At Lettermint, confidentiality is not an add-on. It is part of how the platform is built and operated. For many of our customers, keeping data confidential is not just a preference but a legal duty. We take that seriously, and we can prove it.
This page explains how we approach confidentiality, what it means for customers who are bound by professional secrecy, and where you can verify our security and compliance for yourself.
Confidentiality is built into how we work
We are a Netherlands-based European email platform for transactional, broadcast, and inbound email, built and hosted in the EU. Your email data, including message content and recipient details, stays inside our own infrastructure. Access to it is limited, role based, and logged.
A few things that hold true by default:
- Always encrypted. In transit and at rest.
- Staff are screened and sign a confidentiality agreement. Everyone on the team holds a certificate of conduct (VOG) from the Dutch Ministry of Justice.
- Nobody sees more than needed. Access is limited to delivery, support, security and abuse prevention, and logged.
- Email data stays in the EU. Every provider that handles it sits in the EU, under a data processing agreement.
- Suppliers follow the same rules. Subprocessors sign the same confidentiality obligations we do.
- Never used to train AI. No AI training, no third-party AI services. Connecting your own assistant to our MCP server stays your choice.
We are certified to ISO/IEC 27001:2022, so our information security is independently audited, not just promised. The certification covers our entire email infrastructure, from receiving emails to processing and sending them. You do not have to take our word for any of this: our Trust Center (opens in a new window) sets out our security controls, policies, compliance, and certification status, and is continuously monitored.
Professional confidentiality
Some of our customers work in professions where confidentiality is required by law. Tax advisors, lawyers, accountants, doctors, and similar professionals are often bound by professional secrecy, protected by criminal law across the EU. In Germany, Austria, and Switzerland this can go a step further and ask the provider itself to commit in writing, for example under § 203 StGB (opens in a new window) in Germany, a Verschwiegenheitsverpflichtung. Healthcare providers and government organisations often have the same obligations. Read more about email for healthcare and email for the public sector.
These rules usually require the professional to make sure that any provider who could access protected data is also bound to confidentiality. That is how we work by default. If you are in this position, or you serve clients who are, we understand the requirement and we are ready to support it.
We can put a confidentiality agreement in place that reflects your professional secrecy obligation, alongside our standard Data Processing Agreement. If you need this, please contact us at legal@lettermint.co and tell us which obligation applies, so we can match the agreement to your situation.
What you control
Confidentiality is not only about what we do. You can tighten it yourself:
- Hide message content in your dashboard, per project or per route. Once it is on, the preview and the raw source are no longer visible. See hiding email content.
- Give each team member and client only the access they need with role based access control, so a professional secrecy obligation holds inside your own organisation too.
How we prove it: our Trust Center
Rather than ask you to trust a list of claims, we make our security posture transparent. Our Trust Center (opens in a new window) gives you a live view of our security and compliance, kept continuously up to date.
In the Trust Center you can review:
- Our certifications and the standards we are assessed against.
- The security controls and policies we have in place.
- The subprocessors we rely on, including their role and location.
- The current state of our compliance, kept up to date automatically.
Where your data is processed
Your email data is processed exclusively on infrastructure in Amsterdam and Germany, inside the European Union. We do not move your message content or recipient data outside our own EU infrastructure to deliver the service.
Location alone is not the whole story. A provider owned or controlled from outside the EU can be compelled to hand over data under foreign law such as the US CLOUD Act, wherever its servers happen to stand. That is the point at which professional secrecy stops being enforceable. Lettermint is a European company running its own network and IP ranges (AS213427), with no parent company and no hyperscaler outside the EU in the path of your email data.
Some supporting services, such as payment processing, may handle limited data outside the EU. When that happens, we make sure proper safeguards are in place. You can find the details for each provider in our Trust Center (opens in a new window) and on our Subprocessors page.
When an authority asks for data
If we receive a legally binding request from a public authority, our Data Processing Agreement commits us to notify you before we disclose anything, unless the law forbids it. We review whether the request is lawful and how far it reaches, challenge or seek clarification where that is appropriate and legally available, and disclose only the minimum we are legally required to. We never sell your email data, and we never use it for advertising or unrelated profiling.
Get in touch
If you have a specific confidentiality requirement, a professional secrecy obligation, or a question about how we protect your data, we are happy to help. Contact us at legal@lettermint.co.
This page is provided for information. It explains our approach to confidentiality and does not by itself create a contract. Any confidentiality agreement, our Data Processing Agreement, and our Terms of Service set out the binding terms.