EU data residency (for email)
EU data residency for email means the mailboxes and the processing behind them are stored and run on infrastructure physically located in the European Union. It is distinct from data sovereignty, which also concerns *which laws and jurisdiction* govern the data and the company operating it - a US-owned provider can host an EU region yet remain subject to US legal process. Residency is a verifiable fact about the infrastructure you control. It does not change one inherent property of email: once a message is delivered, it travels to the recipient's mail server, wherever in the world that server happens to be.
Last updated June 30, 2026
Residency vs. sovereignty vs. the CLOUD Act
These three ideas are often conflated:
- Residency - *where* the data physically sits (which datacenter / region).
- Sovereignty - *whose law* governs the data and its operator, which depends on the company's incorporation and ownership, not just the region.
- The US CLOUD Act - a reason the two can diverge: a US-incorporated provider can be compelled to produce data even when it is stored in an EU region. So "EU region of a US company" is residency without full sovereignty.
The honest, defensible signal for a privacy-conscious buyer is *both* an EU location *and* an EU-incorporated operator with no US parent - plus precision about any leg that touches a US-owned service.
How Sairaph Mail handles it
- EU-incorporated operator - Sairaph Mail is run by WELLDONE, a company established in Poland and governed by Polish/EU law, with no US parent.
- EU storage and processing - mailboxes are stored on OVHcloud (a European provider) and the outbound relay runs on Amazon SES in the
eu-west-1(Dublin) region. - Per-customer encryption at rest - each customer's mailbox credentials and message bodies are encrypted with a dedicated per-customer key (Fernet - AES-128 in CBC mode with HMAC-SHA256 authentication, wrapped by a master key). Credentials are never returned by any API or written to logs.
- The one honest caveat - the SES relay that hands mail to the public internet runs in
eu-west-1but on AWS, whose US parent carries CLOUD Act exposure on that outbound leg; and once a message is delivered it travels to the recipient's server anywhere. We state this rather than claim email "never leaves the EU." - Paperwork - an executable DPA and a published sub-processor list back the arrangement.
We describe this as GDPR-aligned, EU data residency by default - not "GDPR certified," and without SOC 2 / ISO / "bank-grade" claims we don't hold.
Related terms
- [Scoped API key](/glossary/scoped-api-key) - least-privilege credentials that limit exposure of EU-resident data.
- See the security page for the full set of controls and the DPA for the data-processing terms.
Related
Give your agent a real mailbox
Two-way email over REST and a native MCP server, EU-resident by default.
EU data residencyPer-customer encryptionNative MCP