Built for European privacy

Jurisdiction: an EU company, with EU sub-processors

Server location alone is not enough. A US company, or an EU subsidiary of one, can be compelled under US law to hand over data stored in the EU. Check where the vendor is incorporated, who owns it, and where each sub-processor is.

Look beyond the processors too. Payment providers, analytics and "sign in with" options also receive some data. A good sub-processor page names each of them, says where they are and what reaches them. For the legal background, see inbound email processing for GDPR compliance.

Data minimisation: the vendor sees only the mail it needs

A tool that connects to a whole mailbox can read years of mail it has no use for. Sending or forwarding only the messages a workflow needs keeps everything else out of the vendor's reach, which is what Article 5(1)(c) of the GDPR asks. Selective email access vs full mailbox →

Storage limitation: email content kept for hours, not forever

The safest copy of an email is one that no longer exists. Ask for the exact retention period per plan, whether you can shorten it, whether you can delete a message as soon as your system has it, and what remains after a deletion: logs, audit entries, backups.

Access: who can read your email, and is it logged?

Ask which people can reach production data, whether contractors or outsourced support are among them, and whether processing needs a human at all. Then ask what is logged (sign-ins, configuration changes, downloads) and for how long. On your own side, check that the vendor's dashboard supports multi-factor sign-in.

Security of processing: what is encrypted, and what is not

Article 32 asks for security appropriate to the risk. For email that means TLS in transit, signed webhook deliveries so your endpoint can verify the sender, and a clear answer on what is encrypted at rest. A vendor that tells you plainly what it does not encrypt, and how it limits that risk, is easier to assess than one that says "bank-grade encryption".

Contract: the DPA, sub-processor changes and breach notice

Article 28 requires a Data Processing Agreement with every processor. Read it for three things:

How EmailConnect fits

These are EmailConnect's answers to the checks above. Each item links to the page behind it.

• A Dutch company, processing in the EU. Application, database and mail server at Hetzner in Germany; optional attachment storage and the mail we send you at Scaleway in Paris; an encrypted backup copy (7 days) at Scaleway in Amsterdam. Payments go through Mollie in the Netherlands. No US company is in the processing chain, apart from optional sign-in with Google or GitHub. Sub-processors →
• No mailbox access. You send or forward mail to addresses we run; we never hold a password or token for your mailbox. Privacy promise →
• Email content exists only as long as you choose: one hour on Free and Maker, 24 hours by default on Business and Platform (configurable up to 30 and 365 days), deletable through the API on Business and above. With Data Residency Mode, an option on Platform, the body and attachments are never stored. Data retention →
• No other companies with access. No contractors or outsourced support; parsing and delivery are automated. Sign-ins, configuration changes and attachment downloads are logged for 90 days by default. Security and access →
• Encrypted in transit, signed on delivery. TLS 1.2 and 1.3 for the dashboard, API and webhook deliveries; storage keys and webhook secrets encrypted at rest with AES-256-GCM; deliveries signed with HMAC-SHA256. Two-factor authentication and passkeys for sign-in. Sign-in security →
• A DPA on every plan, Free included. Sub-processor changes announced 30 days ahead; personal data breaches notified without undue delay. Data Processing Agreement →

If your procurement requires a specific certification, audit or penetration test, tell us what you need.

All answers for your security review: trust center →

Questions for your review, or a security questionnaire to fill in? Write to hello@emailconnect.eu, or for formal GDPR requests to dpo@emailconnect.eu.