Sub-processors
Last updated: 5 September 2026
These are the companies that process data on Spoofhound's behalf so the service can run. Each does one job, and sees only what that job needs.
Cloudflare
What it does: Runs the application, and stores the database and report data.
What it sees: All data held in Spoofhound. Jurisdiction is EU or US depending on your instance; the Rest-of-world, KSA and UAE instances are isolated, without a contractual jurisdiction.
Amazon Web Services (AWS)
What it does: Sends Spoofhound’s email (sign-in codes, alerts, digests) and stores backups.
What it sees: The email addresses and contents of those messages, and backup copies of stored data. Regions eu-west-2 (London) and us-east-1 (US instance).
ipinfo.io
What it does: Looks up IP addresses that appear in your reports, to show network names and countries.
What it sees: Only the IP addresses looked up — no account or report content.
Anthropic
What it does: Managed AI option only — produces the analysis and action plan.
What it sees: Report-derived analysis data, for customers who switch on managed AI. Customers with no AI, or with their own AI provider, do not use this.
Your own AI provider (bring your own AI)
What it does: If you connect your own AI provider — Anthropic, OpenAI, Google, Moonshot or OpenRouter — it produces the analysis for the domains you enable it on.
What it sees: Report-derived analysis data, under your own agreement with the provider you choose. Spoofhound sends data only to the provider you configured. Not a Spoofhound sub-processor: this is your provider, chosen by you.
DNS record contents are stripped from what the help assistant sends to any AI provider. Customers who enable no AI have no AI sub-processor.
Questions: use the contact form. See also our privacy policy and data processing agreement.