ReceiveHQ

Legal · Transparency

Sub-processors

ReceiveHQ (operated by Cortena B.V.) uses the approved sub-processors below. Core inbound mail content and application data are hosted in Germany; see also the hosting declaration and DPA.

Sub-processors · ReceiveHQ · last reviewed September 2026

1. Purpose

To provide transparency about third parties that may process customer data on Cortena's behalf when operating ReceiveHQ, in line with GDPR requirements.

2. Sub-processor list

Sub-processorCountryPurposeRetentionRemark
Hetzner Online GmbHGermanyCore infrastructure — dedicated servers and private Kubernetes hosting for ReceiveHQ application, databases, object storage, message bus, SMTP edge, and related platform dataDuration of contract—
Abusix.comUnited States / GermanyMetadata only — DNS lookups to validate the sender's mailserver and domain (no mail content)Query only (not stored by Cortena)If enabled

Inbound SMTP is terminated on Cortena-operated infrastructure hosted by Hetzner in Germany. Abusix.com is used only when DNS blocklists (DNSRBL) are enabled for a domain, and only for connection metadata (IP/domain), not message content. Customer-configured webhook destinations are under the Customer's control and are not Cortena sub-processors.

3. International transfers

All ReceiveHQ application and inbound mail content is stored and processed in Germany (Hetzner). When DNS blocklists are enabled, limited connection metadata (sender IP and/or domain) may be queried against Abusix.com; mail content is not transferred for that purpose.

4. Sub-processor changes

Cortena will notify customers at least 14 days before any new sub-processor is added or an existing one materially changes (and at least 30 days under the DPA objection process). Notification will be sent to the contact details provided in the applicable contract or DPA. Customers with an active DPA may object to new sub-processors within the notice period.

5. Contact