isBusinessEmail is operated by Tilfortis MB (Lithuania). These are the service providers that may process personal data for us, both for our own processing (see the Privacy Policy) and on behalf of API customers (see the DPA).
Current list
| Provider | Purpose | Data involved | Location | Transfer safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting of website and API (Workers), CDN, WAF, DDoS protection, rate limiting, Turnstile bot protection, key-value and Durable Object storage, analytics storage, DNS-over-HTTPS resolution of domains, email routing, secure tunnel to our database | Requests in transit (including email addresses being checked, processed in memory), IP addresses, request metadata, domain-level data | Global edge network; USA-based company | Data Privacy Framework where certified; Standard Contractual Clauses |
| Hetzner Online GmbH | Database servers and encrypted backups | Account data, usage, consent records, domain-level data, hashed identifiers | Germany / Finland (EU) | Within the EU |
| Brevo | Sending service emails (sign-in links, notices) | Account email address, name, email content and delivery status | EU (France) | Within the EU |
| Sign in with Google; Google Analytics 4 (only with consent); fallback DNS-over-HTTPS resolution of domains | Sign-in identifiers, analytics data, domain names | USA / EU | Data Privacy Framework where certified; Standard Contractual Clauses | |
| Microsoft | Sign in with Microsoft | Sign-in identifiers (including tenant ID) | USA / EU | Data Privacy Framework where certified; Standard Contractual Clauses |
| Slack (Salesforce group) | Internal notifications to our team about new sign-ups and limit hits | Account name, email, our verdict on that email, country | USA | Data Privacy Framework where certified; Standard Contractual Clauses |
Domain lookups to public infrastructure (DNS resolvers, RDAP registries, Microsoft’s public tenant discovery, and a domain’s own website when deep=true is requested) contain the domain only, never the full email address.
Changes to this list
We give at least 14 days’ notice before adding or replacing a subprocessor that processes customer personal data, by updating this page and emailing account owners who’ve asked to be notified. To subscribe, or to object to a change, write to privacy@isbusinessemail.com.
Changes
| Version | Changes |
|---|---|
| 2026-10-04 | First version. |