Subprocessors
Every company that touches your data on our behalf, what each one does, and where it does it.
A subprocessor is a company we hand data to in order to run the service. This page lists every one of them, what each does, and where it does it.
It is a list rather than a category. “Industry-standard cloud infrastructure providers” is the sentence a policy writes when it does not want you to count them, and counting them is the only thing this page is for.
1. Who processes what
| Subprocessor | Entity and country | What it does for us | Where it runs |
|---|---|---|---|
| Amazon Web Services | Amazon Web Services EMEA SARL, Luxembourg | Sends and receives mail (SES); stores raw originals and attachments (S3) | eu-west-1, Ireland |
| Supabase | Supabase, Inc., United States | Postgres database and authentication — accounts, messages, metadata | European Union — see §3 |
| Vercel | Vercel, Inc., United States | Hosts and serves the web application and the API | dub1, Dublin, Ireland |
| Fly.io | Fly.io, Inc., United States | Runs the SMTP and IMAP service — the part external mail clients talk to | lhr, London, United Kingdom |
| Upstash | Upstash, Inc., United States | Redis, holding rate-limit counters | See §3 |
| Sentry | Functional Software, Inc., United States | Error reporting — stack traces and the request path that produced them | See §3 |
| PostHog | PostHog, Inc., United States | Product analytics — server-side events about whether the product works | EU Cloud, eu.i.posthog.com |
| Stripe | Stripe Payments Europe, Ltd., Ireland | Payments and subscriptions, if you are on a paid plan | European Union and United States |
Two of these see message content and six do not. Amazon Web Services holds every byte of mail, because it is the mail provider and the object store. Fly.io runs the process that external clients submit and fetch mail through, so message bytes pass through it in transit. Supabase holds message bodies and metadata in the database. Everything below that line — Vercel, Upstash, Sentry, PostHog, Stripe — is deliberately kept away from correspondence, and §2 says how.
2. What the others are prevented from seeing
Sentry and PostHog are the two that would ordinarily drift into holding correspondence, and both are configured against their own defaults.
- No session recording, anywhere. Sentry Session Replay is not installed and PostHog autocapture is off. On this product the DOM is other people’s mail, so anything that records the screen is exfiltration with a dashboard.
- PostHog runs server-side only. It is not loaded in the browser, its identifiers are opaque, and its events carry ids and metadata — never a subject, an address or a body.
- Sentry gets stack traces with the sensitive parameters redacted,
sendDefaultPiioff, and the account’s email address removed before send. The mail service reports into a project of its own with an allow-list of attributes, message contents excluded outright, and addresses reduced to[address]@domainin error strings. - Sentry’s browser events go through our own origin, so no third-party host is added to the page’s connection policy.
Upstash holds counters keyed by a hash, not by an address. Stripe receives what a payment needs — a billing identity and an amount — and never anything about mail.
3. Which of those regions we can prove
Three rows above say “see §3”, and this is a section rather than a footnote because it is the part a careful reader should push on.
Four are pinned in source, so you can check them without asking us.
eu-west-1 is enforced in the application’s configuration and inbound mail
fails loudly if the region is wrong. Vercel’s execution region is dub1 —
Dublin, which is eu-west-1 — set in vercel.ts; the platform’s default
is Virginia, and leaving it at the default would have meant European mail
being read and written from the United States on every request. The mail
service’s region is declared in its deployment file. PostHog’s EU host is
checked at start-up and warns if it is pointed anywhere else.
Supabase, Upstash and Sentry are configured in their own dashboards rather than in our source, which means this page cannot state their regions with the same confidence and will not pretend to. Supabase holds the database in the European Union; the precise region, and those of the other two, are being confirmed and pinned, and this table gets each exact region when they are. If your decision to use Pidgeon depends on one of them, write to privacy@pidgeon.ai and we will tell you what is actually configured today rather than what we intend.
We would rather publish that paragraph than a table that reads as finished.
4. Transfers outside the EEA
Two transfers leave the European Economic Area, and both are named rather than buried:
- The United Kingdom, where the SMTP and IMAP service runs. The UK has an adequacy decision from the European Commission, so this transfer needs no further mechanism.
- The United States, for the US-incorporated companies above where support, administration or — in Sentry’s case, pending §3 — processing may reach them. Each is covered by the European Commission’s Standard Contractual Clauses through that company’s own data processing agreement, and several are additionally certified under the EU–US Data Privacy Framework.
The mail itself is in Ireland. The one region that decides where your correspondence sits is the one we pinned first.
5. Changes to this list
We will give at least 30 days’ notice before adding a subprocessor or changing what an existing one does, by updating this page and its version date. Customers with a data processing agreement in place can subscribe to be told directly — write to privacy@pidgeon.ai — and may object on reasonable data-protection grounds under clause 6 of that agreement.
An emergency replacement — a provider failing, or being removed for a security reason — may happen faster than 30 days. We will say so when it does, and say why.