Subprocessors
Last updated: 2026-09-17
skink relies on a small set of third-party service providers ("subprocessors") to run the service. This page describes the categories we rely on and, for each, whether it ever receives the email addresses you submit for verification — the question that actually matters for your data — along with where processing happens and the transfer safeguard applied.
We don't publish vendor names or a per-vendor infrastructure map: a named list adds targeting information (hosting provider, region, email vendor) for attackers without adding privacy protection for you. A current, named Subprocessor Register is maintained under our DPA and is available to customers and prospective customers on request at privacy@skink.dev.
Current subprocessor categories
| Category | Purpose | Receives recipient addresses? | Processing locations | Transfer safeguard (EEA/UK origin) |
|---|---|---|---|---|
| Application hosting | Runs the API, verification engine, and scoring service | Yes — in memory during verification; encrypted or hashed at rest per your retention setting | United States | EU SCCs (Module Two) / UK Addendum + transfer risk assessment |
| Database hosting | Operates the primary managed database | Yes — same at-rest rules as application hosting | Japan (Asia-Pacific) | EU SCCs (Module Two) / UK Addendum + transfer risk assessment |
| SMTP probing capacity | Additional outbound verification capacity | Yes — in memory during probing only; not a storage destination | Germany, United States | SCCs where non-EEA; Germany needs none |
| Object storage | Bulk CSV upload/result files; encrypted off-site database backups (disaster-recovery only, never customer-accessible) | Yes — the file you upload contains the addresses you're verifying; backups mirror the primary database under your retention setting | Global network | EU SCCs (Module Three, processor-to-processor) / UK Addendum |
| Transactional email delivery | Sign-in links and account notices | No — only your own account email, never your uploaded list | European Union, United States | SCCs where non-EEA/UK |
| Payment processing / merchant of record | Billing and checkout | No — billing and payment details only | Global (United States-centric) | EU SCCs / UK Addendum + PCI DSS |
| Uptime monitoring | External availability checks of public endpoints | No — public health endpoints only, no customer data | Global | SCCs where non-EEA/UK |
| Landing-site hosting/CDN | Serves the marketing site | No — no customer data flows through it | Global | Not applicable (no personal data of customers) |
What we deliberately don't list here
Anything configured but not wired into a live code path isn't a subprocessor yet — we don't publish a category for a feature that isn't running.
Changes, notice, and your right to object
- We give customers 30 days' advance notice before adding or replacing a subprocessor, via email to the account owner (subscribe at
privacy@skink.devto be added to the notice list). - If you object to a new subprocessor and we can't resolve your objection, you may terminate the affected portion of the service — this is the DPA's agreed remedy.
- skink remains fully liable for each subprocessor's performance of our data-protection obligations, as required by GDPR Article 28(4) and Clause 9 of the Standard Contractual Clauses (Option 2, general written authorization).
- The material change history of these categories is the table below.
Change log
| Date | Change | Notes |
|---|---|---|
| 2026-09-17 | Categories upgraded with locations + transfer safeguards; 30-day notice and objection mechanics published | Named Register moved under the DPA, available on request |
| 2026-09-17 | Moved from named vendor list to category-based disclosure | Added the database-hosting category, which the previous list omitted in error |
| 2026-09-14 | Initial publication | — |
Contact
Questions about this page: privacy@skink.dev.