Data Processing Agreement & Sub-processors
Last updated: 2026-05-06
If you are an EU/UK/Swiss data controller or a CCPA-covered business, this page documents the sub-processors Elite Webmail engages and the controls in place. Customers requiring a signed DPA may request the standard agreement at privacy@elitewebmail.net; we offer the EU SCCs and UK Addendum as required.
Sub-processors
| Sub-processor | Purpose | Region |
|---|---|---|
| Resend | Outbound email delivery; webhook events for opens, clicks, bounces, complaints. | USA |
| Anthropic | AI features (subject lines, copy generation, automation suggestions). | USA |
| Vercel | Web hosting and CDN for marketing site and dashboard. | USA |
| DigitalOcean | Backend application server and database. | USA (NYC) |
Notice of changes
We post changes to this list 30 days before they take effect. To receive notification, email privacy@elitewebmail.net with the subject line "Subscribe to sub-processor changes."
Security controls
- Passwords stored as bcrypt hashes; sessions HMAC-signed with rotating secret.
- Database encrypted at rest; transport TLS 1.2+.
- Per-account suppression isolation; rate-limited login + signup endpoints.
- Webhook signature verification (Svix HMAC, ±5min replay window).
- Sessions invalidated automatically on password reset.
International transfers
All sub-processors operate in the United States. For EU/UK/Swiss customers, transfers occur under the EU Standard Contractual Clauses and UK International Data Transfer Addendum.