- 1. Subprocessor oversight & Article 28(2) obligations
- 2. Complete authorized subprocessor register
- 3. Processing purposes & hosting locations
- 4. Notification mechanism for vendor additions
- 5. Customer right of objection & dispute procedures
- 6. Annual vendor due diligence & security audits
- 7. Frequently asked subprocessor questions
1. Subprocessor oversight & Article 28(2) obligations
Under GDPR Article 28(2), a Data Processor shall not engage another processor without prior specific or general written authorization of the Data Controller. Secuno LLC maintains rigorous vendor vetting protocols. We engage only reputable enterprise infrastructure providers that satisfy our stringent requirements for confidentiality, security, and data protection.
Each authorized subprocessor is bound by a legally enforceable contract imposing data protection obligations that are at least as stringent as those established in our own Master Customer DPA.
2. Complete authorized subprocessor register
The table below details all third-party entities authorized to process data on behalf of MailCheckup:
| Subprocessor Legal Name | Service Role | Data Categories Processed | Processing Location | Safeguards & Compliance |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Primary Cloud Hosting & Storage | Account data, API keys, uploaded CSV lists, verification reports | United States (us-east-1, N. Virginia) | SOC 2 Type II, ISO 27001, AWS Customer DPA with EU SCCs |
| Cloudflare, Inc. | Edge Anycast CDN & DDoS Mitigation | HTTP request headers, client IP addresses, TLS handshake data | Global Edge Network (275+ cities) | SOC 2 Type II, ISO 27001, Cloudflare DPA with EU SCCs |
| Stripe, Inc. | Payment Gateway & Billing Infrastructure | Customer billing tokens, transaction amounts, payment country | United States & European Union | PCI-DSS Level 1 Service Provider, Stripe Customer DPA |
| Equinix, Inc. / Tier III+ Colocations | Distributed SMTP Edge Dialers | Destination domain strings & recipient mailboxes (ephemeral RAM) | North America & Western Europe | SOC 1/SOC 2 Type II, ISO 27001, Hardware isolated racks |
3. Processing purposes & hosting locations
Our infrastructure is geographically optimized to ensure sub-180ms verification latency while maintaining strict data sovereignty:
- Primary Hosting: Amazon Web Services (AWS) us-east-1 region (Northern Virginia, United States) houses all persistent database clusters, queue workers, and S3 list storage buckets.
- Edge Security: Cloudflare operates globally across 275+ edge points of presence, providing DDoS protection and SSL/TLS termination without persistent data caching.
- Billing Services: Stripe provides PCI-DSS Level 1 certified checkout workflows. Credit card credentials bypass Secuno LLC servers entirely.
4. Notification mechanism for vendor additions
Whenever Secuno LLC intends to engage a new subprocessor or replace an existing provider, we will provide at least thirty (30) calendar days advance written notice by sending an email notification to workspace account owners and publishing an advisory on our official status page.
5. Customer right of objection & dispute procedures
If Customer has reasonable, objective data protection concerns regarding a newly announced subprocessor, Customer may submit a formal written objection to privacy@mailcheckup.net within thirty (30) calendar days of notice.
Upon receiving an objection, Secuno LLC will evaluate potential technical workarounds. If no mutually acceptable compromise is achievable within thirty (30) days, Customer may terminate the affected services without penalty and receive a pro-rata refund of unconsumed credits.
6. Annual vendor due diligence & security audits
Our security engineering and legal compliance teams review our subprocessor inventory on an ongoing basis. We verify current SOC 2 Type II reports, ISO 27001 certifications, penetration testing summaries, and business continuity readiness annually.
7. Frequently asked subprocessor questions
Where is customer verification data physically stored?
All customer account databases, uploaded verification CSV files, and generated export reports are hosted exclusively within Amazon Web Services (AWS) facilities located in the United States (us-east-1 region, Northern Virginia).
Does MailCheckup use external AI models (e.g. OpenAI) to process customer lists?
No. MailCheckup does NOT feed, share, or submit customer contact lists, email strings, or uploaded datasets to third-party artificial intelligence platforms (such as OpenAI, Anthropic, or Google Gemini) for training, verification, or scoring.
How are customers notified when a new subprocessor is added?
Under Section 5 of our Data Processing Addendum, Secuno LLC provides at least thirty (30) calendar days advance written notice via email to workspace account administrators and through an announcement on our status dashboard before engaging any new infrastructure subprocessor.
How can an enterprise customer object to a proposed subprocessor?
Customers may object to a new subprocessor on reasonable data protection grounds by submitting a written objection to privacy@mailcheckup.net within thirty (30) calendar days of notice. If a mutually acceptable resolution cannot be reached, the customer may terminate their subscription without penalty.
Are edge dialers used to send marketing emails?
Never. Our distributed SMTP edge dialers located in Tier III+ Equinix facilities execute solely RFC 5321 diagnostic socket checks (HELO, MAIL FROM, RCPT TO, QUIT). They never transmit message bodies or send marketing emails.
What due diligence does Secuno LLC conduct on prospective subprocessors?
Every vendor undergoes formal security assessments verifying SOC 2 Type II or ISO 27001 certifications, data processing agreements incorporating EU Standard Contractual Clauses, least-privilege access controls, and zero secondary data usage commitments.