Warmerly
Customer data hosted in the EU. No certification claimed.
Warmerly
Folderly
One-to-one · Security and data hosting
Security and data hosting
One row, in depth: what each tool does, the verified numbers, and who each suits.
Folderly details read from its pricing page, overview, home page, product sites, terms, privacy policy and help centre on 21 October 2026.
Warmerly
Customer data hosted in the EU. No certification claimed.
Folderly
States SOC 2 Type II and ISO 27001, with no reports linked; where customer data is stored is not stated.
The short answer
Security and data hosting, in one look.
Warmerly hosts customer data in the EU and claims no certification. Folderly states a security programme supported by SOC 2 Type II and ISO 27001, on its home page and in its terms. That is its own statement, and it links no reports. Where customer data is stored is not stated. Folderly is ahead on stated certifications. Warmerly is behind on two-factor sign-in, which it does not have. Last checked 22 October 2026.
FolderlyFolderly ahead on this row
States SOC 2 Type II and ISO 27001, with no reports linked; where customer data is stored is not stated.
The picture
Drawn side by side.
What each says about security
As each company states it
WarmerlyFolderly
Hosted in the EU
- No certification claimed
- API keys stored as hashes
- Billing in USD, GBP or EUR
SOC 2 Type II and ISO 27001
- Its own statement, no reports linked
- Data location not stated
- Billing in dollars
Folderly's security page returned an error when we read it, so we rely on its home page and privacy policy.
Where the data sits
As each page states it
WarmerlyFolderly
Warmerly
Customer data in the EUNo other hosting claim
Folderly
Stored outside your jurisdiction, maybeNo country or provider named
Folderly's privacy policy says data may be maintained outside your jurisdiction and, for EEA users, outside the EEA.
How Warmerly does it
Warmerly, in detail.
EU hosting, stated plainly, and no certification claimed. Warmerly publishes its retention periods, a data processing agreement and a sub-processor list, and says where it falls short, including that there is no two-factor sign-in today.
01
Hosted in the EU
Customer data is hosted in the EU. That is the only hosting claim this page makes: nothing about providers, regions or certifications.
Warmerly product, checked 21 October 2026
02
No certification claimed
We do not claim SOC 2, ISO or any other certification. If procurement needs one, Warmerly cannot supply it today.
Warmerly product, checked 21 October 2026
03
Encryption and access
The privacy policy lists encryption of data in transit, encryption at rest of mailbox credentials and tokens, hashed passwords, and access to production systems that is restricted to those who need it and logged.
Warmerly product, checked 21 October 2026
04
API keys stored as hashes
Only a SHA-256 hash of an API key is stored, and the key is shown once. Each user can hold up to 10 active keys, and a key has no read-only form.
Warmerly product, checked 21 October 2026
05
Sign-in protections
A password needs at least 8 characters and is checked against known leaks without sending the password itself. Too many wrong attempts block sign-in for a short while, per email address and per network. Changing or resetting a password signs out every other session. A session lasts up to 30 days.
Warmerly product, checked 21 October 2026
06
Where Warmerly is behind: no two-factor sign-in
There is no two-factor option in Settings today. Protection rests on the password, Google or Microsoft sign-in with that provider's own two-step verification, and the session controls.
Warmerly product, checked 21 October 2026
07
Published retention periods
Mailbox contents synced into the inbox are deleted when the mailbox is disconnected, and in any case within 30 days. Warmup activity logs are kept 12 months, in-app activity records 90 days and product usage records 24 months. Deleted data stays in encrypted backups for about 50 days.
Warmerly product, checked 21 October 2026
08
A data processing agreement and a sub-processor list
Warmerly publishes an Article 28 data processing agreement with the EU standard contractual clauses and the UK Addendum, and a sub-processors page that the agreement's list must match. Where a customer is itself a processor, for example an agency running client workspaces, Warmerly acts as its sub-processor.
Warmerly product, checked 21 October 2026
09
What Warmerly does read
Warmerly syncs a connected mailbox into its inbox and sends some mail to an AI provider to label leads and draft replies, using the sender, subject and the first 400 or 800 characters of a message. It says it does not use your content to train its own models and does not let its AI provider train on it.
Warmerly product, checked 21 October 2026
10
Billing in three currencies
Plans are sold in USD, GBP or EUR.
Warmerly product, checked 21 October 2026
How Folderly does it
Folderly, in detail.
A stated SOC 2 and ISO 27001 programme, and a vague data location. The claim appears in two places on its own site, and we could not open its security page. Its privacy policy and terms were last updated on 2 April 2026.
01
SOC 2 Type II and ISO 27001
The home page says Folderly maintains a security programme supported by SOC 2 Type II and ISO 27001. It does not link audit reports or certificates, and the security.folderly.com page returned an error when we read it.
folderly.com · read 22 October 2026
02
The same claim in the terms
Section 14 of its terms says it maintains a security and compliance programme supported by SOC 2 Type II and ISO 27001 resources. The wording is about resources that support a programme, not a statement that the company holds the certificates.
folderly.com/compliance/terms-and-conditions · read 22 October 2026
03
Data location not stated
Its privacy policy says data may be maintained on computers outside your jurisdiction and, for EEA users, that it may transfer data outside the EEA. It names no country, region or hosting provider. It describes safeguards only as appropriate technical and organisational ones.
folderly.com/compliance/privacy-policy · read 22 October 2026
04
Third parties named
The privacy policy names Google Analytics, Firebase, Hotjar, Mailchimp, Stripe, PayPal and several advertising vendors as service providers. It does not list sub-processors for the core service.
folderly.com/compliance/privacy-policy · read 22 October 2026
05
Mailbox access not described
The privacy policy's list of data collected names email address, name, payment details and usage data. It does not say whether Folderly reads mailbox content.
folderly.com/compliance/privacy-policy · read 22 October 2026
06
Retention and deletion
No fixed retention period is stated: data is kept only as long as necessary for the purposes set out. Erasure requests go to support@folderly.com or office@folderly.com. Usage data is described as generally retained for a shorter period.
folderly.com/compliance/privacy-policy · read 22 October 2026
07
Security measures described generally
The policy says no method of transmission or storage is completely secure and that it cannot guarantee absolute security. It names no specific measure such as encryption. Card handling is left to payment processors that it describes as PCI-DSS compliant, and it says it does not store payment card details.
folderly.com/compliance/privacy-policy · read 22 October 2026
08
Liability and backups in the terms
Liability is limited to the amounts you paid for the service in the preceding three months. The terms say Folderly does not guarantee there will be no loss or corruption of data. Governing law is Delaware, with exclusive jurisdiction of the Delaware courts.
folderly.com/compliance/terms-and-conditions · read 22 October 2026
What Folderly does not say
We looked, and found no statement on these. That is about its published pages only, not about the product.
- Audit reports or certificates
- Where customer data is stored
- Whether it reads mailbox content
- A sub-processor list
- A data processing agreement
- A stated retention period
- Two-factor sign-in
- How mailbox credentials are stored
Where the sources disagree
We report each version rather than pick one.
- Its privacy policy has an EEA paragraph that names another company, Belkins, which looks like copied template text. The transfer wording appears twice with different text. We do not rely on it.
- Folderly's terms word its SOC 2 and ISO 27001 claim as resources that support a programme. Its home page words it as a programme supported by the two standards. Neither links a report.
The numbers
Only what we could verify.
| Measure | Warmerly | Folderly |
|---|---|---|
| Security and data hosting | Customer data hosted in the EU. No certification claimed. | States SOC 2 Type II and ISO 27001, with no reports linked; where customer data is stored is not stated. |
| Certifications stated | None claimed | SOC 2 Type II and ISO 27001 |
| Data location | EU | Not stated |
| Billing currencies | USD, GBP or EUR | Dollars, currency not named |
| Mailbox contents kept after disconnect | Deleted within 30 days | Not stated |
| Warmup logs kept | 12 months | Not stated |
| Backups after deletion | About 50 days | Not stated |
| Workspace recovery window | 30 days | Not stated |
| Two-factor sign-in | Not available | Not stated |
In practice
What it means for you.
Our reading of the facts above. Not a promise, and not the only reasonable reading.
Ask for the report
If you need SOC 2 for procurement, ask Folderly for the report. A stated programme is not an audit report you can read, and the terms word it as resources that support a programme.
Ask us for what we claim
Warmerly claims EU hosting only. If you need certifications, we are not the right fit yet.
What a three month liability cap means in money
Folderly's terms cap liability at fees paid in the preceding three months. At its listed $96 a mailbox, five mailboxes for three months is 5 x $96 x 3 = $1,440, on a yearly option with a minimum commitment. Compare that with the loss you would carry if your mailbox data were exposed.
A data processing agreement
If you are in the UK or EU and need a signed Article 28 agreement, Warmerly publishes one with the standard contractual clauses and the UK Addendum. We did not find a data processing agreement on Folderly's compliance pages we read, so ask for one.
Offboarding a mailbox
On Warmerly, disconnecting a mailbox deletes its tokens and credentials at once and its synced contents within 30 days. Ask Folderly what happens to a disconnected mailbox, since its policy gives no retention period.
Who it suits
Pick the one that fits.
Warmerly
Warmerly is the better fit if
- You want customer data hosted in the EU
- You are content without a certification
- You want billing in GBP or EUR
- You want published retention periods and a data processing agreement
- You want a sub-processor list you can read
Folderly
Folderly is the better fit if
- Your procurement asks for SOC 2 Type II or ISO 27001
- You want a vendor that states a security programme
- You will request the audit reports
- You want audits that need no inbox connection, as Lens describes
- You are comfortable with US governing law
Questions
Is Folderly SOC 2 certified?
Its home page and terms say it maintains a security programme supported by SOC 2 Type II and ISO 27001 (read 22 October 2026). It does not link the reports, so ask for them. Warmerly claims no certification.
Where does Folderly store data?
Its privacy policy does not name a country, region or hosting provider. Warmerly hosts customer data in the EU.
Does Warmerly read my emails?
It syncs a connected mailbox into its inbox and sends some mail to an AI provider to label leads and draft replies, using the sender, subject and the first part of the message. It says it does not use your content to train its own models.
Does Warmerly have two-factor sign-in?
Not at the moment. You can sign in with Google or Microsoft and use that provider's two-step verification.
Sources
Folderly pages were read on 21 October 2026. Plans and wording change, so check the vendor's own page before you decide. Warmerly details come from the product as it runs today.
More features
- All features
- Starting price (per month)
- Pricing model
- Cost at 5, 25 and 100 mailboxes
- Free plan or trial
- Warmup and mailbox engagement
- SPF, DKIM, DMARC and blocklist checks
- DMARC reports
- Inbox placement tests
- Alerts
- Content and spam-trigger checks
- Campaign sending
- Mailbox providers and sending services
- Agencies, teams and API
See it on your own mailbox.
Connect a mailbox. Warmerly runs alongside whatever you send from now, so you can compare before you move anything.
Free plan, no card. Paid plans: 7-day trial, first charge on day 8.