Legal
Sub-processors
The third parties that help us run Ṣọ Email Security, what each one does, and exactly what data each one receives.
A sub-processor is an outside company that handles data on our behalf so we can run the product. If we use a supplier for hosting, payments, sign-in, or sending email, that supplier is a sub-processor. This page names every one of them.
Our Data Processing Addendum refers to this page as the current list. Our Privacy Policy explains what we collect and why. Where a signed agreement names a different list, the signed agreement applies to that customer.
SO Labs Inc. is based in Calgary, Alberta, Canada. Our primary privacy framework is PIPEDA. Canada currently benefits from an EU adequacy decision for commercial organisations subject to PIPEDA.
01Current Sub-processors
This is the full list of third parties that receive data from our services today. It reflects what our code actually calls, not what appears in configuration.
| Provider | What they do for us | What data they receive | Location |
|---|---|---|---|
| Amazon Web Services (EC2) | Hosting and infrastructure for the platform and the API | Account records, usage and billing metadata, and any data our services hold at rest | Canada. Exact region to confirm |
| Stripe | Payment processing and subscription billing | Billing data only. Never email content | To confirm |
| Have I Been Pwned (HIBP) | Dark web breach monitoring | The user's email address only. No passwords. No email content | To confirm |
| Google (Gmail API, Google OAuth) | Mailbox access and sign-in | The mailbox access the user authorises, and basic profile information | To confirm |
| Microsoft (Graph API, Microsoft OAuth) | Mailbox access and sign-in | The mailbox access the user authorises, and basic profile information | To confirm |
| Apple (Sign in with Apple) | Authentication only | Authentication identifiers | To confirm |
| SMTP email provider (used via nodemailer) | Transactional email delivery, such as verification, alerts, and billing notices | The recipient email address and the content of the message we send | To confirm |
| Wise | Referral programme payouts only | The payout details a recipient gives us for that purpose | To confirm |
| Cloudinary | Hosts the images embedded in our outbound email templates | No user data | To confirm |
| Our own machine learning classifier service | Email threat analysis. Returns a verdict and stores nothing | Email subject and body, held in memory only | Our own infrastructure. Region to confirm |
A few points worth stating plainly, because reviewers ask about them every time.
- ▸Have I Been Pwned gets an email address and nothing else. No password, no password hash, and no email content is ever sent there.
- ▸Cloudinary receives no user data. It serves the logo and illustration files that our email templates link to. We do not send it any personal data.
- ▸Stripe never sees email content. It receives the billing data needed to charge a subscription.
- ▸The classifier is ours, not an outside company. It is listed for completeness so the picture is complete. Once the pending backend change ships, email content is analysed in memory and is not written to persistent storage. The one exception is content a user voluntarily submits when reporting a false positive, which is encrypted at rest and deleted after 90 days.
- ▸Locations marked “to confirm” are not guesses. We would rather leave a cell honest than fill it with something we have not verified. We will update this page as each one is confirmed.
02The Ṣọ Shield API Uses No External Third Parties
The Ṣọ Shield API service calls no external third parties at all.
Content you submit to the API, including email bodies, headers, documents, URLs, and images, never leaves our infrastructure. It is not sent to a threat intelligence vendor, a reputation service, or any other outside company for analysis. The analysis runs on our own systems and the result is returned to you.
The providers in the table above support the wider platform, for example hosting, billing, sign-in, and outbound email. They are not in the path of an API analysis request. If that ever changes, we will announce it under Section 04 before it takes effect.
The API Terms set out the rest of the arrangement, including roles, retained request metadata, and the limits of automated detection.
03Not Used
Two services appear in older configuration files but are not called by any code path. They receive no data from us, so they are not sub-processors and are deliberately left off the list above.
- ▸VirusTotal. Present in configuration. Never called. Receives no data.
- ▸Google Safe Browsing. Present in configuration. Never called. Receives no data.
We state this openly so a reviewer who finds those names in a config file does not assume data is going to them. If we start calling either service, we will add it to the table above and announce it in advance.
04How We Announce Changes, and How to Object
- ▸Advance notice. We email enterprise and API customers who subscribe to these updates at least 30 days before a new sub-processor starts processing data.
- ▸This page is updated too. The table and the date at the bottom change at the same time, so you can check the current position at any point.
- ▸Subscribing. Email privacy@soemailsecurity.com with the subject “Sub-processor updates” and tell us which address to notify.
- ▸Objecting. Reply to the notice, or email the same address, within the notice period. Tell us the data protection grounds for the objection. We will work with you to find a fix, such as a different provider or a change to the configuration.
- ▸If we cannot resolve it. You may terminate the affected service under the terms of your agreement. Your signed agreement and our Data Processing Addendum set out how that works.
- ▸Emergency replacements. If we must replace a provider quickly, for security or because a provider fails, we will act first and tell subscribers as soon as we can with the reason.
Governing law, jurisdiction, and dispute resolution are set out in our Terms of Service.
05Questions and Last Updated
- ▸Privacy and sub-processor questions: privacy@soemailsecurity.com
- ▸Security questions: privacy@soemailsecurity.com
- ▸Enterprise, MSP, and API enquiries: sales@soemailsecurity.com
- ▸Product support: support@soemailsecurity.com
- ▸Mailing address: SO Labs Inc., 7909 Flint Rd SE #202, Calgary AB T2H 1G3, Canada
Last updated: July 25, 2026.