Rendered at 19:20:43 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
jacquesm 2 hours ago [-]
EU data regions are a reflexive action by companies that try to hold on to their EU customers (and more and more are leaving, surprisingly the larger ones seem to be leading here). Realize that as long as you are still hosted on US owned infrastructure or that if there are US owned companies anywhere in the stack your data can still be forcibly pulled and often without you being aware that this happened. There are only very few such stacks that are 100% owned by EU entities.
ffsm8 1 hours ago [-]
> your data can still be forcibly pulled and often without you being aware that this happened
as a german i feel the urge to point out that this technically also applies to european companies...
With more hurdles for the US, but still technically applicable
usernomdeguerre 1 hours ago [-]
True, I think the calculus is more about who you think is more trustworthy than what tools they have to damage you.
slow_typist 10 minutes ago [-]
Especially if European companies have an office and significant share of customers in the US.
V__ 2 hours ago [-]
For anyone curious, it's the CLOUD act:
> The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil.
The point of control is Congress, until we stop electing corpratist politicians, we will continue to get bad legislation.
braiamp 2 hours ago [-]
Which wouldn't matter where the data is located, so I don't think that this is the reason Fastmail is doing it, because a savvy enough company would know that the problem is that the company is US based.
kid64 1 hours ago [-]
They're Australian
petcat 1 hours ago [-]
Australian companies are also subject to the USA Cloud Act. As is the UK, with Canada coming on board soon too.
Even the entire EU is in the process of negotiating the same agreement.
Your linked information doesn't indicate anywhere that Australia or any other foreign government is subject to US law. The latter states that negotiation with the EU on this topic was suspended in 2019.
Things have changed. With Chinese law in regards to data within Chinese jurisdiction a long-standing thing and an unfriendly American government potentially in power for an extended period, other countries are realizing the importance of data sovereignty.
> The latter states that negotiation with the EU on this topic was suspended in 2019.
Dated 2023:
> Justice Department and European Commission Announces Resumption of U.S. and EU Negotiations on Electronic Evidence in Criminal Investigations
The negotiations are still ongoing. Canada is further along than the EU.
wolfi1 1 hours ago [-]
isn't there this five eyes thingy?
kisamoto 18 minutes ago [-]
Does this still apply if there are separate legal entities for US & EU operations? Take Hetzner as an example. They have a separate US company to deal with their US data center. Would their EU servers be vulnerable to the CLOUD Act?
microtonal 1 hours ago [-]
Yeah, this does absolutely not solve the CLOUD Act issues. However, it is good to look at what the ramifications of the CLOUD Act is for e-mail:
- The US could request your data. You probably shouldn't use e-mail for anything sensitive anyway for many reasons. E-Mail was traditionally not encrypted and I think that many servers still allow plain-text communication. The protocols are old and there are all kinds of downgrade attacks. Aside from that, even if your service does not fall under the CLOUD Act, you are probably f*cked anyway, because most people you communicate with are using services that fall under the CLOUD Act.
- The US can force the provider to block your account. The workarounds are: regularly backup your e-mail (easy for services that offer IMAP) and, most importantly, use a domain with an extension that is not under the control of a US (or probably five eyes) registrar.
Use an E2E-encrypted messenger with perfect forward secrecy, etc. for most personal communication.
atmosx 1 hours ago [-]
That’s true and Fastmail runs on AWS. But it’s a start and a “feature” many have requested for years. It’s funny because the HQ and I believe their workforce is located in Australia.
chrismorgan 31 minutes ago [-]
Fastmail has never used AWS, and this article is pretty clear about how they have always used their own hardware and traditional colocation.
Fastmail used to be based in Melbourne only, but after the Pobox merger it ended up with an office in Philadelphia too. No idea how the balance of things is between the offices now.
atmosx 21 minutes ago [-]
That’s interesting, I thought they were hosted on AWS. Thanks for sharing.
preisschild 8 minutes ago [-]
But how is it actually "a start" or improves anything at all? It doesnt matter where the "physical location" of the data is. It matters who has access to it.
calvinmorrison 22 minutes ago [-]
Fastmail runs on its own infra.
rufasterisco 1 hours ago [-]
Can you point me towards some resources that show EU customers moving?
Not that I don’t trust the statement, I just would like to know more.
calvinmorrison 23 minutes ago [-]
Fastmail is an Australian company
amelius 1 hours ago [-]
How does Apple handle it?
xnickb 58 minutes ago [-]
Why would apple care? Eu is what a quarter of their business? And where exactly will those people move? They're locked into the Apple infra.
mrtesthah 1 hours ago [-]
Ok, but Fastmail is an Australian company based in Melbourne.
petcat 1 hours ago [-]
Australia and the US entered into a bilateral agreement in 2024 which made Australian companies subject to the US CLOUD Act.
As a FastMail customer who spends a portion of the year in the US, I am happy to pay to move my data to the EU region, even if they cannot yet fully guarantee all my data will remain outside of US access at this time. Defense and mitigations in depth, over time. We must always start somewhere, and perfect is never the target (as it does not exist).
OJFord 1 hours ago [-]
But whose cloud infrastructure do they use? (I don't know, but it might likely be AWS, GCP, or Azure.)
microtonal 1 hours ago [-]
That it described in the linked post:
We’ve installed our own servers, co-located in a secure facility in Amsterdam, set up by our own engineers.
calvinmorrison 22 minutes ago [-]
None. It's racked and stacked old school
selectively 2 hours ago [-]
[dead]
robin_reala 2 hours ago [-]
Posted on the previous submission for this: it’s a good start, but from the article:
If what you need is a guarantee that your data remains only in the EU, we don’t have that, and we’d rather tell you directly than let you assume otherwise.
intothemild 2 hours ago [-]
Wow they completely missed the ball on why people want reassurances that their data stays in the EU
fodkodrasz 32 minutes ago [-]
For me this is already a better value proposition, as less value add happens in the US. With the US being a perpetrator in trade war against the EU, even this matters. Everything counts, in large amounts...
xnickb 57 minutes ago [-]
I think they just know what they can and can't guarantee.
linux2647 38 minutes ago [-]
Agreed. I imagine they’ll announce an EU-only option later once they get more EU infrastructure in place
calvinmorrison 21 minutes ago [-]
One needs multiple data centers in europe for backup and DR, sounds like they have one
altairprime 2 hours ago [-]
EU folks, note the warnings threaded throughout this post: this is not currently any sort of panacea against US or AU data hosting risks, but it will make your data noticeably closer to home. Fastmail (Australia) merged with Pobox (Philadelphia) resulting in a complex tri-national law/risk surface when the EU is involved, so go in eyes wide open having read this in full. That everyone will overinterpret “EU data region” to mean “for privacy” here until reading the article is completely understandable; I empathize, having done the same.
superq 29 minutes ago [-]
EU data regions are based on the insanely flawed idea that data is:
* a physical thing that can only live in one place
* not copyable
* can be 'contained'.
The whole thing reeks of bureaucratic 'best practices' that just aren't.
Even worse than that, trying to keep email restricted to the EU (or anywhere else) means that you effectively wouldn't be able to communicate with anyone in a different region, which is kinda the whole point.
Why not just make your own internet next? and then you can disconnect from everyone else who is trying to hack you. Just pull your network plug.
Email itself is hopelessly insecure by design anyway. Not just metadata when you are E2EE everything inside the envelope, but even basic vulns like downgrade attacks are simple because it's literally a violation of the RFCs (so you're not spec-compliant) to require TLS or any other encryption.. Why? because requiring modern crypto might interfere with deliverability and backwards compatibility. The real, deeper reason is that email is from a kinder, simpler time (well, at least simpler) and the design goals were never updated to keep up with the times.
Email is what we have. Just understand its flaws and then use other tools where you can. And who cares where your email lives - it's too easy to break anyway.
egorfine 41 minutes ago [-]
Can't wait to verify my age before reading emails!
In all seriousness though, what are the chances Fastmail won't require KYC at some point? I have sent them a support request with that question and got a non-answer.
PS: Am a paying customer for like a decade
rzerowan 44 minutes ago [-]
Seeing a lot of detail in the comments about the CLOUD act which applies as they(fastmail) themselves have an equivalent that was signed between USgov and Australia.
The more concerning issue as far as Australian based tech is The Assistance and Access Act 2018 which
"...permits government enforcement agencies to force businesses to hand over user info and data even though it’s protected by cryptography.
If firms don’t have the power to intercept encrypted data for authorities, they will be forced to create tools to allow law enforcement or government to have access to their users’ data."
As far as i know this has not been challenged or walked back and with the rise of ChatControl like laws doesnt seem it will.
chrismorgan 27 minutes ago [-]
The Assistance and Access Act is completely irrelevant to Fastmail, because Fastmail doesn’t offer end-to-end encryption. Fastmail was always subject to the Telecommunications Act, which allows Australian police access with warrants, and Fastmail has always made it clear that it complies with legal warrants.
rb666 18 minutes ago [-]
Finally! I have been asking for this since the US started to lose its mind. Great they are listening.
crossroadsguy 1 hours ago [-]
I have never understood their 50+10 GB storage as the starting plan. Anyone storing a lot of emails, please don't come at me screaming, but know that not everyone keeps every email and every attachment ever received right there in that email account (especially the attachments). For me, email is just communication i.e timed information, not data storage, except for very personal emails, and very very rare, some non-personal important emails. So some people do like to simply delete the emails they no longer need. Also their pricing almost feels like "unlimited storage" backup solutions mass pricing strategy.
tene80i 51 minutes ago [-]
You mean why isn’t there a cheaper tier than $5/mo? Not much to be gained by offering it, I would think.
cube2222 1 hours ago [-]
Nice, as a European customer, I appreciate this.
Side note, I moved to Fastmail a couple years ago, and so far I’ve been very happy with it! The Gmail migrator works great, too.
greenleafone7 45 minutes ago [-]
The article states that they do not offer any guarantee that my data will stay in the EU!
I feel that that's the whole point. And the whole point of them making this article/advertisement.
petcat 38 minutes ago [-]
How could they possibly guarantee such a thing?
Do you only send and receive emails with people in the EU?
2 hours ago [-]
PeterStuer 2 hours ago [-]
Five Eyes country are subject to local data disclosure orders and gag clauses, forcing them to hand over user data that may then enter the shared intelligence pool
skywal_l 2 hours ago [-]
There are no Five Eyes country in the EU.
r_lee 1 hours ago [-]
the company is based in Australia, which is part of FVEY
anon48293 1 hours ago [-]
No, but there are nine eyes and fourteen eyes with EU countries.
PeterStuer 1 hours ago [-]
Is fastmail not australian?
throw1234567891 2 hours ago [-]
they offer services in the EU
senderista 1 hours ago [-]
Not sure Five Eyes will outlast Trump, the UK has reportedly stopped sharing some intelligence with the US:
If what you need is a guarantee that your data remains only in the EU, we don’t have that, and we’d rather tell you directly than let you assume otherwise.
Is there an alternative that really keeps data in the EU? (And not only in the sense it serves a sales promotion)
atmosx 57 minutes ago [-]
Depends on the definition and your threat model but to make a very large story short; it’s email, others have copies (your gmail friends?). Metadata is public by default the body can be encrypted and encrypted at rest (comes with many limitations) and that’s the highest level of security you can realistically achieve.
If that works fine if not, use another method of comm. Email wasn’t designed to be secure.
lschueller 46 minutes ago [-]
Thank you. Sure. In Europe the "euro stack" approach becomes more and more relevant. So, the issue is more a compliance topic in the way of making use of service provides, who are best-case "eu-headquartered", but at least with a guarantee that processing on my side stays within the european realm. Doesn't mean very little in a technical understanding of security, I agree.
59 minutes ago [-]
vzaliva 1 hours ago [-]
I do not know any EU-only, but ProtonMail is in Switzerland.
petcat 56 minutes ago [-]
Proton is leaving Switzerland because of surveillance and privacy issues.
> Because of legal uncertainty around Swiss government proposals to introduce mass surveillance — proposals that have been outlawed in the EU — Proton is moving most of its physical infrastructure out of Switzerland.
They are moving to Germany, but will quickly find that they are going to face the same surveillance and privacy issues since the EU is in the process of negotiating a data sharing agreement under the US Cloud Act.
As a European and Fastmail user, this is great news.
I_am_tiberius 2 hours ago [-]
And which company hosts the data? An American company like Aws, Azure, Google or a European company like OVH, Stackit?
fhdkweig 2 hours ago [-]
The flagged/dead comment contains a copy of the entire page, but the relevant part is:
> Built by us, not rented from someone else
> We’ve installed our own servers, co-located in a secure facility in Amsterdam, set up by our own engineers. This new location is built to the same high standards as our existing infrastructure in Philadelphia and St Louis, with our own hardware and our own software — specified right down to the exact model of disks in each machine.
> In all our locations, data is stored encrypted at rest inside locked racks, and managed by our in-house team. We don’t rent computing or management services from a big cloud provider and pass on their assurances. That’s how we’ve approached privacy, reliability, and performance for more than 25 years.
techpression 2 hours ago [-]
> We’ve installed our own servers, co-located in a secure facility in Amsterdam, set up by our own engineers. This new location is built to the same high standards as our existing infrastructure in Philadelphia and St Louis, with our own hardware and our own software — specified right down to the exact model of disks in each machine.
sparkling 19 minutes ago [-]
To me, jurisdiction matters more than physical location. I'd rather be with a EU-operated service that stores data on a non-EU server, than a non-EU operator with a German/french datacenter.
tamimio 40 minutes ago [-]
Does it matter much? From one side, you are still in the 14 eyes countries (in fact, I would trust a Chinese server if i am living in the west and vice versa), on another side, emails as a protocol was never meant to be secure or private, so deal with it as that, if you are after private or secure communication, choose a protocol that provides that, adding more stuff to emails will only complicate it further plus giving false sense of privacy/security, gpg will leak meta data, receiver email server/client might expose you too, among many gaps, so just avoid it. Still, make sure your email spf dkim dmarc etc are set properly and carry on.
atmosx 1 hours ago [-]
Okay, that solves two problems for me. Great news.
KingOfCoders 1 hours ago [-]
We offer EU data centers for customers that want their emails to stay in the EU but
"Resilient replicas of your data will live in the US"
?
crossroadsguy 1 hours ago [-]
The US data replicas will be resilient, and when the FBI asks your data to reveal things about itself, your data will refuse to reveal anything about itself in the characteristic resilient manner. That's why the mention of "resilient".
KingOfCoders 54 minutes ago [-]
How is that possible if the OS/drive/vault is backdoored? Could you elaborate?
I think "resilient" just means "backup copy" and I do think (IANAL) it is illegal to destroy emails when asked for them in the US.
Or was your comment ironic? Sorry, German, irony impaired.
varispeed 1 hours ago [-]
Data is still compellable through US Cloud Act (and other provisions). If you want true EU data region, you should buy from a company without presence in the US.
honeycrispy 2 hours ago [-]
Right in time for Chat Control 1.0. Servers in Europe doesn't have the same privacy implications that it had a year ago.
lrae 1 hours ago [-]
You mean Chat Control 1.0 that was already in place from 2021 to April 2026 and allows for voluntary scanning for CSAM in unecrypted data through hash-matching for existing and indexed CSAM material?
flexagoon 1 hours ago [-]
Chat Control 1.0 is a permanent extension of a temporary law that already existed a year ago, allowing the companies to scan your messages if they want to. Nothing changed since then.
Marciplan 1 hours ago [-]
using cirrux.me and very happy with an actual EU hosted option (Team is Dutch)
as a german i feel the urge to point out that this technically also applies to european companies... With more hurdles for the US, but still technically applicable
> The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil.
[1] https://en.wikipedia.org/wiki/CLOUD_Act
Even the entire EU is in the process of negotiating the same agreement.
https://www.justice.gov/archives/opa/pr/united-states-and-ca...
https://www.justice.gov/archives/opa/pr/justice-department-a...
Things have changed. With Chinese law in regards to data within Chinese jurisdiction a long-standing thing and an unfriendly American government potentially in power for an extended period, other countries are realizing the importance of data sovereignty.
> The latter states that negotiation with the EU on this topic was suspended in 2019.
Dated 2023:
> Justice Department and European Commission Announces Resumption of U.S. and EU Negotiations on Electronic Evidence in Criminal Investigations
The negotiations are still ongoing. Canada is further along than the EU.
- The US could request your data. You probably shouldn't use e-mail for anything sensitive anyway for many reasons. E-Mail was traditionally not encrypted and I think that many servers still allow plain-text communication. The protocols are old and there are all kinds of downgrade attacks. Aside from that, even if your service does not fall under the CLOUD Act, you are probably f*cked anyway, because most people you communicate with are using services that fall under the CLOUD Act.
- The US can force the provider to block your account. The workarounds are: regularly backup your e-mail (easy for services that offer IMAP) and, most importantly, use a domain with an extension that is not under the control of a US (or probably five eyes) registrar.
Use an E2E-encrypted messenger with perfect forward secrecy, etc. for most personal communication.
Fastmail used to be based in Melbourne only, but after the Pobox merger it ended up with an office in Philadelphia too. No idea how the balance of things is between the offices now.
Not that I don’t trust the statement, I just would like to know more.
https://www.justice.gov/criminal/criminal-oia/cloud-act-agre...
We’ve installed our own servers, co-located in a secure facility in Amsterdam, set up by our own engineers.
If what you need is a guarantee that your data remains only in the EU, we don’t have that, and we’d rather tell you directly than let you assume otherwise.
* a physical thing that can only live in one place
* not copyable
* can be 'contained'.
The whole thing reeks of bureaucratic 'best practices' that just aren't.
Even worse than that, trying to keep email restricted to the EU (or anywhere else) means that you effectively wouldn't be able to communicate with anyone in a different region, which is kinda the whole point.
Why not just make your own internet next? and then you can disconnect from everyone else who is trying to hack you. Just pull your network plug.
Email itself is hopelessly insecure by design anyway. Not just metadata when you are E2EE everything inside the envelope, but even basic vulns like downgrade attacks are simple because it's literally a violation of the RFCs (so you're not spec-compliant) to require TLS or any other encryption.. Why? because requiring modern crypto might interfere with deliverability and backwards compatibility. The real, deeper reason is that email is from a kinder, simpler time (well, at least simpler) and the design goals were never updated to keep up with the times.
Email is what we have. Just understand its flaws and then use other tools where you can. And who cares where your email lives - it's too easy to break anyway.
In all seriousness though, what are the chances Fastmail won't require KYC at some point? I have sent them a support request with that question and got a non-answer.
PS: Am a paying customer for like a decade
The more concerning issue as far as Australian based tech is The Assistance and Access Act 2018 which
"...permits government enforcement agencies to force businesses to hand over user info and data even though it’s protected by cryptography.
If firms don’t have the power to intercept encrypted data for authorities, they will be forced to create tools to allow law enforcement or government to have access to their users’ data."
As far as i know this has not been challenged or walked back and with the rise of ChatControl like laws doesnt seem it will.
Side note, I moved to Fastmail a couple years ago, and so far I’ve been very happy with it! The Gmail migrator works great, too.
I feel that that's the whole point. And the whole point of them making this article/advertisement.
Do you only send and receive emails with people in the EU?
https://www.courthousenews.com/uk-faces-questions-on-complic...
Is there an alternative that really keeps data in the EU? (And not only in the sense it serves a sales promotion)
If that works fine if not, use another method of comm. Email wasn’t designed to be secure.
> Because of legal uncertainty around Swiss government proposals to introduce mass surveillance — proposals that have been outlawed in the EU — Proton is moving most of its physical infrastructure out of Switzerland.
https://proton.me/blog/lumo-ai
They are moving to Germany, but will quickly find that they are going to face the same surveillance and privacy issues since the EU is in the process of negotiating a data sharing agreement under the US Cloud Act.
https://www.justice.gov/archives/opa/pr/justice-department-a...
> Built by us, not rented from someone else
> We’ve installed our own servers, co-located in a secure facility in Amsterdam, set up by our own engineers. This new location is built to the same high standards as our existing infrastructure in Philadelphia and St Louis, with our own hardware and our own software — specified right down to the exact model of disks in each machine.
> In all our locations, data is stored encrypted at rest inside locked racks, and managed by our in-house team. We don’t rent computing or management services from a big cloud provider and pass on their assurances. That’s how we’ve approached privacy, reliability, and performance for more than 25 years.
"Resilient replicas of your data will live in the US"
?
I think "resilient" just means "backup copy" and I do think (IANAL) it is illegal to destroy emails when asked for them in the US.
Or was your comment ironic? Sorry, German, irony impaired.