EU-sovereign email security: sovereignty, residency and vendor checks

Data sovereignty is the principle that data is subject to the laws of the jurisdiction that governs it, and in practice, of every jurisdiction that can compel the people holding it. Data residency is narrower: the physical or regional location where data is stored and processed. A vendor can offer EU residency and still be subject to a non-EU government’s legal orders, because those orders bind the company, not the data centre. In Swedish the debate runs under digital suveränitet; the question is the same.

For an email security vendor, sovereignty has at least five layers. Each one can sit in a different country.

The Clarifying Lawful Overseas Use of Data (CLOUD) Act was enacted in the United States in March 2018. It amended the Stored Communications Act so that a provider must preserve or disclose communications and records “within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.” The US Department of Justice describes the Act as speeding access to electronic information held by US-based global providers, and as authorizing bilateral agreements with trusted foreign partners.

The practical point for buyers: EU residency does not by itself settle which governments can compel a provider. That depends on who the provider is and who controls the data. Separately, the Court of Justice of the EU’s Schrems II judgment (Case C-311/18, July 2020) made transfer mechanisms and the laws of the recipient country part of every GDPR transfer assessment.

Two honest caveats. First, how the CLOUD Act applies to a European processor that runs on a US-headquartered cloud provider is a legal question with more than one view; ask your counsel, not a vendor’s marketing page. Second, this applies to Sentaro too: it is a Swedish company, and its hosting provider, Microsoft, is headquartered in the US. Sovereignty is a set of layers you assess, not a badge a vendor awards itself.

Everything below comes from Sentaro’s published DPA, terms and website. Where Sentaro’s marketing and its DPA differ in detail, the DPA is the document that binds.

• Who processes: Sentaro AB, a Swedish company. The customer is controller; Sentaro is processor.
• Where: hosted in Sweden on Microsoft Azure. The DPA’s Annex 1 lists processing locations and Annex 3 lists subprocessors.
• Who reads mail: analysis is automated, and nobody at Sentaro reads your mail in the course of providing the service. The DPA lists the exceptions: a support request where you provide content, a security incident under logged and approved controls, a legal requirement, and limited third-party AI analysis.
• Third-party AI: Sentaro states that “verdicts come from our own engine with no third-party model in the hot path.” The DPA separately allows limited threat-signal analysis by a named third-party AI provider; providers are prohibited from training on customer data or retaining it, and Sentaro does not use customer data to train or fine-tune third-party AI.
• Shared model: Sentaro’s Global Model is trained on data derived from multiple customers, and is “designed and tested not to reproduce one customer’s raw email content to another customer in readable form.”
• Retention: raw harmless email 14 days; quarantined items 180 days; operational metadata 180 days; pseudonymized data up to 5 years; anonymized data indefinitely. On termination, data is returned or deleted within 30 days.
• Changes: at least 30 days’ notice of new subprocessors, with a 10-day objection window.
• Audit: an independent third-party audit at most once per 12 months.
• Encryption: TLS 1.2+ in transit and AES-256 at rest; the website adds per-tenant keys at rest.

We checked each vendor’s public material on 18 October 2026 and rechecked hosting statements on 21 October 2026. “Not found” means we found no public statement, not that the vendor lacks EU hosting. Ask each one directly.

Several vendors are stronger than Sentaro on formal assurance today. Microsoft and Google publish extensive certification portfolios and contractual data boundaries, and self-hosting options such as Sublime’s let you control the region yourself. Sentaro’s SOC 2 and ISO 27001 certifications are in progress; it says it will announce them “the day they’re signed, and not before.”

Use these in a security questionnaire or a sales call. A vendor that cannot answer them in writing has answered them.

• Which legal entity signs the DPA, in which country, and who ultimately owns it?
• Which infrastructure provider hosts the service, and in which regions is our data stored and processed?
• Can you send the full subprocessor list, with each one’s function and processing location?
• Does any third-party AI or LLM service see our mail or metadata? On what terms, and is it ever used for training?
• Is our data used to train a model shared with other customers? What prevents leakage between tenants?
• How long do you retain raw email, quarantined items, metadata and derived data?
• Which transfer mechanism covers any transfer outside the EU or EEA?
• Who at your company can read our email, under what conditions, and is that access logged?
• How quickly do you notify us of a security incident, and from when does the clock run?
• Which certifications do you hold today, and which are in progress? Can we see the reports?
• What happens to our data on termination, and within how many days?

Sentaro’s answers to most of these are in its DPA. The evidence pack for DORA, NIS2 and SOC 2 diligence, security questionnaires and the subprocessor list are available from hello@sentaro.com.