Sub-processors
This list is current as of 10 October 2026. When it changes materially, the change is published on this page.
Tratto is the data controller for the data you give us directly (the waitlist and the founding-member form). When you send email through Tratto, we are your data processor and you are the controller. Either way, running the service means other providers touch that data. Here is every one of them.
| Sub-processor | What it does | Where the data is |
|---|---|---|
| Google Cloud: Firebase App Hosting | Runs this website and the documentation at docs.tratto.email. Sees every request made to either. | europe-west4 (Netherlands) |
| Google Cloud: Cloud Run | Runs the Tratto API. Sees every request made to it. | europe-west1 (Belgium) |
| Google Cloud: Firestore | The application database: accounts, contacts, campaigns, email records, and the waitlist itself. | eur3 (EU multi-region) |
| Google Cloud: BigQuery | Stores email event data (delivery, open, click, bounce) for the analytics in the dashboard. | europe-west1 (Belgium) |
| Google Cloud: Vertex AI (Gemini) | Powers assisted template drafting. When you ask Tratto to draft an email, the brief you type is sent to the model, together with the existing email when you are rewriting one. Nothing else goes with it: not your contacts, not your sent email, not your account details. The feature is off unless you use it, and the call is text in, text out, with no tools and no file access. | europe-west1 (Belgium) |
| Amazon Web Services: SES | Delivers the email. Recipient address, subject and message body pass through it on every send. | eu-west-1 (Ireland) |
| Upstash: Redis | Holds rate-limiting counters. The key is a truncated SHA-256 of the visitor's IP address, the value is a number, and it expires after one hour. Nothing else is written. | AWS eu-west-1 (Ireland), primary region. The database is an Upstash Global instance, so requests are routed to the nearest endpoint: from Italy that resolves into AWS eu-central-1 (Frankfurt). Both regions are in the EU. |
| Google Analytics, via Google Tag Manager | Measures how this website is used. The Tag Manager container is not requested at all until you accept analytics cookies: decline, and no request ever reaches Google. | Google's global infrastructure, including the United States |
| Sentry | Monitors errors in the dashboard at app.tratto.email. When something breaks, the technical details of that session are sent: the page, the browser, the stack trace, and your user id and email address, so we can tell which account ran into it. Error monitoring is always on, because without it we cannot keep the service working. Sentry also records a sample of dashboard sessions, and that happens only if you accept analytics cookies: decline, and no session is recorded. The recording of a session in which an error occurs is kept either way. Recordings are masked: text, form fields and images are hidden, and the contents of network requests are not collected. | Sentry's EU region (Germany) |
What is not on this list
Fonts. Inter, DM Serif Display and JetBrains Mono are downloaded at build time and served from tratto.email, so opening a page here sends nothing to Google Fonts.
Certifications
Tratto holds no SOC 2 report and no ISO 27001 certificate. Any certification held by the providers above is theirs, not ours, and is published on their own trust pages.
Questions about this list, or about how we process data on your behalf: [email protected].