Your mail lives in the United Kingdom, governed by UK law. Where anything has to leave, we name it on this page rather than let you find it in a DNS record.
Where your data is stored
All Glassmail mailboxes, attachments, backups and account records are stored on servers physically located in the United Kingdom. We do not replicate your mail to data centres outside the UK. The one thing that does not yet sit here is the mail sent to our own addresses, which an external provider has to receive until our servers are ready — named under sub-processors below.
Jurisdiction
Because both the company and the infrastructure are UK-based, your data is subject to UK data-protection law and the oversight of the UK’s Information Commissioner’s Office (ICO). It is not routinely exposed to the laws of other countries simply by virtue of where it is held.
Encryption
Mail in transit between you and Glassmail, and between Glassmail and other mail servers, is protected with TLS where the other side supports it. Your private mail is end-to-end encrypted, and data stored on our servers is encrypted at rest. Backups are encrypted before they leave the primary system.
Sub-processors
Two, and we would rather name them than let you find out later.
Until our own mail servers are established, an external email provider is necessary to receive email sent to glassmail.co.uk at all; that provider is Fastmail. Replacing it with our own infrastructure inside the UK is part of what we are building, and it will be done before the service launches.
If we bring in any other sub-processor, we will name it on this page before it touches your data, say plainly what it does and why, and require it to store and process that data within the United Kingdom under contractual data-protection terms. Anything less and there would be no point in using us.
International transfers
Carrying mail is the one unavoidable exception, and today it is a larger one than we want it to be. Email sent to glassmail.co.uk is received by Fastmail, whose servers are in the United States, because until our own mail servers are established an external provider is necessary to receive it at all. That transfer is covered by the Addendum to the EU Standard Contractual Clauses, and it is named in our privacy notice. It ends when our own infrastructure does the job.
Even once it does, some mail has to cross a border: when you email someone whose provider sits abroad, that message has to leave the country to reach them, and mail sent to you from overseas has to arrive from there. That is inherent to email itself, and it goes no further than delivering your messages. Nothing else leaves the UK — not the waitlist, not your backups, not your account records.
Questions
If you’d like more detail about where and how your data is held, get in touch.