Version 2026-10-25. Published 25 October 2026.
SecureThread is provided by ArcByte Studios, a sole proprietorship of Aidan Daniel Rodrigues, registered in India as a micro enterprise under the MSME Udyam scheme, Udyam Registration No. UDYAM-KR-03-0759003 ("ArcByte"). ArcByte uses the service providers below to run SecureThread. For customer content they are Sub-processors under the Data Processing Agreement. For account and website data they are the processors that ArcByte's own operations use. We list each provider with what it does, what data it handles and where it is located, and we say when a provider is used only if it is configured.
| Provider | What it does | Data it handles | Location | Status |
|---|
| Leaseweb (Leaseweb Canada Inc.) | Hosts the servers that run the web app, the API, the background worker, the database and the cache | All data the Service stores | Canada | In use |
| Cloudflare | DNS and reverse proxy in front of the Service's public domains | Request content that passes through the proxy, including page and API traffic in transit | Cloudflare's global network (Cloudflare, Inc., United States) | In use |
| Let's Encrypt | Issues the TLS certificates for the Service's domains | Domain names only | United States (Internet Security Research Group, which operates Let's Encrypt) | In use |
| GitHub | Hosts the source code, runs continuous integration, and hosts the desktop app's installers | Source code and build logs; no customer data. Download requests carry IP addresses | United States (GitHub, Inc.) | In use |
| Docker Hub | Supplies base container images at build and deploy time | IP addresses only | United States (Docker, Inc.) | In use |
| The hosting provider's DNS resolver | Looks up domain records for sender checks (SPF, DKIM, DMARC, BIMI) and for SMTP host checks | Domain names that are looked up | Canada | In use |
Leaseweb (Leaseweb Canada Inc.)
What it does
Hosts the servers that run the web app, the API, the background worker, the database and the cache
Data it handles
All data the Service stores
Cloudflare
What it does
DNS and reverse proxy in front of the Service's public domains
Data it handles
Request content that passes through the proxy, including page and API traffic in transit
Location
Cloudflare's global network (Cloudflare, Inc., United States)
Let's Encrypt
What it does
Issues the TLS certificates for the Service's domains
Data it handles
Domain names only
Location
United States (Internet Security Research Group, which operates Let's Encrypt)
GitHub
What it does
Hosts the source code, runs continuous integration, and hosts the desktop app's installers
Data it handles
Source code and build logs; no customer data. Download requests carry IP addresses
Location
United States (GitHub, Inc.)
Docker Hub
What it does
Supplies base container images at build and deploy time
Data it handles
IP addresses only
Location
United States (Docker, Inc.)
The hosting provider's DNS resolver
What it does
Looks up domain records for sender checks (SPF, DKIM, DMARC, BIMI) and for SMTP host checks
Data it handles
Domain names that are looked up
The reverse proxy (Traefik) and the deployment platform (Dokploy) are software that runs on ArcByte's own servers. ArcByte does not send Customer data to their makers, so neither is listed as a Sub-processor. The reverse proxy keeps request records in its logs on those servers; they are not kept for a fixed period, and older entries are removed as the logs are rotated.
| Provider | What it does | Data it handles | Location | Status |
|---|
| Resend | Sends SecureThread's own system email: invitations, password resets, sign-up confirmations, status and incident emails, billing emails, new-device alerts, support acknowledgements and replies, approval notices, notices about email sent by agents, and enquiries from the securethread.co contact form | Recipient name and email address; one-time links; the text of each notice, including a support request's subject and reply, an approval item's title and the requester's name; for new-device alerts, the IP address and a description of the device; for contact-form enquiries, the details the visitor enters | United States (Plus Five Five, Inc., which operates Resend) | Used when the server is configured with Resend; otherwise an administrator chooses a mailbox to send system email |
| Razorpay | Subscriptions, payments and invoices | Customer record: legal name, billing email address and GSTIN; a note holding the workspace's identifier; the type of payment method. Card and bank numbers are held by Razorpay, not by SecureThread | India | Used for paid plans |
| Cloudflare Turnstile | Checks new sign-ups, public abuse reports and securethread.co contact-form enquiries for automated abuse | The visitor's challenge response and, where available, the visitor's IP address | Cloudflare's global network (Cloudflare, Inc., United States) | Used when Turnstile is switched on |
| Browser and device push services | Deliver a notification to a person's device when they have turned notifications on | The push subscription's endpoint and the timing and size of each notification. The content is encrypted before it leaves SecureThread, so the push service cannot read it | Set by the push service the device uses: Google for Chrome and the SecureThread Android app, Microsoft for Edge, Mozilla for Firefox, Apple for Safari; for any other browser, that browser's vendor | Used only for people who turn on notifications |
| S3-compatible object storage | Stores attachment files, when the server is configured to keep them outside the database | Attachment files | Where the configured storage bucket is located | Used only when configured; otherwise attachments are stored in the database |
Resend
What it does
Sends SecureThread's own system email: invitations, password resets, sign-up confirmations, status and incident emails, billing emails, new-device alerts, support acknowledgements and replies, approval notices, notices about email sent by agents, and enquiries from the securethread.co contact form
Data it handles
Recipient name and email address; one-time links; the text of each notice, including a support request's subject and reply, an approval item's title and the requester's name; for new-device alerts, the IP address and a description of the device; for contact-form enquiries, the details the visitor enters
Location
United States (Plus Five Five, Inc., which operates Resend)
Status
Used when the server is configured with Resend; otherwise an administrator chooses a mailbox to send system email
Razorpay
What it does
Subscriptions, payments and invoices
Data it handles
Customer record: legal name, billing email address and GSTIN; a note holding the workspace's identifier; the type of payment method. Card and bank numbers are held by Razorpay, not by SecureThread
Status
Used for paid plans
Cloudflare Turnstile
What it does
Checks new sign-ups, public abuse reports and securethread.co contact-form enquiries for automated abuse
Data it handles
The visitor's challenge response and, where available, the visitor's IP address
Location
Cloudflare's global network (Cloudflare, Inc., United States)
Status
Used when Turnstile is switched on
Browser and device push services
What it does
Deliver a notification to a person's device when they have turned notifications on
Data it handles
The push subscription's endpoint and the timing and size of each notification. The content is encrypted before it leaves SecureThread, so the push service cannot read it
Location
Set by the push service the device uses: Google for Chrome and the SecureThread Android app, Microsoft for Edge, Mozilla for Firefox, Apple for Safari; for any other browser, that browser's vendor
Status
Used only for people who turn on notifications
S3-compatible object storage
What it does
Stores attachment files, when the server is configured to keep them outside the database
Data it handles
Attachment files
Location
Where the configured storage bucket is located
Status
Used only when configured; otherwise attachments are stored in the database
These are the mail, sending, chat and AI providers that a Customer chooses and connects with its own account. They are not Sub-processors of ArcByte. When SecureThread sends, reads or requests through them, it does so as the Customer directs, and the Customer's own agreement with each provider governs how that provider processes the data. Sign-in with Google or Microsoft is a separate use, described in the table below.
| Provider | What the connection does | Data that passes through it |
|---|
| Google (Gmail API, and Google sign-in) | Sends mail and reads, labels, archives and trashes mail in a connected Gmail mailbox; signs a person in | Sent and read mail content, recipients and contacts; the identity (email address and name) of the person signing in |
| Microsoft (Microsoft Graph, and Microsoft sign-in) | Sends and reads mail in a connected Microsoft 365 mailbox; signs a person in | The same kinds of data as Google |
| SMTP mail servers from the approved catalogue, and any custom server an administrator approves | Sends mail through the mailbox's server, and reads the inbox over IMAP | Sent mail content, recipients and IMAP inbox data |
| Amazon SES | Sends mail through the Customer's own SES account and receives delivery events | Message content, recipients and delivery events |
| SendGrid, Mailgun, Postmark and Resend (the Customer's own accounts) | Send mail through the Customer's account and report delivery events back | Message content, recipients and delivery events |
| Anthropic (with the Customer's own API key) | AI drafting, inbox summaries and reply drafts, security scores, assistant memory and the optional AI review of outgoing mail | The content each request needs: instructions, subject, body or message text and sender name. Secrets are always replaced first, and contact details while redaction is on (the default). Requests go to api.anthropic.com (Anthropic, PBC, United States) |
| An OpenAI-compatible endpoint the administrator supplies | The same AI uses as Anthropic | The same as Anthropic. SecureThread requires an HTTPS address that resolves to public internet addresses; where that provider processes data is set by the Customer's agreement with it |
| Email on Acid | Email client rendering tests, when an administrator connects the Customer's account | The HTML and subject of the email under test |
| Slack and Microsoft Teams (incoming webhooks an administrator sets up) | Post approval notices to a channel | The approval item's title and the requester's name |
Google (Gmail API, and Google sign-in)
What the connection does
Sends mail and reads, labels, archives and trashes mail in a connected Gmail mailbox; signs a person in
Data that passes through it
Sent and read mail content, recipients and contacts; the identity (email address and name) of the person signing in
Microsoft (Microsoft Graph, and Microsoft sign-in)
What the connection does
Sends and reads mail in a connected Microsoft 365 mailbox; signs a person in
Data that passes through it
The same kinds of data as Google
SMTP mail servers from the approved catalogue, and any custom server an administrator approves
What the connection does
Sends mail through the mailbox's server, and reads the inbox over IMAP
Data that passes through it
Sent mail content, recipients and IMAP inbox data
Amazon SES
What the connection does
Sends mail through the Customer's own SES account and receives delivery events
Data that passes through it
Message content, recipients and delivery events
SendGrid, Mailgun, Postmark and Resend (the Customer's own accounts)
What the connection does
Send mail through the Customer's account and report delivery events back
Data that passes through it
Message content, recipients and delivery events
Anthropic (with the Customer's own API key)
What the connection does
AI drafting, inbox summaries and reply drafts, security scores, assistant memory and the optional AI review of outgoing mail
Data that passes through it
The content each request needs: instructions, subject, body or message text and sender name. Secrets are always replaced first, and contact details while redaction is on (the default). Requests go to api.anthropic.com (Anthropic, PBC, United States)
An OpenAI-compatible endpoint the administrator supplies
What the connection does
The same AI uses as Anthropic
Data that passes through it
The same as Anthropic. SecureThread requires an HTTPS address that resolves to public internet addresses; where that provider processes data is set by the Customer's agreement with it
Email on Acid
What the connection does
Email client rendering tests, when an administrator connects the Customer's account
Data that passes through it
The HTML and subject of the email under test
Slack and Microsoft Teams (incoming webhooks an administrator sets up)
What the connection does
Post approval notices to a channel
Data that passes through it
The approval item's title and the requester's name
The AI review of outgoing mail is switched off by default. When an administrator turns it on, it sends the subject, preview text, sender name, body, and the text of the message's HTML attributes (such as image descriptions and link addresses) of each message that the word list and the outbound checks have not already blocked, to the AI provider the administrator has configured. Card numbers, identity numbers and secrets are masked first, and contact details are redacted by default.
When mail from a sender's domain passes DMARC with an enforced policy (quarantine or reject on all mail) and the sender has published a BIMI record that names a mark certificate, SecureThread requests that certificate to show the sender's logo. The request goes to a host the sender chose. No personal data is sent in it; it reveals the Service's server address to that host. These requests are listed here as a disclosure, not as a Sub-processor.
SecureThread does not use the following:
- analytics services (for example Google Analytics, Google Tag Manager, Plausible, PostHog, Segment, Vercel Analytics, Mixpanel or Amplitude);
- error-tracking and performance services (for example Sentry, Datadog or New Relic);
- session-replay services (for example Hotjar, LogRocket or Microsoft Clarity);
- advertising or customer-messaging widgets (for example Intercom);
- a content delivery network that stores copies of customer content.
Fonts are included with the web app and are not requested from a font service when a page loads.
This list is based on a review of SecureThread's source code and configuration. It does not cover requests that a person's own browser or device makes to third parties outside the Service.
We give at least 30 days' written notice before a new or replaced Sub-processor begins to process customer personal data, as the Data Processing Agreement says. The notice goes to each Customer's workspace administrators and is posted on this page. A Customer may object in writing within those 30 days. If we cannot address the objection, the Customer may close the affected workspace and receive a refund of prepaid fees for the unused period.