EU Data Residency & Security for Agent Email

This pillar lays out the residency model, the encryption mechanism (described exactly as it is implemented), the honest SES/CLOUD-Act nuance, and where to find the DPA and sub-processor list.

EU residency, by default and on every tier

Residency here means two concrete things we control:

• Storage: mailboxes and their messages live on OVHcloud infrastructure in the EU. OVHcloud is ISO 27001 / ISO 27701 certified (a certification attributed to OVHcloud, our sub-processor - not a Sairaph Mail certification).
• Processing: the application that runs your mailboxes runs in the EU, operated by an EU-incorporated company (WELLDONE, Poland), subject to EU and Polish law.

This is the same on every plan - EU residency is the default, not a feature gated behind an enterprise contract. That default + jurisdiction is the defensible difference versus US-native agent-email vendors.

See the EU data residency glossary entry for residency vs. sovereignty, and the EU-alternative comparison for how this stacks up against US incumbents.

How encryption actually works

We describe this exactly as the code implements it - no rounding up.

• Authenticated encryption with a per-customer key. Each customer is issued a dedicated encryption key at signup. Mailbox credentials and message content are sealed with that key using Fernet, which is AES-128 in CBC mode with an HMAC-SHA256 authentication tag - i.e. authenticated symmetric encryption, so tampered ciphertext is rejected on decrypt.
• Per-customer key isolation. The per-customer key is itself sealed ("wrapped") by a rotating master key family (MultiFernet), so master-key rotation is online and one customer's data is never encrypted under another customer's key.
• Right-to-erasure built in. Destroying a customer's key is a soft-delete that stamps the row and stops the unwrap path from running - so even a leaked encrypted backup of a destroyed key cannot be decrypted. Destroying the key also cascades to revoke that customer's API keys and tear down live IMAP sessions.
• Credentials never exposed. Mailbox passwords are never returned by any API and never written to logs; plaintext keys exist only in memory at the moment of use, with any short-lived cache capped at a 60-second TTL.

The security page states these controls in product terms.

The honest SES / CLOUD Act nuance

We never claim "your email never leaves the EU," because email is store-and-forward and that claim would be false. Here is the precise picture:

• The SES relay that hands outbound mail to the public internet runs in eu-west-1 (Dublin) - but on AWS infrastructure. AWS's US parent carries potential CLOUD Act exposure on that outbound relay leg.
• Once a message is delivered, it travels to the recipient's mail server, wherever in the world that is. No provider can keep delivered mail inside the EU.

Selling this honestly is the trust signal for a privacy-first buyer who has heard "EU region of a US company" before: the moat is default + jurisdiction, not an airtight "data never leaves" guarantee. We are EU-incorporated and EU-default; we are specific about the one leg that isn't airtight.

What we deliberately do NOT claim

To keep every claim substantiated:

• No "GDPR certified" (no such broad certificate exists). We say GDPR-aligned, EU data residency, backed by a real DPA and sub-processor list.
• No SOC 2 / ISO 27001 / ISO 27701 / HIPAA / PCI DSS claims for Sairaph Mail itself. (Certifications held by sub-processors are attributed to *them*, e.g. OVHcloud's ISO 27001/27701.)
• No "enterprise-grade," "bank-grade," or "military-grade" security. We name the concrete control instead.
• No "your email never leaves the EU."

DPA, sub-processors, and proof

• An executable Data Processing Agreement (Article 28) - see `/legal/dpa`.
• A published sub-processor list (OVHcloud, AWS/SES, and others), so you can see exactly who touches data.
• An honest "no inbox-placement guarantee" - we do not promise deliverability outcomes no one can honestly promise.

Next step: read the DPA and the security page, or see how this compares to US incumbents in the EU-alternative guide.