AegeanAll legal docs

Subprocessors

This page lists every external party data may transit through, plus the legal basis for each transfer. Customers are notified at least 30 days before any new subprocessor is engaged or replaced.

Active subprocessors

Infrastructure

  • Contabo GmbH — Frankfurt, Germany. Provides the production VPS hosting all Aegean compute, storage, and networking. All Customer personal data at rest and in transit on Aegean infrastructure resides here. Within EU/EEA — no Chapter V transfer mechanism required.
  • Hetzner Online GmbH — Falkenstein, Germany. Provides the development VPS. No Customer production data lives on this host; it carries developer-test traffic only. Within EU/EEA — no Chapter V transfer mechanism required.

Telephony (engaged at SMS feature activation only)

  • Telnyx LLC (or equivalent EU-presence carrier, finalised on first SMS customer) — provides phone-number provisioning and SMS message delivery. Recipient phone numbers and message body transit the carrier. Where the carrier’s primary processing is in the United States, Standard Contractual Clauses (Commission Decision 2021/914) are in place. Not engaged for any customer that has not enabled SMS.

Customer-controlled subprocessors

These are technically subprocessors, but the Customer chooses and controls them — Aegean only forwards data per the Customer’s configuration:

  • Webhook destinations — every webhook URL the Customer registers in the dashboard receives signed payloads at message-event time. The Customer is responsible for ensuring those endpoints have an appropriate legal basis to receive the data.
  • Custom sender domains — once verified, message dispatch routes through the Customer’s domain’s DNS and recipient MX servers, which are outside Aegean’s direct control.

Self-hosted components (not third-party subprocessors)

  • Bundled Postfix relay (aegean-postfix-relay container, boky/postfix + OpenDKIM) — outbound SMTP routing, runs on Aegean infrastructure.
  • SeaweedFS object store (aegean-object-store) — templates, attachments, account-export bundles. Self-hosted on Aegean infrastructure.
  • PostgreSQL — primary datastore; self-hosted.
  • Redis — cache; self-hosted.

Notification policy

When Aegean adds, changes, or removes a subprocessor:

  • The change is committed to this page in the Aegean repository (PR + review).
  • An email goes to all Customer admin contacts at least 30 days before the change takes effect.
  • The notice includes: the new subprocessor’s name, jurisdiction, role, and transfer mechanism.
  • Customers may object on reasonable data-protection grounds; if Aegean cannot accommodate the objection (e.g., the subprocessor is a critical infrastructure provider), the Customer may terminate without penalty.

Removed subprocessors

None to date. A chronological changelog will appear here when the first removal occurs.