Less boo. More booked. Halloween offer: 30 days free on any paid plan. Claim 30 days free
Your mailbox is the most sensitive asset we touch. Here is how Warmerly protects it, what data we store, and who we work with to run the service.
How a send is handled
Each account you link is logged in to when you connect it. Its domain records are checked after you connect and again several times a day, and a failure raises an alert.
Peer mailboxes in the warmup pool are real accounts that Warmerly logs in to. For mailboxes we host, a block list of known low-reputation domains is kept out of the pairing.
Security posture
Microsoft refresh tokens and any mailbox credentials are encrypted with AES-256-GCM before they touch our database. Encryption keys are stored separately from the data they protect.
Warmerly is served over HTTPS. Connections to your mailbox use TLS where your provider offers it.
Microsoft 365 mailboxes connect through Microsoft's own sign-in, so we never see your password. Gmail and Google Workspace connect with a Google app password, stored encrypted at rest and revocable from your Google account at any time.
We ask for the mailbox access warmup needs: IMAP and SMTP access to send and read mail, plus the standard sign-in permissions on Microsoft. You can revoke it from your Microsoft account, or revoke the app password from your Google account, at any time.
Security checks run when an account is created and when a mailbox is connected. If a new account looks like a second account for someone who already has one, it is paused and the person is shown their options. Nothing is deleted, and the person can file an appeal.
When a campaign email comes back as undeliverable, the address is added to our suppression list and the sequence for that contact stops, so a dead address is not mailed again and again.
Data handling
Warmerly's app, API, workers and main database run on Microsoft Azure in Sweden (Sweden Central region). Our mail servers run on OVHcloud in the EU.
Databases are dumped nightly, encrypted (AES-256), and stored in Microsoft Azure Blob Storage (Germany West Central, zone-redundant), kept for 35 days plus 14 days of soft-delete. The production database's write-ahead log is also archived continuously, encrypted, which allows point-in-time recovery.
Mailbox tokens and credentials are deleted immediately on mailbox disconnect. A deleted workspace can be restored for 30 days after the deletion takes effect, and is then permanently deleted. If you ask us to close your account, we delete it, except where the law requires us to keep data.
Domain authentication
Authentication is the part of deliverability that is genuinely binary: either the records are right or receiving servers cannot confirm you are who you claim to be. Warmerly re-checks all four record types several times a day on the domain of every live mailbox (paused mailboxes are skipped), and checks the domain against public blocklists.
When a record hard-fails, Warmerly alerts you.
Compliance and processors
Warmerly acts as a data processor on behalf of customers and as a data controller for account information. We honour data subject rights including access, correction, deletion, and portability.
A Data Processing Addendum is available on request. Read our standard Data Processing Addendum.
A full, current sub-processor list (with data categories, location, and the date each was added) is on our Sub-processors page, or in the DPA.
Enterprise & Google Workspace
Straight answers for Google Workspace and Microsoft 365 admins evaluating Warmerly, drawn directly from how the integration is built.
Per-mailbox access. Warmerly does not use a service account or domain-wide delegation, so it cannot act on behalf of your Workspace domain as a whole, only on the individual mailboxes you connect. Each Google mailbox connects with its own app password, and each Microsoft 365 mailbox through its own sign-in, using delegated mailbox scopes (IMAP and SMTP access plus the standard sign-in permissions) and no application-only permissions.
Yes. Each mailbox is connected independently. You choose which mailboxes to authorize, and nothing else in your Workspace or Microsoft 365 tenant is touched.
Yes. Every mailbox is connected on its own: Microsoft 365 through its own sign-in and consent screen, Gmail and Google Workspace with their own app password. Each credential is stored encrypted against that mailbox's account record.
No. Warmerly never requests Google Admin SDK / Directory API scopes, or the equivalent Microsoft Graph directory scopes, and has no code path that enumerates a domain's users. It can only ever see the mailboxes that were individually authorized.
Not today: we don't currently hold a SOC 2 report. Our current controls are architectural: no domain-wide delegation, least-privilege, mailbox-only access, and AES-256-GCM encryption at rest for credentials (see “Security posture” above).
Yes. Our standard DPA is part of the Terms and applies automatically. A countersigned copy is available on request. Read it at /dpa.
Status
We monitor warmup dispatch, Microsoft refresh, and the dashboard continuously. Incidents and scheduled maintenance are posted to our public status page.
View status pageCompany identity
Warmerly is a trading name operated by Kristiyan Tsvetanov, a self-employed sole trader based in the United Kingdom.
Independent reviews
Trust signals should come from outside, not just us. If you use Warmerly, leaving an honest review on any of these platforms helps others make a better-informed decision.
Sender health
Security work protects your credentials. Sender health protects your ability to reach anyone at all. Warmerly watches both, and shows your bounce rate, undeliverable rate, DNS authentication and blocklist status.
Blocklist status is checked against a set of public blocklists, so a listing shows up as an alert.
Send us your questionnaire, request a DPA, or ask where your data is processed.
