Subprocessor List
Last Updated: August 20, 2026
AlecRae ("AlecRae") uses certain third-party service providers ("Subprocessors") to assist in providing the AlecRae platform. These Subprocessors may process personal data on behalf of our customers in accordance with our Data Processing Agreement and applicable data protection laws. This page lists every current and planned Subprocessor, the nature of their services, and the data they process. AlecRae is in a pre-launch preview; no customer mail is sent or received yet, so the transport and billing providers below are listed ahead of use.
1. Current Subprocessors
The following Subprocessors are authorized to process personal data on behalf of AlecRae customers. All processing takes place in the United States.
Subprocessor
Purpose
Location
Data Processed
Vultr
Cloud servers that host the AlecRae web application, API, database and mail handling
United States (Chicago)
All customer data including email content, metadata, attachments, account information
Vapron
Email transport platform: routes inbound and outbound mail for domains hosted on AlecRae
United States
Messages in transit: sender and recipient addresses, headers, subject, body and attachments
Resend
Outbound email delivery during sending warm-up
United States
Outbound messages in transit: sender and recipient addresses, headers, subject, body and attachments
Anthropic
AI features (Claude API): triage, drafting, summarising and other AI actions you invoke
United States
The message content you choose to run an AI feature on. Anthropic states that API inputs are not used to train its models
Google (Google LLC)
Connected-account sync, only if you connect a Google account (OAuth)
United States
OAuth tokens; the mailbox data you authorise us to read
Microsoft
Connected-account sync, only if you connect a Microsoft account (OAuth)
United States
OAuth tokens; the mailbox data you authorise us to read
Stripe, Inc.
Payment processing, billing and subscription management, when billing is live
United States
Billing name, email address, payment method details, transaction history
Cloudflare, Inc.
DNS for alecrae.com only; does not proxy or inspect traffic
United States (global DNS network)
DNS queries for our domain names; no customer data
GitHub
Source-code hosting and continuous integration
United States
Source code and build logs; no customer data
2. Change Notification Process
AlecRae is committed to transparency regarding its use of Subprocessors. When we engage a new Subprocessor or make material changes to an existing Subprocessor's scope of data processing, we will notify customers through the following mechanisms:
a.
Email Notification. We will send an email notification to the account owner and designated data protection contact (if configured) at least 30 days before the new Subprocessor begins processing customer data.
b.
This Page. Changes are published on this page. This Subprocessor List will be updated with the new or modified Subprocessor details, and the "Last Updated" date will reflect the most recent change.
3. Objection Procedure
If you have a legitimate objection to our use of a new or modified Subprocessor, you may exercise your right to object as follows:
a.
Objection Window. You must submit your objection in writing within 30 calendar days of receiving the change notification. Objections must be sent to [email protected] and must include a detailed explanation of the specific, reasonable grounds for the objection based on data protection concerns.
b.
Resolution Process. Upon receiving a valid objection, AlecRae will work in good faith to address your concerns. This may include: (i) providing additional information about the Subprocessor's data protection measures; (ii) implementing additional safeguards or restrictions on the Subprocessor's processing activities; or (iii) offering a commercially reasonable alternative configuration that avoids the use of the objected-to Subprocessor for your data.
c.
Escalation. If the parties are unable to resolve the objection within 30 days of the objection being raised, either party may escalate the matter in accordance with the dispute resolution provisions of the Data Processing Agreement. In certain circumstances, if resolution is not possible, you may have the right to terminate the affected services without penalty, subject to the terms of the DPA.
4. Data Protection Measures
We require each Subprocessor, under its service terms or a data processing agreement, to:
(i)
Processing personal data only on documented instructions from AlecRae
(ii)
Implementing appropriate technical and organizational security measures
(iii)
Maintaining confidentiality obligations for all personnel with access to personal data
(iv)
Assisting AlecRae in responding to data subject rights requests
(v)
Deleting or returning all personal data upon termination of services
(vi)
Submitting to audits and inspections as required by applicable data protection laws
All Subprocessors are located in the United States. For personal data of EEA and UK residents, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our Data Processing Agreement and required of each Subprocessor.
Changes to this list are published on this page; account owners are also notified by email as described in Section 2.
For questions about our Subprocessors or data processing practices, contact our Data Protection Officer at [email protected].