Skip to content
Sairaph Mail

Agent email that's EU-incorporated and EU-hosted by default

If jurisdiction matters, where your agent's email lives matters too. Sairaph Mail is operated by an EU-incorporated company and is EU-resident by default - on every plan, not gated behind an enterprise contract - and we're precise about the one place mail crosses a boundary. That precision is the point.

Read the DPASecurity & Trust

What you can verify

“EU region” usually means “EU region of a US company”

Most agent-email and transactional-email vendors are US companies. Some offer an EU region; some don't. But an EU region operated by a US parent still sits under that parent's jurisdiction. Among vendors with real agent mailboxes, the EU options are thin: some gate EU residency to an enterprise tier, others have announced an EU region that isn't generally available yet, and the transactional incumbents store in the US.

How it works

  1. 01EU storage + EU processing

    Mailbox storage is on OVHcloud and processing happens in the EU - on every plan, not behind an enterprise upsell. OVHcloud is itself ISO 27001 and ISO 27701 certified (those certifications are OVHcloud's, as our infrastructure provider).

  2. 02Per-customer encryption at rest

    Each customer's message bodies and mailbox credentials are encrypted at rest with a dedicated per-customer key (Fernet symmetric encryption). Credentials are never returned by any API or written to logs.

  3. 03An executable DPA and a published sub-processor list

    A real Article 28 data processing agreement you can sign, plus a public list of every sub-processor.

  4. 04Honest about the one outbound leg

    Outbound mail is relayed through Amazon SES in eu-west-1 (Dublin) - in the EU, but on AWS, whose US parent carries CLOUD Act exposure on that leg. And email is store-and-forward: once delivered, a message travels to the recipient's server, wherever that is. We never say “your email never leaves the EU.”

The same EU-resident mailbox, over a clean API

Your agent reads its EU-hosted inbox over REST - from the cache, or with live=true for an on-demand fetch.

cURL

Read-scoped keys can read but never send.

What a privacy review can verify

Concrete controls and documents - not certifications we don't hold.

  • EU data residency
  • Per-customer encryption
  • Scoped, expiring API keys
  • Optional two-factor authentication
  • Native MCP server
  • REST API

Frequently asked questions

Related

  • EU data residency & security

    The full write-up of our EU posture and security model.

    Learn more

  • Security & Trust

    How mailbox data is protected, end to end.

    Learn more

  • Sub-processors

    Every sub-processor that touches data, published.

    Learn more

Read the DPA and the data-flow story in full

If jurisdiction is a requirement, start with the documents you'd review anyway.

Read the DPAEU data residency & security

EU data residencyPer-customer encryptionNative MCP