Sub-processors
This list is current as of 9 September 2026. When it changes materially, the change is published on this page.
Tratto is the data controller for the data you give us directly (the waitlist and the founding-member form). When you send email through Tratto, we are your data processor and you are the controller. Either way, running the service means other providers touch that data. Here is every one of them.
| Sub-processor | What it does | Where the data is |
|---|---|---|
| Google Cloud — Firebase App Hosting / Cloud Run | Runs this website and the Tratto API. Sees every request made to either. | europe-west1 (Belgium) |
| Google Cloud — Firestore | The application database: accounts, contacts, campaigns, email records, and the waitlist itself. | eur3 (EU multi-region) |
| Google Cloud — BigQuery | Stores email event data (delivery, open, click, bounce) for the analytics in the dashboard. | europe-west1 (Belgium) |
| Amazon Web Services — SES | Delivers the email. Recipient address, subject and message body pass through it on every send. | eu-west-1 (Ireland) |
| Upstash — Redis | Holds rate-limiting counters. The key is a truncated SHA-256 of the visitor's IP address, the value is a number, and it expires after one hour. Nothing else is written. | AWS eu-west-1 (Ireland), primary region. The database is an Upstash Global instance, so requests are routed to the nearest endpoint — from Italy that resolves into AWS eu-central-1 (Frankfurt). Both regions are in the EU. |
| Google Analytics, via Google Tag Manager | Measures how this website is used. The Tag Manager container is not requested at all until you accept analytics cookies: decline, and no request ever reaches Google. | Google's global infrastructure, including the United States |
What is not on this list
Fonts. Inter, DM Serif Display and JetBrains Mono are downloaded at build time and served from tratto.email, so opening a page here sends nothing to Google Fonts.
Certifications
Tratto holds no SOC 2 report and no ISO 27001 certificate. Any certification held by the providers above is theirs, not ours, and is published on their own trust pages.
Questions about this list, or about how we process data on your behalf: [email protected].