--- title: "Email platform for the public sector: GDPR compliant and hosted in the EU" description: "GDPR-compliant email for municipalities, government agencies and schools. Own infrastructure in the EU, ISO 27001, a public DPA, SSO and a written SLA." url: "https://lettermint.co/for/public-sector" --- # Lettermint for the Public Sector Municipalities, government agencies and schools send emails with personal data every day. Lettermint delivers them from its own infrastructure in the EU and is ISO 27001 certified. Every document your procurement or privacy officer asks for is ready. ## Ready for your procurement process Before a public organisation picks an email platform, procurement, the security officer and the data protection officer want proof. So we publish it all: the data processing agreement, the list of subprocessors and our security controls in the Trust Center. Every department, application or supplier gets its own project, with its own domains, API keys and analytics. Colleagues only see the projects they work on. - Public DPA, countersigned on request - Public subprocessor list with locations - ISO/IEC 27001:2022 certified - SSO with SAML 2.0 or OIDC and SCIM - Enterprise contract with a written SLA ## Easy integration Most public organisations work with suppliers and existing systems: a case management system, a citizen portal or a WordPress website. Lettermint connects through SMTP, the REST API or one of our official SDKs. With our documentation, a supplier is up and running quickly. Because every supplier gets its own API key, you always know who sends from your domains. See all [integrations](https://lettermint.co/integrations.md). ## High deliverability An appointment confirmation, a permit update or a password reset has to arrive. Otherwise citizens pick up the phone. Lettermint sends from its own network and IP addresses, and keeps transactional emails and newsletters apart in separate IP pools. The dashboard shows the status of every email, and webhooks push delivery events to your own systems in real time. ## Made in Europe An EU data centre is not enough when the provider falls under US law. Lettermint runs only on its own infrastructure in the EU. Lettermint B.V. is a European company based in the Netherlands, with no US parent company, so the US CLOUD Act does not reach your emails. Your data stays in the EU. Hosting, storage and processing happen in the EU, and our data processing agreement puts that in writing. That is digital sovereignty in practice. Read more about the [European approach](https://lettermint.co/european-email.md). ## Procurement checklist | What procurement asks for | Where to find it | | ----------------------------------------------- | ----------------------------------------------------------------------------------- | | Data processing agreement (Article 28 GDPR) | [DPA](https://lettermint.co/dpa.md), countersigned on request | | Subprocessors and where they process data | [Subprocessors](https://lettermint.co/subprocessors.md) | | ISO/IEC 27001 certificate | [Trust Center](https://trust.lettermint.co) | | Security policies and controls | [Trust Center](https://trust.lettermint.co) | | Confidentiality agreement for professional secrecy, such as § 203 StGB | On request, see [confidentiality](https://lettermint.co/confidentiality.md) | | Staff screening and access to email data | [Confidentiality](https://lettermint.co/confidentiality.md) | | Data residency and jurisdiction | [European email](https://lettermint.co/european-email.md) | | SLA and invoicing on your terms | Enterprise contract on the Pro plan, see [pricing](https://lettermint.co/pricing.md) | ## Frequently asked questions ### Is Lettermint suitable for government organisations? Yes. Lettermint is made for organisations that work with personal data and want to stay in control of it. All email data stays on our own infrastructure in the EU, we are ISO/IEC 27001:2022 certified, and the documents for your procurement process are public. ### Where is our email data stored and processed? Only in the EU, on infrastructure we own and operate ourselves (AS213427). We never transfer data outside the EEA on our own initiative, and we only deliver an email outside the EU when you send it there. Read more about our [European approach](https://lettermint.co/european-email.md). ### Does the US CLOUD Act apply to Lettermint? No. Lettermint B.V. is a European company based in the Netherlands, with no US parent company. For a US provider the CLOUD Act always applies, even when your data sits in a European data centre. With Lettermint, both the infrastructure and the company are European. ### Does Lettermint sign a data processing agreement? Yes. We are your processor under Article 28 GDPR. Our [data processing agreement](https://lettermint.co/dpa.md) is public, covers security and audit rights among other things, and we countersign it on request. ### Which documents are available for procurement? The data processing agreement and the [list of subprocessors](https://lettermint.co/subprocessors.md), with each provider's role and location, are public. The ISO/IEC 27001 certificate and our security policies are in the [Trust Center](https://trust.lettermint.co). Bound by professional secrecy, such as § 203 StGB? Then we can put a confidentiality agreement in place that matches your obligation. Our [confidentiality page](https://lettermint.co/confidentiality.md) explains how that works, how we screen staff and who can access email data. ### How does Lettermint protect our data? We encrypt email data in transit and at rest. Everyone on the team holds a certificate of conduct (VOG) from the Dutch Ministry of Justice and signs a confidentiality agreement. Only people who need it for their work can access email data, and we log every access. Our ISO 27001 certification covers the entire email infrastructure. National baselines such as the Dutch BIO build on ISO 27001 and ISO 27002, so your security officer can map our controls against them. ### Can we sign in with our own identity provider? Yes. Every paid plan includes Single Sign-On (SSO) over SAML 2.0 or OIDC, with SCIM provisioning and group-to-role mapping. When someone leaves your organisation, you remove their access in your own identity provider. ### Does Lettermint offer an SLA? Yes. For larger organisations we offer an enterprise contract on the Pro plan, with a written SLA for uptime and response times, a direct line to our team and invoicing on your terms. [Contact us](https://lettermint.co/contact) to discuss what you need. ## Ready to send your emails from the EU? Start for free and test with your own domain. Have a security questionnaire, or need an enterprise contract with a written SLA? [Get in touch](https://lettermint.co/contact) and we'll help, or [start for free](https://app.lettermint.co/register).