DMARCER
Sign in Get started
Legal

Sub-processors

This is the short list of third parties that may process data on our behalf, and exactly what each one is used for.

Last updated: 8 July 2026

iVibe Media Limited (trading as DMARCER, company no. 17212558) performs the core processing of your data itself and keeps the list of external sub-processors deliberately short. For customers under our Data Processing Agreement, we give prior notice of any new sub-processor so you can object.

Infrastructure and hosting

The DMARCER platform runs on cloud infrastructure from Microsoft Azure and on dedicated servers we lease from iomart. All data is encrypted at rest across every server and provider, with the encryption keys held by us. Your reporting data is processed and stored in the region you select and is not copied to another region. The current list of regions is shown on our Security and trust page.

iomart supplies dedicated leased hardware and the data centre around it. They have physical access to the hardware only — no logins to our systems and no access to the data, which they hold only in encrypted form. They are therefore a hosting provider rather than a processor of your data. We list them here for transparency.

Sub-processors we use

  • Microsoft provides our cloud server hosting (Microsoft Azure), our business email hosting (Microsoft 365), and product analytics and session replay through Microsoft Clarity on our public website and support site. Clarity loads only after you accept analytics cookies and receives anonymised interaction data, not the content you type.
  • Stripe handles card payments as an independent payment processor. We do not store full card numbers; it sees billing and contact details only.
  • Xero handles invoicing and accounting, and sees billing and company details.
  • Cloudflare provides bot protection (Turnstile) on certain public forms, processing the visitor's IP address.
  • Anthropic and OpenAI analyse a forensic (RUF) report only when a user requests it. We contract on terms that prohibit training on your data, and no other personal data is sent to them.

Changes to this list

We post changes here, and for customers under our DPA we give prior notice of any new sub-processor so you can object. Questions: privacy@dmarcer.net.

See also our Privacy policy and Data Processing Agreement.