Less boo. More booked. Halloween offer: 30 days free on any paid plan. Claim 30 days freeEvery new account gets one free mailbox for warmup and replies. No domain to buy. See how it works

Skip to content
Warmerly Closely
One-to-one · Data hosting

Data hosting

One row, in depth: what each tool does, the verified numbers, and who each suits.

Start freeBack to all features

Closely details read from its pricing page, home page, product and legal pages and help centre on 21 October 2026.

Warmerly

Hosted in the EU, per our trust page, with the services behind it listed.

Closely

Servers in the USA, per its privacy policy; no sub-processors listed in its DPA.

The short answer

Data hosting, in one look.

Warmerly's trust page says customer data is hosted in the EU and lists the services behind it. Closely's privacy policy says its servers are in the USA and data is generally processed and hosted outside the EU, and its data processing agreement names no sub-processors. Last checked 22 October 2026.

WarmerlyWarmerly ahead on this row

Hosted in the EU, per our trust page, with the services behind it listed.

Closely

Servers in the USA, per its privacy policy; no sub-processors listed in its DPA.

The picture

Drawn side by side.

Where customer data sits

As each company states it

WarmerlyClosely

Hosted in the EU

  • Where data is hosted: The EU, per its trust page
  • Sub-processors: Listed in full
  • Transfer safeguards: Adequacy or UK addendum and SCCs

Servers in the USA

  • Where data is hosted: The USA, per its privacy policy
  • Sub-processors: Categories only; none in its DPA annex
  • Transfer safeguards: Standard Contractual Clauses

This compares published statements only. Closely's privacy policy is dated 1 May 2022.

Sub-processors

What each publishes

WarmerlyClosely
Warmerly
Listed in full15 days' notice of a new one
Closely
Categories in its privacy policyNone named in its DPA annex

Ask Closely for its current sub-processor list.

How Warmerly does it

Warmerly, in detail.

Warmerly states that customer data is hosted in the EU and lists the services behind it. Its trust page also publishes the security measures its data processing addendum describes, a breach notice window, a notice period for new sub-processors and who at Warmerly can see a workspace.

01

Hosted in the EU

Warmerly's trust page says customer data is hosted in the EU, and the services behind Warmerly are listed in full.

Warmerly product, checked 21 October 2026

02

Transfers

Where personal data goes to a service outside the UK and EU, the privacy policy says Warmerly relies on an adequacy decision or regulation where one covers the recipient, and otherwise on the UK addendum and standard contractual clauses.

Warmerly product, checked 21 October 2026

03

Some services sit outside the EU

The trust page says some of the services that process customer data are outside the UK and the EEA, and names the safeguards used. It also says Warmerly gives at least 15 days' notice before a new sub-processor starts and tells the account owner of a confirmed breach within 72 hours where feasible.

Warmerly product, checked 21 October 2026

04

What we did not check

This page compares published statements only. We did not audit either company's systems.

Warmerly product, checked 21 October 2026

05

Who is the controller

The privacy policy names Warmerly as the controller of account data. For the data you process through Warmerly, such as campaign recipients, imported lists and the contacts in your mailbox, the policy and the DPA say you are the controller and Warmerly is your processor. The DPA governs that relationship, and you stay responsible for having a lawful basis to contact those people.

Warmerly product, checked 21 October 2026

06

Credentials are encrypted at rest

The DPA lists the measures in place. Mailbox OAuth tokens, IMAP and SMTP passwords and the credentials of hosted mailboxes are encrypted at rest with AES-256-GCM, using a key held outside the database. Account passwords are hashed with Argon2id, and API keys and reset tokens are stored only as SHA-256 hashes.

Warmerly product, checked 21 October 2026

07

Backups and recovery

The production database and the mail servers' databases are backed up nightly, each backup encrypted with a key held off-server. Servers hold write-only credentials, so a compromised server cannot read or delete existing backups. The database's write-ahead log is also archived at least every five minutes, which allows point-in-time recovery.

Warmerly product, checked 21 October 2026

08

Who at Warmerly can see a workspace

Administrators can temporarily access a customer workspace, including the inbox, only to resolve a problem you raised or to investigate a credible abuse report. The access needs a permitted role, is written to an audit log, is shown in the interface while it happens and expires within 24 hours.

Warmerly product, checked 21 October 2026

09

Requests and objections

Access, correction, deletion and objection requests are answered within one month, and no account is needed to make one. If you object to a new sub-processor on reasonable data protection grounds and it cannot be settled within 30 days, you may end the affected part of the service.

Warmerly product, checked 21 October 2026

10

Where Warmerly is behind

The trust page makes one statement about location: hosted in the EU. It does not name a provider or region, and it says it will not stretch that into anything wider. The breach notice is within 72 hours where feasible, and Closely's DPA states 24 hours.

Warmerly product, checked 21 October 2026

How Closely does it

Closely, in detail.

Closely's published position is US servers, with Standard Contractual Clauses for transfers from the EEA, a 24 hour breach notice in its DPA and an empty sub-processor annex.

01

Where it is hosted

Its privacy policy says its servers are based in the USA, so data will generally be processed and hosted outside the EU. The policy's effective date is 1 May 2022.

closelyhq.com/legal/privacy-policy · read 21 October 2026

02

Transfers

For EEA transfers to countries without adequate protection it uses Standard Contractual Clauses approved by the European Commission on 4 June 2021.

closelyhq.com/legal/privacy-policy · read 21 October 2026

03

Sub-processors

The privacy policy lists categories only: cloud storage, data analytics and measurement providers. Annex III of its data processing agreement, headed authorised sub-processors, lists none.

closelyhq.com/legal/data-processing-agreement · read 21 October 2026

06

Who is the controller

The privacy policy names Esterson Limited of Nicosia, Cyprus as the controller of client data. For business and shared data (names, work emails, job titles and LinkedIn URLs from public sources or uploaded by clients) it says Closely acts as a processor for its clients, and it says personal email domains such as Gmail are excluded.

closelyhq.com/legal/privacy-policy · read 22 October 2026

07

Breach notice

The DPA requires the vendor to notify the client within 24 hours of becoming aware of an actual or suspected personal data breach, and of any legally binding request from law enforcement.

closelyhq.com/legal/data-processing-agreement · read 22 October 2026

08

Notice of new sub-processors

The DPA allows sub-processors on at least 10 days' prior written notice. The client may object on any privacy or security grounds, and if it does the vendor shall not engage that sub-processor. It is not clear what happens if the vendor's service depends on it.

closelyhq.com/legal/data-processing-agreement · read 22 October 2026

09

Security annex

Annex II lists encryption in transit at a minimum of 256 bits, unique access credentials, access revoked on termination, backups, disaster recovery testing and staff training, with a stated goal of restoring services within 36 hours. The vendor also commits to annual external security assessments and penetration tests, and the text does not say the client can see the results.

closelyhq.com/legal/data-processing-agreement · read 22 October 2026

10

Deletion on termination

The vendor must promptly delete or return the client's personal data at the client's choice, unless the law requires it to keep it, and can certify this on written request. Annex I also lets it keep data for statistical or financial purposes if it is aggregated or stripped of identifiers.

closelyhq.com/legal/data-processing-agreement · read 22 October 2026

11

Requests and age limit

The policy lists access, rectification, erasure, restriction, withdrawal of consent and portability. It answers within one month, extendable by two further months if requests are numerous. Use is restricted to people aged 18 or over.

closelyhq.com/legal/privacy-policy · read 22 October 2026

What Closely does not say

We looked, and found no statement on these. That is about its published pages only, not about the product.

  • A named hosting provider or region
  • A sub-processor list
  • How LinkedIn credentials are stored
  • A named hosting provider or region on the pages we read
  • How long deleted data is kept
  • Any security certification on the pricing, home, privacy or DPA pages

Where the sources disagree

We report each version rather than pick one.

  • Closely's DPA says transfers outside the EEA use Standard Contractual Clauses and refers to listed sub-processors, but lists none.
  • Closely's privacy policy says it does not sell data, while its California section says it may have sold certain categories in the past 12 months. The policy does not reconcile the two.
The numbers

Only what we could verify.

Data hosting: Warmerly and Closely side by side. Warmerly is in the first column.
MeasureWarmerlyClosely
Data hostingHosted in the EU, per our trust page, with the services behind it listed.Servers in the USA, per its privacy policy; no sub-processors listed in its DPA.
Where data is hostedThe EU, per its trust pageThe USA, per its privacy policy
Sub-processorsListed in fullCategories only; none in its DPA annex
Transfer safeguardsAdequacy or UK addendum and SCCsStandard Contractual Clauses
Breach noticeWithin 72 hours where feasibleWithin 24 hours, per its DPA
Notice of a new sub-processorAt least 15 daysAt least 10 days
Privacy requests answeredWithin one monthWithin one month, extendable by two months
Mailbox and account credentialsEncrypted at rest with AES-256-GCMNot described
In practice

What it means for you.

Our reading of the facts above. Not a promise, and not the only reasonable reading.

1

If EU hosting matters to you, this row decides it

Closely says US. Warmerly says EU.

2

Read the policy dates

Closely's privacy policy is dated 1 May 2022. Ask it for its current sub-processor list.

3

The notice periods are five days apart

A new sub-processor starts after at least 15 days' notice at Warmerly and at least 10 at Closely, a gap of 5 days. That is time to read the change and object before your data reaches a new company. Both are minimums, so ask each for the actual list today.

4

The breach clock favours Closely

Closely's DPA says 24 hours from becoming aware. Warmerly says without undue delay and within 72 hours where feasible. The difference is 48 hours, and the two phrasings differ too: Closely's covers suspected breaches and Warmerly's starts when a breach is confirmed.

5

A policy more than four years old

Closely's privacy policy carries an effective date of 1 May 2022. On 22 October 2026 that is more than four years and five months. Its California section refers to periods in 2021 and 2022 and a date in 2024, so ask whether a newer version is in force before you rely on it.

6

Questions to put to either company

Which region and provider hold the database? Which sub-processors have received my data this month? How long after I leave is my data deleted, and in what form? Warmerly answers the first in part (the EU) and the second with a public list. Closely's pages we read answer neither.

Who it suits

Pick the one that fits.

Warmerly

Warmerly is the better fit if

  • You need customer data hosted in the EU
  • You want sub-processors listed
  • You must be able to point to a public list of every service that processes your customers' data
  • You want mailbox credentials described as encrypted at rest, with the cipher named
  • You want the longer notice before a new sub-processor starts
Closely

Closely is the better fit if

  • US hosting is acceptable for your data
  • Your legal team wants a breach notice stated as 24 hours
  • You are content with a processor established in Cyprus and servers in the USA under Standard Contractual Clauses
  • You want the right to veto a sub-processor written into the DPA
Questions
Where does Closely host data?

Its privacy policy says its servers are based in the USA and data is generally processed and hosted outside the EU.

Where does Warmerly host data?

Its trust page says customer data is hosted in the EU, and lists the services behind it. Some of those services sit outside the UK and the EEA, with safeguards named.

Who is the data controller at Closely?

Its privacy policy names Esterson Limited of Nicosia, Cyprus as controller of client data. For business and shared data it says Closely is a processor for its clients.

How fast does each company tell me about a breach?

Closely's DPA says within 24 hours of becoming aware. Warmerly's DPA says without undue delay, and within 72 hours where feasible, after it confirms a breach.

How much notice do I get before a new sub-processor?

At least 15 days at Warmerly, by updating the sub-processors page and by email to anyone who asked. At least 10 days at Closely, in writing, with a right to object.

Sources

Closely pages were read on 21 October 2026. Plans and wording change, so check the vendor's own page before you decide. Warmerly details come from the product as it runs today.

More features
PreviousIntegrations and APINextMain job

See it on your own mailbox.

Connect a mailbox. Warmerly runs alongside whatever you send from now, so you can compare before you move anything.

Start freeFull Closely comparison

Free plan, no card. Paid plans: 7-day trial, first charge on day 8.