WarmerlyWarmerly ahead on this row
Customer data hosted in the EU. No certification claimed.
Warmerly
Mailreach
One-to-one · Data hosting and security
Data hosting and security
One row, in depth: what each tool does, the verified numbers, and who each suits.
Mailreach details read from its pricing page and script, home page, product pages, terms, privacy policy and docs on 21 October 2026.
Warmerly
Customer data hosted in the EU. No certification claimed.
Mailreach
Website on DigitalOcean per its terms; where customer data is stored is not stated; no certification stated.
The short answer
Data hosting and security, in one look.
Warmerly hosts customer data in the EU and claims no certification. Mailreach's terms say its website is hosted by DigitalOcean, and neither its terms nor its privacy policy says where customer data is stored or names a certification. Last checked 22 October 2026.
Mailreach
Website on DigitalOcean per its terms; where customer data is stored is not stated; no certification stated.
The picture
Drawn side by side.
Where customer data sits
As each company states it
WarmerlyMailreach
Hosted in the EU
- No certification claimed
- API keys stored as hashes
- Billing in USD, GBP or EUR
Location not stated
- Website on DigitalOcean, per its terms
- No certification stated
- Billing in US dollars
Warmerly claims EU hosting and nothing more. Mailreach's pages do not say where customer data is stored.
Who handles the data
Processors each page names
WarmerlyMailreach
Warmerly
Customer data in the EUPlans billed by cardNo other claims
Mailreach
Stripe for paymentsGoogle Analytics for statisticsOpenAI and Anthropic for assistants you connect
Mailreach's privacy policy names these. Neither company lists everything on one page.
How Warmerly does it
Warmerly, in detail.
Hosted in the EU, mailbox credentials encrypted at rest, per-mailbox access and a published sub-processor list, with no certification claimed.
01
Hosted in the EU
Customer data is hosted in the EU. That is the only hosting claim we make: nothing about providers, regions or certifications.
Warmerly product, checked 21 October 2026
02
No certification claimed
We do not claim SOC 2, ISO or any other certification.
Warmerly product, checked 21 October 2026
03
Billing in three currencies
Plans are sold in USD, GBP or EUR.
Warmerly product, checked 21 October 2026
04
API keys stored as hashes
Only a SHA-256 hash of an API key is stored, and the key is shown once.
Warmerly product, checked 21 October 2026
05
Mailbox credentials encrypted at rest
Microsoft refresh tokens and any mailbox credentials are encrypted before they reach the database, and a Google app password is stored encrypted too.
Warmerly product, checked 21 October 2026
06
Served over HTTPS
Warmerly is served over HTTPS and connects to your mailbox with TLS where your provider offers it.
Warmerly product, checked 21 October 2026
07
No Microsoft password seen
Microsoft 365 mailboxes connect through Microsoft's own sign-in, so Warmerly never sees the password.
Warmerly product, checked 21 October 2026
08
Access is per mailbox
Warmerly reaches only the mailboxes you connect, one at a time, with no domain-wide delegation. You can revoke access from your Microsoft or Google account at any time.
Warmerly product, checked 21 October 2026
09
Deleted data has a stated lifetime
A deleted workspace can be restored for 30 days and is then permanently deleted. Deleted data stays in encrypted backups until they expire, about 50 days.
Warmerly product, checked 21 October 2026
10
Published legal pages
A sub-processors page and a data processing agreement page are published on the site.
Warmerly product, checked 21 October 2026
11
Webhooks are signed
Outbound webhook deliveries carry an HMAC-SHA256 signature you verify with a secret shown once.
Warmerly product, checked 21 October 2026
How Mailreach does it
Mailreach, in detail.
A short privacy policy that names its processors and AI connection limits, and says little about location or security controls.
01
Website on DigitalOcean
The terms say the website is hosted by Digital Ocean. The location of data storage is not stated.
mailreach.co/terms-of-use · read 21 October 2026
02
No location in the privacy policy
The policy refers to its servers without saying where they are, and names no company address.
mailreach.co/privacy-policy · read 21 October 2026
03
GDPR mentioned
The policy says personal data is collected in accordance with applicable law including the GDPR. It sets out no lawful basis.
mailreach.co/privacy-policy · read 21 October 2026
04
Named processors
The policy names Stripe for payments, Google Analytics for statistics, and OpenAI and Anthropic for assistants you connect.
mailreach.co/privacy-policy · read 21 October 2026
05
Mailbox credentials
It says mailbox passwords and tokens stay on its servers and are never collected through ChatGPT.
mailreach.co/privacy-policy · read 21 October 2026
06
Retention is stated for one thing
AI assistant requests are kept in security and activity logs for 12 months. No retention period is given for account details, usage logs or mailbox statistics.
mailreach.co/privacy-policy · read 22 October 2026
07
What warm-up reads
For warm-up it uses the first and last name on the mailbox account and counts of warm-up emails in inbox, spam or other categories.
mailreach.co/privacy-policy · read 22 October 2026
08
Limits on AI connections
Tokens are limited to one project and the user's role, a connection lasts at most 30 days and removing a mailbox needs explicit confirmation. It says it does not use that data to train AI models.
mailreach.co/privacy-policy · read 22 October 2026
09
Spam test mail is stored
It says it needs to store the emails to make your deliverability reports available.
mailreach.co/email-spam-test · read 22 October 2026
10
Terms: backups are yours
The terms say the customer owns its data, that Mailreach uses it only to provide the services, and that the customer must make its own backups.
mailreach.co/terms-of-use · read 22 October 2026
11
French law and Paris courts
The terms are governed by French law, disputes go to the courts of Paris and the French version prevails over the English one.
mailreach.co/terms-of-use · read 22 October 2026
12
Payment by credit card
Plans are paid monthly in advance by credit card.
mailreach.co/terms-of-use · read 22 October 2026
What Mailreach does not say
We looked, and found no statement on these. That is about its published pages only, not about the product.
- Where customer data is stored
- A SOC 2, ISO 27001 or similar certification
- Retention periods for mailbox data
- A last-updated date on the privacy policy
- A data processing agreement
- A full list of sub-processors
- A description of encryption, backups or breach notification
- Retention for mailbox statistics and usage logs
Where the sources disagree
We report each version rather than pick one.
- Its terms say data is kept only to provide the services, while its privacy policy lists several processors, so the two describe sharing from different angles.
- The terms give privacy@mailreach.co for data requests while the privacy policy gives support@mailreach.co.
The numbers
Only what we could verify.
| Measure | Warmerly | Mailreach |
|---|---|---|
| Data hosting and security | Customer data hosted in the EU. No certification claimed. | Website on DigitalOcean per its terms; where customer data is stored is not stated; no certification stated. |
| Data hosted | In the EU | Not stated |
| Certification | None claimed | None stated |
| Billing currencies | USD, GBP or EUR | US dollars |
| Mailbox passwords | Encrypted at rest | Stay on its servers, never collected through ChatGPT |
| Deleted workspace restore window | 30 days | Not stated |
| Published sub-processor list | Yes, on a sub-processors page | None found, only named processors in the policy |
In practice
What it means for you.
Our reading of the facts above. Not a promise, and not the only reasonable reading.
If data residency matters, ask Mailreach
Its pages do not say where customer data is stored.
Neither claims a certification
If you need SOC 2 or ISO, neither is stated here, so ask each for what it holds.
Filling in a security questionnaire
For Warmerly you can answer hosting (in the EU), encryption of credentials, per-mailbox access and the 30 day restore window from published pages. For Mailreach the pages we read leave location, encryption and a DPA blank, so you would ask.
Revoking access
A Warmerly connection is revoked from your Microsoft account or by deleting the Google app password, and tokens are deleted on disconnect. Mailreach says removing a mailbox needs your explicit confirmation.
Leaving
At Mailreach you disconnect your accounts, the month started is charged in full and the terms say you keep your own backups. At Warmerly a deleted workspace is restorable for 30 days.
Connecting an AI assistant
Mailreach limits an assistant token to one project and 30 days. Warmerly's MCP connections are removed with the person who made them when that person leaves a workspace.
Who it suits
Pick the one that fits.
Warmerly
Warmerly is the better fit if
- You need customer data hosted in the EU
- You want a clear, short hosting claim
- You want GBP or EUR billing
- You need a published sub-processor list and DPA page to hand to procurement
- You want credentials encrypted at rest and per-mailbox access stated plainly
Mailreach
Mailreach is the better fit if
- You are happy with its stated processors
- You want mailbox credentials kept on its servers as stated
- You value its terms on data ownership
- You are happy with a short policy and will ask for details by email
- You want AI assistant limits spelled out, such as a 30 day token
Questions
Where does Mailreach store customer data?
Its terms say its website is hosted by DigitalOcean and neither its terms nor its privacy policy says where customer data is stored (read 21 October 2026).
Where does Warmerly host customer data?
In the EU. We claim no certification.
Does Mailreach sign a DPA?
The privacy policy we read does not mention one. Ask privacy@mailreach.co (read 22 October 2026).
How long does Mailreach keep data?
It states 12 months for AI assistant request logs. We found no other retention period.
Can I revoke Warmerly's access to my mailbox?
Yes. Revoke it from your Microsoft account, or delete the Google app password, at any time.
Sources
Mailreach pages were read on 21 October 2026. Plans and wording change, so check the vendor's own page before you decide. Warmerly details come from the product as it runs today.
More features
See it on your own mailbox.
Connect a mailbox. Warmerly runs alongside whatever you send from now, so you can compare before you move anything.
Free plan, no card. Paid plans: 7-day trial, first charge on day 8.