Warmerly
Customer data hosted in the EU. No certification claimed.
Warmerly
Warmy
One-to-one · Data hosting and security
Data hosting and security
One row, in depth: what each tool does, the verified numbers, and who each suits.
Warmy details read from its pricing page, FAQ, home page, product pages and security page on 21 October 2026.
Warmerly
Customer data hosted in the EU. No certification claimed.
Warmy
Primary hosting on AWS in Ireland; SOC 2 Type II audit in progress.
The short answer
Data hosting and security, in one look.
Warmerly states one thing: customer data is hosted in the EU. It claims no security certification. Warmy states primary hosting on AWS in Ireland, AES-256 at rest, TLS 1.2 or higher in transit, and a SOC 2 Type II audit that is in progress, not complete. Warmy says more, and says it in detail. Last checked 22 October 2026.
Warmy
Primary hosting on AWS in Ireland; SOC 2 Type II audit in progress.
The picture
Drawn side by side.
What each states
Hosting and certification, as stated
WarmerlyWarmy
Hosted in the EU
- Customer data hosted in the EU
- No certification claimed
- API keys stored as hashes
AWS in Ireland, primary
- AES-256 at rest, TLS 1.2 or higher
- SOC 2 Type II in progress
- Other sub-processors named in its DPA
Warmerly claims only the EU hosting statement. Warmy's security page was read on 21 October 2026.
Warmy's SOC 2 Type II programme
Five months, as its security page describes them
WarmerlyWarmy
WarmerlyNo certification claimed
WarmyMonths 1 and 2 done, month 3 in progress, months 4 and 5 planned
12345
In progress is not certified: the audit report is not issued.
How Warmerly does it
Warmerly, in detail.
One confirmed hosting statement, and no certification claimed.
01
Hosted in the EU
Customer data is hosted in the EU. That is the only hosting claim we make: nothing about providers, regions or certifications.
Warmerly product, checked 21 October 2026
02
No certification claimed
We do not claim SOC 2, ISO or any other certification.
Warmerly product, checked 21 October 2026
03
Billing in three currencies
Plans are sold in USD, GBP or EUR.
Warmerly product, checked 21 October 2026
04
API keys stored as hashes
Only a SHA-256 hash of an API key is stored, and the key is shown once.
Warmerly product, checked 21 October 2026
05
Sign-in is protected
Sign-in is blocked for a short while after too many wrong attempts, per email address and per network, and a signed-in session lasts up to 30 days.
Warmerly product, checked 21 October 2026
06
Passwords are checked against leaks
A new password must be at least 8 characters and is checked against known leaked passwords, using only a fragment of a fingerprint of it.
Warmerly product, checked 21 October 2026
07
Disconnecting deletes passwords and tokens
Mailbox passwords and tokens are deleted the moment you disconnect a mailbox.
Warmerly product, checked 21 October 2026
08
Deleted workspaces wait 30 days
A deleted workspace is kept for 30 days to restore, then permanently deleted.
Warmerly product, checked 21 October 2026
09
Mailbox passwords are encrypted at rest
Passwords for connected mailboxes are encrypted at rest with AES-GCM.
Warmerly product, checked 21 October 2026
10
Roles limit who can change billing
Billing, plan changes and workspace deletion are owner-only, and admins can invite and remove people.
Warmerly product, checked 21 October 2026
11
API and MCP access is revocable
API keys can be revoked, and connected AI apps can be revoked from the workspace.
Warmerly product, checked 21 October 2026
12
Audit log of account actions
Mailbox connections, plan changes and API key creation are recorded in a read-only log. Sign-ins are not listed there.
Warmerly product, checked 21 October 2026
How Warmy does it
Warmy, in detail.
A detailed security page, with a SOC 2 audit still under way.
01
AWS Ireland
The security page says primary hosting is AWS in Ireland and shows a Data hosted in the EU (Ireland) badge. It names other sub-processors, including Hetzner and Google Cloud Platform.
warmy.io/security · read 21 October 2026
02
SOC 2 Type II in progress
The page describes a five-month programme with an independent auditor, with months 1 and 2 completed, month 3 in progress and months 4 and 5 planned. The badge reads in progress and the report is not issued.
warmy.io/security · read 21 October 2026
03
Encryption
AES-256 at rest and TLS 1.2 or higher in transit, including internal traffic.
warmy.io/security · read 21 October 2026
04
OAuth for Google and Microsoft
OAuth 2.0 is used for Google Workspace and Microsoft 365 with no password stored, and tokens are held in an encrypted vault and removed on disconnection.
warmy.io/security · read 21 October 2026
05
A DPA is offered
The page says Warmy offers a data processing agreement as Processor, covering GDPR, UK GDPR and CCPA, with the EU Standard Contractual Clauses.
warmy.io/security · read 22 October 2026
06
Named sub-processors
They include AWS, Google Cloud Platform, Hetzner, Google Workspace, HubSpot, Slack and Stripe, with at least 10 calendar days' notice of a change.
warmy.io/security · read 22 October 2026
07
Staff access
Access is role-based and least-privilege, logged, and granted only for a support or engineering task.
warmy.io/security · read 22 October 2026
08
Penetration testing
External specialists carry out penetration testing and findings are tracked. The page does not give a frequency.
warmy.io/security · read 22 October 2026
09
Sign-in options
Google sign-in and email and password, with SSO and 2FA for enterprise workspaces.
warmy.io/security · read 22 October 2026
10
No training on your mail
Warmy says it does not read, index or train on business correspondence.
warmy.io/security · read 22 October 2026
11
Backups are tested
The page says encrypted, automated backups are tested with restore procedures.
warmy.io/security · read 22 October 2026
12
Environments are separate
Production, staging and development are segregated, code is peer-reviewed and dependencies are scanned.
warmy.io/security · read 22 October 2026
13
Enterprise data options
Enterprise plans include data residency and retention options. The page does not define them.
warmy.io/security · read 22 October 2026
What Warmy does not say
We looked, and found no statement on these. That is about its published pages only, not about the product.
- Where backups are held
- The name of the auditor
- How OAuth tokens are protected in detail
- Incident notification timelines
- An uptime commitment
Where the sources disagree
We report each version rather than pick one.
- GDPR wording: the security page header says GDPR and CCPA aligned, while its FAQ answers Are you GDPR compliant with Yes.
- Password wording: no passwords are stored for OAuth mailboxes, while account sign-in does use email and password.
The numbers
Only what we could verify.
| Measure | Warmerly | Warmy |
|---|---|---|
| Data hosting and security | Customer data hosted in the EU. No certification claimed. | Primary hosting on AWS in Ireland; SOC 2 Type II audit in progress. |
| Data hosting | In the EU | AWS in Ireland, as primary |
| SOC 2 Type II | Not claimed | In progress, not issued |
| Encryption at rest | Not stated | AES-256 |
| DPA | Not stated | Offered |
| Data deletion on termination | Workspace kept 30 days after deletion | Within 30 days, per its page |
In practice
What it means for you.
Our reading of the facts above. Not a promise, and not the only reasonable reading.
Ask for the DPA
Both vendors can supply a data processing agreement. Ask for the sub-processor list before you connect client mailboxes.
Do not read in progress as certified
Warmy's SOC 2 Type II audit is not complete.
Send the questionnaire early
If your company needs a security review, Warmy has a page, a DPA and a contact for it. For Warmerly, ask support for what you need.
Do not read in-progress as passed
SOC 2 Type II at Warmy is an audit in progress, so ask for the report when it is issued.
Who it suits
Pick the one that fits.
Warmerly
Warmerly is the better fit if
- You want EU-hosted customer data
- You do not need a certification today
- You prefer short, plain claims
- You need only to know customer data is hosted in the EU
- You want to disconnect and have mailbox tokens deleted at once
Warmy
Warmy is the better fit if
- You want detailed encryption and hosting statements
- You are following a SOC 2 Type II audit
- You want an OAuth-only connection for major providers
- You need a DPA and a sub-processor list for a procurement review
- You want a stated security programme with an audit under way
Questions
Where is Warmy hosted?
Its security page says primary hosting is AWS in Ireland, with a Data hosted in the EU (Ireland) badge.
Is Warmerly SOC 2 certified?
No. Warmerly claims no certification. It states that customer data is hosted in the EU.
Is Warmy SOC 2 certified?
Not yet. Its page says a SOC 2 Type II audit is in progress, not issued.
How long is data kept after deletion?
Warmerly keeps a workspace for 30 days after deletion. Warmy says data is deleted within 30 days on termination.
Sources
Warmy pages were read on 21 October 2026. Plans and wording change, so check the vendor's own page before you decide. Warmerly details come from the product as it runs today.
More features
See it on your own mailbox.
Connect a mailbox. Warmerly runs alongside whatever you send from now, so you can compare before you move anything.
Free plan, no card. Paid plans: 7-day trial, first charge on day 8.