EU infrastructure by default, DSGVO-first by design, and AI decisions you can audit. Built by an Austrian company that signs an AVV without drama.
Database and storage in Frankfurt (AWS eu-central-1 via Supabase), application servers in the EU, email infrastructure in Frankfurt. AI inference runs on EU endpoints in Sweden — your data does not cross the Atlantic for a chat reply.
OAuth tokens for your Outlook or Shopify connection are encrypted at rest with AES-256-GCM and decrypted only in memory for the API call at hand. Credit card data never touches our servers — payment processing stays with the payment provider.
A complete Auftragsverarbeitungsvertrag (data processing agreement) with the full subprocessor list is part of every paid plan. Read the DPA — no enterprise tier required.
Every routing decision is traceable: which rule matched, which actions ran, which tools the AI called before drafting a reply. Drafts wait for human review by default — auto-send is something you switch on per category, after you trust it.
We never copy your whole mailbox — only the threads needed to act, from the addresses you connect. The chat widget sets no cookies and does no tracking. Server logs are deleted after 90 days.
InboxMate is built by psquared GmbH in Linz. Your data protection questions are answered by the people who built the system — in German or English — not by a ticket queue in another timezone.
The short version — the full privacy policy has every subprocessor and legal basis.
| What | Where | Provider |
|---|---|---|
| Database & file storage | Frankfurt, Germany | Supabase (AWS eu-central-1) |
| AI inference | Sweden (EU endpoint) | OpenAI EU |
| Application servers | EU (Ireland / Frankfurt) | Heroku / Hetzner |
| Email infrastructure | Frankfurt, Germany | AWS SES |
| Product analytics | EU instance, pseudonymous | PostHog (no message content, IPs anonymised) |
For subprocessors incorporated outside the EU, processing is contractually restricted to EU infrastructure under Standard Contractual Clauses (Art. 46(2)(c) GDPR) or the EU-US Data Privacy Framework.
Everything your data protection officer will ask for:
Book a call — the people who built the system will answer them directly.
Book a demo
InboxMate