---
title: "Trust: data location, CLOUD Act, security · Elchi Studios"
description: "Where data sits at Elchi Studios, who sees it and what the US CLOUD Act has to do with it, with the exceptions named and what is still missing."
url: https://elchi.dev/en/vertrauen
language: en
---

Trust

# Where your data is, and who sees it.

Stored data, meaning accounts, mailboxes, content and databases, sits on our own servers at European providers in Switzerland, Germany, the Netherlands and France. The few services that differ from this are named below.

## The US CLOUD Act

Since 2018, a provider subject to US law has to hand data it possesses or controls to US authorities, even when it is stored in Europe. What decides is therefore not where a data centre stands but who owns it. That is why your stored data sits only with European providers here.

[The CLOUD Act, in detail](https://elchi.dev/en/wissen/cloud-act)

## What is missing

We hold no ISO 27001 or SOC 2 certification and have had no independent security audit. What we disclose instead: where every server stands, who sees which data, how passwords are stored, and every incident at its real length. When the audit happens, we publish the result, whatever it is.

## The path of an email at EMX

Where an email arrives, where it is kept, who can read it and how it leaves. Drawn from the sketch EMX started with.

[How the diagram was made](https://elchi.dev/en/entstehung)

**The path of an email at EMX.** An email comes from a sender on the internet to mx.emxmail.ch, where SPF, DKIM and DMARC are checked and the spam filter runs. Messages and attachments are stored encrypted in Geneva, sealed if you want; the database is in Frankfurt, with copies in Nuremberg and Paris. Mail is read in the web client and the app with sign-in through EAuth, in Outlook, Apple Mail and on the phone over IMAP with an app password, and by your software through the API with a token. Our own servers deliver outgoing mail, signed with DKIM, to recipients on the internet.

 

## The exceptions, by name

We still use four services from outside the EU or from a US group, for narrowly limited jobs.

Service

What for

What it sees

Resend, United States

Notification mails: an address confirmation, a password reset, invitations, replies to an enquiry.

The recipient's address and the content of that one mail. Sent from the EU, stored in the United States.

Stripe, Ireland (a US group)

Payment for EMX Team.

The payment details. No mail, no accounts of your users.

Cloudflare, United States

Holds the DNS zones of our domains.

Names and addresses of our servers, no traffic. Cloudflare does not pass requests through.

Spamhaus, United Kingdom

Block lists for the EMX spam filter.

Addresses and domains of sending servers, no messages.

## Being able to leave

With EAuth you export every account with the password hashes in their original form. With EMX every mailbox, over IMAP or the API. With a website all text, pictures, enquiries and data. At any time, without asking us.

## Reporting security issues

Write to security@elchi.dev, in German or English. Every host names the address in /.well-known/security.txt. You get an answer within three working days. Whoever keeps to the rules has no legal action to expect from us; there is no reward programme.

[security@elchi.dev](mailto:security@elchi.dev)

[The rules for reports](https://docs.elchi.dev/security#reporting-a-vulnerability)

## Sub-processors

The complete list, with the place and job of every provider. When it changes, we announce it 30 days ahead.

[To the list](https://docs.elchi.dev/subprocessors)

## Incidents

What is running is on status.elchi.dev, measured from several places. Every incident is recorded there at its real length.

[status.elchi.dev](https://status.elchi.dev/)

## Legal documents

Imprint, privacy policy, terms, data processing agreement and the terms for EAuth and EMX. Every version stays published, with the day it applied from.

[All legal documents](https://legal.elchi.dev/en/)

## Infrastructure

Eight servers at Hetzner, UpCloud, Infomaniak, Scaleway and Tavuru in Switzerland, Germany, the Netherlands and France, with three copies of every database.

[How the cluster is built](https://elchi.dev/en/infrastruktur)