Trust center
Answers for your security review
Where your email is, who can access it and how long it is kept. One page to forward; every answer links to the full document.
Answers by topic
Where your email is
- Germany (Hetzner): app, database, mail
- France, Netherlands (Scaleway): storage, backups
- No US company in the chain
- 30 days' notice of changes
Who can access it
- Never your mailbox
- No contractors or outsourced support
- Multi-factor sign-in, if you want it
- 90-day audit log
How long it is kept
- 1 hour on Free and Maker
- 24 hours by default on Business, Platform
- Delete on arrival through the API
- Not stored in Data Residency Mode
Encryption and signing
- TLS 1.2 and 1.3 everywhere
- MTA-STS on inbound mail
- Secrets encrypted with AES-256-GCM
- Signed deliveries (Standard Webhooks)
Reliability
- 99.93% inbound uptime, 90 days
- Measured externally, incidents public
- 7 delivery attempts over 22 hours
- One ID per email for deduplication
Audits and certifications
- Certified data centres (Hetzner, Scaleway)
- Every change scanned for vulnerabilities
- Need a report or pen test? Ask us
Documents
Data Processing Agreement
GDPR Article 28, on every plan including Free
Sub-processors
Who handles your data, where, and why
Privacy policy
How we handle personal data
Terms of service
The agreement for using EmailConnect
Company details
Legal entity and registration
Report a vulnerability
Email security@emailconnect.eu. The responsible disclosure policy covers scope, safe harbor and our PGP key.
Something your review needs?
Content encrypted at rest, a certification or a questionnaire: tell us what your review requires at hello@emailconnect.eu.