Sub-processors
Every third party that touches data you send us, what specifically reaches them, and where they are.
Before you rely on this
Proofwire is currently operated by a private individual in Italy; VAT registration is in progress and the company details will appear here once it completes. Until then we cannot issue VAT invoices, and these documents have not yet been reviewed by a lawyer. If you are evaluating us as a supplier under a procurement process, tell us and we will say plainly where we stand rather than let you find out at contract stage.
Last updated 2026-08-28
| Who | What for | What reaches them | Where |
|---|---|---|---|
| Turso | Primary database | Account records, credit ledger, redacted lookup history, batch data | AWS eu-west-1, Ireland |
| Railway | API hosting | Everything the API processes, in transit and in memory | United States Outside the EEA · Standard Contractual Clauses |
| Vercel | Website and dashboard hosting | Request metadata, session cookies | Global edge network Outside the EEA · Standard Contractual Clauses |
| hlr-lookups.com | Carrier register queries for phone verification | The phone number being verified. Nothing about who submitted it. | Germany |
| MillionVerifier | Mailbox verification | The email address being verified. Nothing about who submitted it. | European Union |
| Stripe | Payments and invoicing | Billing name, address, VAT number, payment method. Card details never reach us. | United States and Ireland Outside the EEA · Standard Contractual Clauses |
| Resend | Transactional email delivery | Recipient address and message content | United States Outside the EEA · Standard Contractual Clauses |
| Namecheap Private Email | Our own mailboxes, where support correspondence arrives | Anything you choose to write to us | United States Outside the EEA · Standard Contractual Clauses |
What the verification vendors do and do not receive
When you verify a phone number, that number goes to the carrier register. When you verify an email address, that address goes to the mailbox verifier. Nothing else does — not who submitted it, not which account it belongs to, not what else you have looked up.
This matters if the data you are verifying belongs to your own customers. You remain the controller of it; we act on your instructions, and so do they.
Not sub-processors
AWS, Google Cloud, Cloudflare, the Tor Project — We read the IP ranges they publish. Nothing is sent to them, and they are not told what we looked up.
They appear here so their absence from the table above is a deliberate statement rather than something we forgot.
Changes
This list lives in the source code, next to the integrations it describes, so adding a vendor without disclosing it means actively ignoring the file. If you have an account and we add a sub-processor, we will tell you before data starts flowing to them.
Contact
Privacy questions and data requests: privacy@proofwire.app
Everything else: support@proofwire.app
A person reads both. We aim to answer data requests within 30 days, which is the statutory limit, and in practice much sooner.