Warmerly
Customer data hosted in the EU; no certification claimed.
Warmerly
TrulyInbox
One-to-one · Hosting and security
Hosting and security
One row, in depth: what each tool does, the verified numbers, and who each suits.
TrulyInbox details read from its pricing page, home, features, how-it-works, network, why-trulyinbox and agencies pages, V2 blog post, refund policy, terms, privacy policy, API docs and help centre on 21 October 2026.
Warmerly
Customer data hosted in the EU; no certification claimed.
TrulyInbox
Operated from India under Indian law, with no hosting region named; SOC 2 compliance claimed on its features page only.
The short answer
Hosting and security, in one look.
Warmerly states that customer data is hosted in the EU and claims no security certification. TrulyInbox's privacy policy says it is operated from India, with data processed in India or elsewhere, and names no hosting region; its terms are under Indian law, and its features page claims SOC 2 compliance, a claim we found nowhere else on its site. Neither row is a clear win. Last checked 21 October 2026.
TrulyInbox
Operated from India under Indian law, with no hosting region named; SOC 2 compliance claimed on its features page only.
The picture
Drawn side by side.
Where data sits and what is claimed
As each company states it
WarmerlyTrulyInbox
Hosted in the EU
- No certification claimed
- Mailbox passwords encrypted
- API keys stored as hashes
Operated from India
- No hosting region named
- Indian law governs the terms
- SOC 2 claimed on one page
Neither is a clear win: one is a plainer statement, the other makes a certification claim we could not verify.
How Warmerly does it
Warmerly, in detail.
One hosting statement, no certification claimed, and encrypted credentials.
01
Hosted in the EU
Customer data is hosted in the EU. That is the only hosting claim we make: nothing about providers, regions, residency guarantees or certifications.
Warmerly product, checked 21 October 2026
02
No certification claimed
We do not claim SOC 2, ISO or any other certification. If a buyer needs one, the honest answer is that we do not hold or state one.
Warmerly product, checked 21 October 2026
03
Mailbox credentials are encrypted
Mailbox passwords are encrypted with AES-GCM before they are stored, and Microsoft mailboxes connect through a sign-in.
Warmerly product, checked 21 October 2026
04
API keys are stored as hashes
Only a SHA-256 hash of an API key is stored, and the key is shown once when it is created.
Warmerly product, checked 21 October 2026
05
Billing in three currencies
Plans are sold in USD, GBP or EUR, with the currency following the visitor's country unless they pick a region.
Warmerly product, checked 21 October 2026
06
Documents and a status page
A data processing agreement, a sub-processors list and acceptable use terms are published on the site, and a public status page covers the app and mail components.
Warmerly product, checked 21 October 2026
How TrulyInbox does it
TrulyInbox, in detail.
An India-operated company with Indian governing law, encrypted credentials, and security claims on its features and network pages that its privacy policy does not repeat.
01
Operated from India
The privacy policy names Ikigai Infotech LLP as controller, gives no postal address, and says the service is operated from India. Data may be processed in India or in other countries where it or its providers operate.
trulyinbox.com/privacy · read 21 October 2026
02
No hosting region named
The policy lists categories of processors, such as cloud hosting, payment, email and analytics, and names none. For EEA, UK and Swiss data it cites standard contractual clauses, adequacy decisions and other legally approved mechanisms.
trulyinbox.com/privacy · read 21 October 2026
03
Indian law governs the terms
The terms are governed by the laws of India, with the courts of Ahmedabad, Gujarat having exclusive jurisdiction. Total liability is capped at what you paid in the 12 months before the claim, and damage to sender reputation is excluded.
trulyinbox.com/terms · read 21 October 2026
04
Credentials and message content
OAuth is used for Gmail and Outlook, and the policy says it does not store email passwords when OAuth is used. SMTP and IMAP credentials are encrypted at rest. It says it does not read, store or analyse email content outside of the warmup process.
trulyinbox.com/privacy · read 21 October 2026
05
SOC 2, on one page
The features page claims SOC 2 compliance with encryption at rest and in transit. We found no SOC 2 statement on the pricing, privacy, terms or network pages.
trulyinbox.com/features · read 21 October 2026
06
Retention and rights
Closed accounts keep data for 90 days and then it is deleted or anonymised. Requests go to privacy@trulyinbox.com and the policy promises a reply within 30 days.
trulyinbox.com/privacy/; https://www.trulyinbox.com/terms · read 21 October 2026
07
Enterprise terms
The network page mentions a custom DPA and security review and data residency options of US, EU or custom for the Enterprise tier, and SLAs of 99.95% and 99.99%. Those are contract offers, not described controls.
trulyinbox.com/network · read 21 October 2026
What TrulyInbox does not say
We looked, and found no statement on these. That is about its published pages only, not about the product.
- A named hosting provider or region for customer data on standard plans
- A SOC 2 report, auditor or date to go with the SOC 2 claim
- A list of named sub-processors
- An answer to the FAQ question on data security on its network page, which is asked and not answered
Where the sources disagree
We report each version rather than pick one.
- The features page claims SOC 2 compliance, and the privacy policy and terms describe no certification. The network page lists SLAs and DPAs as Enterprise offers.
- The footer lists one phone number and the privacy policy another, and neither page gives a postal address for the controller.
The numbers
Only what we could verify.
| Measure | Warmerly | TrulyInbox |
|---|---|---|
| Hosting and security | Customer data hosted in the EU; no certification claimed. | Operated from India under Indian law, with no hosting region named; SOC 2 compliance claimed on its features page only. |
| Stated hosting | EU | Not named, operated from India |
| Certification claimed | None | SOC 2, on one page |
| Governing law | Not covered here | India |
| Data kept after closing | Not covered here | 90 days |
| Privacy request reply | Not covered here | Within 30 days |
| Currencies billed | 3 | 7 on a selector |
| Uptime claim | None published | 99.9% over 12 months |
In practice
What it means for you.
Our reading of the facts above. Not a promise, and not the only reasonable reading.
EU hosting is a statement, not a guarantee
Our claim is one line: hosted in the EU. It does not say which provider or promise residency for every record, and we make no further claim. If your contract needs more, ask for it in writing.
Ask TrulyInbox where the data sits
If you hold data of EU or UK people, its policy leaves hosting region open and relies on transfer mechanisms. Ask for the region and the sub-processor list before you connect mailboxes.
A claim on one page is weaker than a claim on five
SOC 2 appears on its features page and nowhere else we read. Ask for the report if you rely on it, because a certification is only useful with an auditor's name and a date.
Choose by what you must be able to say
If your own customers ask where their data is, an EU line is easy to repeat. If your procurement team asks for SOC 2, TrulyInbox's claim is a place to start, and ours is a no.
Think about governing law
TrulyInbox's terms send disputes to the courts of Ahmedabad. For a small purchase that rarely matters, and for a large one your legal team will want to read it.
Ask for evidence of uptime
A 99.9% claim is a number someone chose to publish. Ask TrulyInbox how it is measured, and look at Warmerly's status page, which shows the components it probes, before you decide uptime matters to you.
Who it suits
Pick the one that fits.
Warmerly
Warmerly is the better fit if
- You want a plain statement that customer data is hosted in the EU
- You prefer a vendor that does not claim certifications it cannot show
- You want to bill in pounds or euros as well as dollars
- You want a public status page and published DPA and sub-processor pages
TrulyInbox
TrulyInbox is the better fit if
- You need a SOC 2 claim to start a procurement conversation
- You want a custom DPA and data residency options on an Enterprise contract
- You want a published uptime figure and SLA tiers to negotiate from
- You are happy with an India-based company under Indian law
Questions
Where does TrulyInbox host data?
Its privacy policy says it is operated from India and that data may be processed in India or other countries, and it names no hosting region.
Is TrulyInbox SOC 2 compliant?
Its features page claims SOC 2 compliance. We found no report, auditor or date, and no mention on its other pages.
Where does Warmerly host data?
Customer data is hosted in the EU. We make no claim about providers, regions or certifications beyond that.
Can I get a data processing agreement from TrulyInbox?
Its network page mentions a custom DPA and security review for the Enterprise tier. Whether standard plans can sign one is not stated.
Does Warmerly publish a data processing agreement?
Yes, a DPA and a sub-processors list are published on the site, along with acceptable use terms and a prospect privacy notice.
Sources
- TrulyInbox privacy policy
- TrulyInbox terms of service
- TrulyInbox features page
- TrulyInbox network page
- Warmerly trust and security
- Warmerly sub-processors
TrulyInbox pages were read on 21 October 2026. Plans and wording change, so check the vendor's own page before you decide. Warmerly details come from the product as it runs today.
More features
- All features
- Starting price (per month)
- Pricing model
- Cost as you add mailboxes
- Free plan, trial and refunds
- Daily warmup volume
- Warmup strategies and controls
- Warmup network size
- Spam rescue
- Health score and readiness
- Authentication and blocklists
- Supported mailboxes
- Campaign sending
- API access
- Agencies and teams
See it on your own mailbox.
Connect a mailbox. Warmerly runs alongside whatever you send from now, so you can compare before you move anything.
Free plan, no card. Paid plans: 7-day trial, first charge on day 8.