Subprocessors
Last updated 17 October 2026
Carrier Grade Inc. uses the following third parties to run Testlie. They may process Customer Data or account data as described in our data processing addendum and privacy policy. We give at least 30 days' notice of new subprocessors on this page; to be told by email, write to hello@testlie.com.
Infrastructure and services
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Servers, storage, the database and backups that run the Service, including captured content and attachments | All Customer Data and account data | EU (Ireland) |
| Resend (Plus Five Five, Inc.) | Sending email from the Service: address verification, password resets, invitations, forwarding confirmations, welcome emails, product tips, trial reminders and confirmed forwards | Recipient addresses; the content of those emails, including forwarded messages | EU (Ireland) |
| Stripe, Inc. | Billing and payment processing for paid plans | Billing contact, address and payment details | United States |
| Cloudflare, Inc. | Public website hosting and delivery, DNS, compatibility forwarding for existing API and mock URLs, and routing of mail sent to our contact addresses | Website request metadata; metadata and content of requests forwarded through existing testlie.com integration endpoints; domain lookups; messages sent to our contact addresses | Global |
Hosting disclosure updated 19 October 2026: application and database storage remain on AWS in Ireland. Requests sent directly to app.testlie.com reach the AWS application; existing integration URLs on testlie.com pass through Cloudflare before reaching it. The compatibility Worker does not persist request URLs, headers or bodies in its application logs.
DNS blocklist lookups during spam checks
When a spam check runs on a captured email (you open its spam report, call the spam report API, or turn on automatic spam checks for an inbox), SpamAssassin's network tests query public DNS blocklist and reputation services directly from our servers. The queries contain the IP addresses in the message's Received headers and the domain names of the sender and of links in the message, in plain form, and some rules may send a hash of an email address. No message content and nothing that identifies you or your team is sent.
| Service | Data | Location |
|---|---|---|
| The Spamhaus Project (Spamhaus Technology Ltd.) | IP addresses and domain names from captured messages, as DNS queries | Global (DNS) |
| URIBL (uribl.com) | Domain names from links in captured messages, as DNS queries | Global (DNS) |
| Other DNS blocklists in SpamAssassin's standard rules, such as SURBL, DNSWL, SpamCop and Mailspike | IP addresses and domain names from captured messages, as DNS queries | Global (DNS) |
Not subprocessors
- Our product analytics (Umami) are self-hosted on the same infrastructure as the Service, listed above, and receive no Customer Data, so they add no subprocessor. See the privacy policy.
- The Service does not send Customer Data to analytics, advertising or error-tracking services.
- API mocks and payment gateways are simulations that run entirely on the infrastructure listed above. They never contact the companies whose APIs they emulate (such as Stripe, Adyen, PayPal, DocuSign, Onfido, Lean Technologies or Segment), so those companies receive no Customer Data and are not subprocessors for these features. Stripe appears above only as the processor of Testlie's own subscription payments.
- Destinations your team configures, such as webhook URLs, Slack or Microsoft Teams integrations, your application's endpoints and forwarding addresses, receive data on your instructions and are not our subprocessors.