Trust and security
Where your business’s data lives, who helps us run the service, the agreements behind it, and the protections in place today. Including what we do not claim yet.
Where data is kept
- The app and its database
- France (EU)
- The United Kingdom
- Customers outside Europe
- Your data is held in the EU and the UK wherever your business is. There is no choice of region yet.
Who processes data for us
| Company | What for | Where |
|---|---|---|
| Contabo GmbH | Hosting: the servers that run the app, its database and the mail server | France (EU) and the United Kingdom |
| Cloudflare, Inc. | DNS, network protection and content delivery, and TLS certificates for the custom domains of business pages (Cloudflare for SaaS) | Worldwide network; the company is in the United States |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Payments, invoices and tax for the Business plans we sell. For payment data Stripe is an independent controller | Ireland, the United States and other countries |
| GitHub, Inc. | Hosting the desktop app downloads | United States |
| Anthropic, PBC | AI features (Piccolo and Fix with AI), only when someone uses them. Not used to train AI models | United States |
| OpenAI, L.L.C. | AI features, only for people who choose ChatGPT in Settings and only when they use them. Not used to train AI models | United States |
| KLIPY | GIF search in Vire, only where it is switched on | To be confirmed |
Agreements and policies
Protections in place today
Each business kept apart
Every business request is checked against your business first. People outside it get a not-found answer, so its details cannot be guessed.
Mailboxes only on your verified domain
Before any change to a mailbox, we check its address is on a verified domain of that same business.
No sign-ups on your domain
Once your domain is with us, nobody can create a free Viremail address on it.
Passkeys and two-step sign-in
Every mailbox can sign in with a passkey, and add codes from an authenticator app.
Admin actions recorded
Creating a business, each domain step and each new mailbox are written to a log chained with a keyed hash.
Security and compliance, and what is on the way How every account is protected
What we do not claim
- We do not hold an independent security certification, such as SOC 2 or ISO 27001, yet.
- We aim for 99.9% uptime, but we do not offer service credits yet.
- Single sign-on, admin policies and an audit log you can read in the app are still being built.
- Unless you use end-to-end encryption, your mail and files are stored in a form our systems can read, so they can be delivered, filtered and searched.
Found a weakness? Our responsible disclosure policy explains how to tell us, or write to [email protected].
Your domain, your team, one price per person.
Your first mailbox is free for a month. No card needed.