Sub-processors
- Service
- IXmail (ixmailer.com)
- Last updated
- 16 May 2026
- Version
- 1.0
Authorised sub-processors
This page lists every third party Innovatex Digital FZCO engages to help us provide the IXmail service. The list is authoritative — it's what we update when adding or removing a sub-processor, and it's what the Data Processing Agreement (§5.2) and Privacy Policy (§4.1) reference.
Each sub-processor is bound by contractual data-protection terms no less protective than our DPA, and is selected based on the security posture and data-protection track record appropriate to the data they handle.
Per DPA §5.4, we will notify Customers of intended changes to this list with at least 30 days' notice via email or in-product. Customer objections within 15 days can be raised via privacy@innovatex.ae; if a material objection cannot be resolved, the Customer may terminate the affected portion of the Service.
Cloudflare, Inc.
- Purpose
- CDN, DNS, edge security, TLS termination
- Data categories
- Connection metadata (IP, headers, request timing)
- Processing location
- Global edge — primarily USA
- Transfer mechanism
- SCCs (Module Two) + UK IDTA
- Vendor URL
- https://www.cloudflare.com
Cloudflare R2
- Purpose
- Object storage — inbound email raw MIME + attachments, Postgres off-site backups
- Data categories
- Email content + attachments uploaded by recipients to customer inbound addresses; encrypted database snapshots
- Processing location
- WEUR (Frankfurt / Amsterdam region)
- Transfer mechanism
- SCCs (Module Two)
- Vendor URL
- https://www.cloudflare.com/products/r2
Stripe, Inc.
- Purpose
- Payment processing, fraud signals (Stripe Radar), tax calculation
- Data categories
- Customer billing identity, card token (we never see PAN), invoice metadata
- Processing location
- USA + Ireland
- Transfer mechanism
- SCCs (Module Two) + UK IDTA
- Vendor URL
- https://stripe.com
Twilio, Inc.
- Purpose
- SMS verification at signup (when triggered) — Twilio Verify / Lookup APIs
- Data categories
- Phone number, country, one-time code delivery metadata
- Processing location
- USA
- Transfer mechanism
- SCCs (Module Two)
- Vendor URL
- https://www.twilio.com
Vonage (Nexmo)
- Purpose
- SMS verification at signup — regional failover for Twilio (when triggered)
- Data categories
- Phone number, country, one-time code delivery metadata
- Processing location
- UK + USA
- Transfer mechanism
- SCCs (Module Two) + UK IDTA
- Vendor URL
- https://www.vonage.com
Sumsub (Sum and Substance Ltd.)
- Purpose
- Know-Your-Customer verification — triggered only for dedicated IP requests, >1M/mo volume tier upgrades, white-label reseller arrangements, or accounts flagged by abuse monitoring
- Data categories
- Identity document images, biometric liveness, business registration documents
- Processing location
- United Kingdom
- Transfer mechanism
- UK IDTA + SCCs (Module Two)
- Vendor URL
- https://sumsub.com
Mailjet / Mailgun
- Purpose
- Transactional system mail (account verification, billing receipts, operator alerts) — does NOT process customer recipient mail
- Data categories
- IXmail customer email addresses for system-generated messages only
- Processing location
- EU (France) / USA
- Transfer mechanism
- SCCs (Module Two)
- Vendor URL
- https://www.mailjet.com
IXnodes (Innovatex affiliate)
- Purpose
- Cloud hosting and compute infrastructure for the IXmail service
- Data categories
- All Customer Data processed by the Service runs on IXnodes infrastructure
- Processing location
- Germany + Singapore + UAE
- Transfer mechanism
- Innovatex group company; intra-group data-sharing agreement
- Vendor URL
- https://ixnodes.com
Right to object
Per DPA §5.4, Customers may object on reasonable grounds to the addition of a new sub-processor within 15 days of our notice. Send objections to privacy@innovatex.ae with the sub-processor name and the basis for objection.
If we cannot resolve the objection (for example, by routing the Customer's data around the sub-processor where technically feasible), the Customer's exclusive remedy is to terminate the affected portion of the Service per DPA §5.4 and the underlying Terms of Service §12.
Contact
- Privacy: privacy@innovatex.ae
- Legal: legal@innovatex.ae