Subprocessors List
Version 1.0 · Last updated: October 2, 2026
| Change notice | 14 days' advance notice to the Customer (see DPA §6.2) |
|---|
1. Introduction
Destinatarium uses third-party providers ("Subprocessors") for certain components of its infrastructure and Service. Destinatarium enters into data processing agreements with its Subprocessors and requires appropriate technical and organizational measures under the GDPR, LGPD, and Law 25,326.
This list is updated when Subprocessors are added, changed, or removed. Customers receive at least 14 days' advance notice of changes under the current DPA.
2. Infrastructure and hosting
| Subprocessor | Country | Purpose | Data processed | Legal framework | Status |
|---|---|---|---|---|---|
| Hivelocity hivelocity.net | United States | Hosting of MTA (Postal) infrastructure, dedicated IPs, and outbound email delivery | Sending metadata, IPs, and delivery logs | SCCs / own DPA | Active |
| Primary VPS / cloud provider (to be determined) | To be confirmed | Hosting of the Express.js application and primary database | Account data, settings, and application logs | Assessment pending | Pending |
3. Email delivery engine
| Subprocessor | Country | Purpose | Data processed | Legal framework | Status |
|---|---|---|---|---|---|
| Postal MTA (self-hosted) postal.codes | Argentina | Email delivery engine; queue, bounce, and feedback-loop management. Destinatarium-owned infrastructure. | Sending metadata, recipients, and delivery logs | Own infrastructure | Active |
Note: Using a self-hosted Postal MTA shortens the Subprocessor chain. Destinatarium does not rely on a third party for actual email delivery, providing greater privacy and operational control.
4. Payments and billing
| Subprocessor | Country | Purpose | Data processed | Legal framework | Status |
|---|---|---|---|---|---|
| Stripe, Inc. stripe.com | United States | Payment processing, subscription management, and recurring billing | Name, email, tokenized card data, and transaction history | PCI DSS / Stripe DPA | Active |
| LATAM payment alternative (MercadoPago / Lemon / to be confirmed) | Argentina / LATAM | Payment processing for LATAM customers | Billing and payment data | Assessment pending | Pending |
5. Monitoring and observability
| Subprocessor | Country | Purpose | Data processed | Legal framework | Status |
|---|---|---|---|---|---|
| Error-monitoring tool (Sentry or alternative — to be confirmed) | United States | Real-time application error detection and reporting | Error logs and stack traces (without final-user Personal Data) | DPA pending | Pending |
| Analytics / metrics tool (to be determined) | To be confirmed | Platform usage metrics, uptime, and system performance | Aggregated or anonymized usage data | Pending | Pending |
6. Customer support
| Subprocessor | Country | Purpose | Data processed | Legal framework | Status |
|---|---|---|---|---|---|
| Support ticket system (Freshdesk / Intercom / to be determined) | To be confirmed | Technical support request management and Customer communications | Name, email, issue description, and support history | DPA pending | Pending |
7. Destinatarium's obligations concerning Subprocessors
For every Subprocessor, Destinatarium ensures:
- A DPA is signed before Processing begins.
- Technical and organizational measures equivalent or superior to those required by the Customer DPA.
- Audit rights or independent third-party certifications.
- Corrective measures, including replacement, in the event of breach.
- No engagement of sub-subprocessors without Destinatarium's prior authorization.
Warning — pending entries: Fields marked "Pending" represent Subprocessors that have not yet been formalized. Each pending entry is an active legal risk that must be resolved before commercial launch.