30 days. We will say so when it does, and say why.