Data processing agreement
The processor terms, the sub-processors, and the transfer mechanism.
Roles and scope
You are the controller of the personal data in your contacts, your recipients and your message content. MailHaap is the processor. We process that data only on your documented instructions, which are: to deliver the messages you send, to record the events those messages generate, and to operate the suppression and consent records that keep both of us compliant.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Outbound delivery and key management | eu-central-1 (Germany) |
| Cloudflare | Edge, CDN, object storage, tracking worker | EU jurisdiction |
| Hetzner | Compute and databases | Germany and Finland |
| Stripe | Billing and payment processing | EU / US, SCCs in place |
| MaxMind | Geolocation database licence | No data transferred — the database is a local file |
The geolocation note matters
Transfers
Production data stays in the EU by default. Where a sub-processor's group includes entities outside the EEA, transfers are covered by Standard Contractual Clauses with the supplementary measures the platform already implements: encryption at rest with keys held separately from the storage provider, no standing human access, and full audit logging of every decryption.
Security measures
- Envelope encryption with a per-workspace key, bound to the workspace by additional authenticated data — a ciphertext moved between workspaces fails to decrypt.
- Row-level security enforced in the database, so even a query missing its tenant clause returns nothing.
- No standing production access. Access is time-boxed, request-based, approved by a second person, and session-recorded.
- Mandatory two-factor authentication for any account that can send or manage domains.
- Continuous backups to a different provider than production storage, with monthly timed restore drills.
Breach notification
Detection, containment, assessment within 24 hours, and notification to affected controllers within 48 hours — giving you a full day inside your own 72-hour obligation. The contact tree and the notification templates are written in advance, because writing them during an incident is how deadlines get missed.