ZephyrAB subprocessors

Last updated: 2026-08-19.

A subprocessor is a third party that processes personal data on our behalf in

the course of providing ZephyrAB. This page lists all of them.

We publish this because GDPR Article 28(2) requires a controller to be informed

of subprocessors, and because a list that only appears when someone asks for it

is not a list anyone can rely on. **Material additions will be published here

before they take effect.**

1. Infrastructure

This is the whole platform, and it is in one country. Every virtual machine,

every FoundationDB cluster, every object store and every backup is in

Packetworx's Philippine facility. There is no other region — a fact stated

plainly in the disaster-recovery documentation as well, because it is a

resilience property as much as a legal one.

Consequences a controller should weigh:

• Personal data is stored and processed in the Philippines. For a controller

subject to the GDPR this is a transfer to a third country. The Philippines has

no European Commission adequacy decision, so such a transfer needs an

Article 46 safeguard — in practice Standard Contractual Clauses plus a

transfer impact assessment. [ARNOLD: confirm whether SCCs are in place with

Packetworx, and whether ZephyrAB intends to offer EU-region hosting. Until

one or the other exists, ZephyrAB should not be sold to controllers with EU

data subjects.]

• Packetworx is a related party. [ARNOLD: confirm the exact relationship and

state it here — common ownership between a processor and its subprocessor is

not a problem, but concealing it is.]

• Multi-region and data residency are a planned capability (gate G4C), not a

current one.

2. Domain name service

ZephyrAB operates its own authoritative nameservers (ns1–ns3.zephyrab.com)

for domains that delegate to us. zephyrab.com itself remains on GoDaddy.

3. Transport security

Note that issued certificates appear in public Certificate Transparency

logs, so the hostnames we serve are public by design. That is a property of the

Web PKI rather than a disclosure by us, but a controller running a

vanity-hostname deployment should know it.

4. Anti-abuse

The Spamhaus lookup is a DNS query containing the sender's IP address, made via

our own resolver at connection time. **No message content and no recipient

information is sent.** This is currently in observe mode.

5. Deliverability feedback

These are relationships in which data flows to us. They are listed because

enrolling in a feedback loop means a recipient's complaint about one of our

senders is shared between that provider and us.

6. Not subprocessors, and why

• Receiving mail providers (Gmail, Outlook, iCloud, Yahoo, Proton and every

other destination). When a user sends mail, the recipient's provider is an

independent controller acting on the recipient's behalf, not a processor

acting on ours. This is the same position every mail operator takes, and it

is why a subprocessor list cannot enumerate them.

• Monitoring and logging. Prometheus, Grafana, Loki, Tempo and Alertmanager

all run on our own infrastructure. No telemetry vendor sees our data.

• AI features. ZephyrAB can classify mail and draft replies using a language

model, and it supports three arrangements: an operator-run model, a user's own

endpoint, and a browser-direct mode in which the prompt never reaches our

servers at all. No AI backend is configured on this deployment, so no

model provider currently processes anything. If one is enabled it will be

added here first.

• GlockApps was used once, in August 2026, for a one-off inbox-placement

test using synthetic seed mailboxes. No user data was involved and the

relationship is not ongoing.

7. Operational contact

Alerting email is delivered to an operator address at Apple (iCloud). That

address receives operational alerts about the platform, which can incidentally

include a mailbox address in an error. It is listed for completeness rather

than because it processes user data in the ordinary course.

Changes