A European DMARC Platform: What It Means, and What It Doesn’t

For SentraDMARC, “European” means the application, the database and every report we hold sit on a server in France. It does not mean no provider outside the EU is ever involved. Here is where each piece runs, what each outside provider sees, and what you can do with your data at any time.

Where the service runs

SentraDMARC is built in Lyon, France. The application, the database and the processor that reads your DMARC and TLS reports run on a server in France, operated by OVHcloud.

Every report we hold is stored there.

Report files reach us through Amazon’s email service. They are kept in an AWS region inside the European Union, along with any BIMI logo you upload and our database backups.

What is encrypted, and what is not

• Backups are encrypted on our server before they leave it.
• Files in S3 are covered by AWS server-side encryption.
• The live database volume is not encrypted at rest. It is protected by network isolation and access control instead.

Our security page says the same, because a blanket “encrypted at rest” would not be true.

Which providers outside the EU are involved

“European” does not mean that no provider outside the EU is ever involved. Some parts of the job cannot be done that way, and pretending otherwise would be exactly the kind of claim this post exists to avoid.

• DNS. The records we host for you are served by Amazon Route 53, a global anycast service. That is what lets a receiving server anywhere look them up, and what keeps them answering if our own server is down. DNS records are public by design and contain no personal data.
• Payments. Stripe handles subscriptions and invoices. You type your card details into Stripe, and they never reach our servers.
• Our own email. Verification links, password resets, invitations, alerts and the weekly digest are delivered by Resend, which is established in the United States.
• Sign-in, if you choose it. Signing in with Google or Microsoft is optional. If you use it, that provider confirms who you are at sign-in, and that is all.

What each one receives

Transfers to the providers in the United States rely on the European Commission’s standard contractual clauses.

Each is limited to what its job needs: a billing identifier, the address a message is sent to, or the identity returned at sign-in.

The full list of sub-processors, with the transfer basis for each, is in the annex of our Data Processing Agreement.

The agreement commits us to thirty days’ notice before we add or replace a sub-processor that would handle your data, and gives you the right to object.

What GDPR commits us to

When you monitor a domain with us, you decide what is processed and we process it on your behalf. That relationship is written down in the Data Processing Agreement.

Our Terms incorporate the agreement, so it applies to every account without a separate signature.

How long data is kept

A background job deletes report data older than your plan’s window, domain by domain.

Where a domain belongs to an organisation, the organisation’s plan sets the window, not the plan of whoever added the domain.

How to export or delete your data yourself

Most of your data-protection rights you can exercise yourself:

• Settings → Download my data gives you one JSON file: your account, your domains and their configuration, the workspaces you own and their members, your audit log and your notifications.
• DMARC and TLS reports download as CSV for any date range your plan keeps.
• Delete Account erases your account and the workspaces you own.

Before deleting, you can copy the records to publish in your own DNS, so your mail keeps authenticating once ours are gone.

They are rebuilt from your configuration rather than copied from ours, because our SPF record is a flattened snapshot and our reporting addresses point at us.

For anything you cannot do in the app, the privacy policy says where to write and how quickly we answer.

Why it matters

DMARC reports are not anonymous. They list the addresses that sent mail as your domain, how much, and whether it passed.

Together, that is a fairly detailed picture of which services your organisation uses.

Knowing where that picture is stored, who else handles any part of the service, and how to take it with you is a reasonable thing to ask of any vendor. We would rather answer it in writing than with a flag on the homepage.