Trust & compliance
How Lockally handles your data
This page is the canonical source for residency, sub-processors, breach disclosure, and incident history. Material changes follow the 30-day notice obligation in our DPA.
Residency & custody
- Primary region
- Germany, EU (Contabo GmbH dedicated server)
- Backup region
- Two copies. Germany, EU (second, isolated dedicated server) and United States (Backblaze B2, us-east-005) as an off-provider copy
- Backup encryption
- AES-256 (restic), encrypted on our servers before upload. Neither backup host holds the key; the repository password is custodied off-box by the operator, so the US copy is ciphertext Backblaze cannot read
- Tenant isolation
- Logical (per-tenant Postgres rows + Stalwart directory partition)
- Breach disclosure SLA
- 72 hours from confirmed breach to tenant notification
- Pen-test cadence
- Quarterly self-pen-test; third-party annually from W26
Sub-processors
subprocessors.jsonPer L16, 30-day advance notice of additions / material changes via email + status-page banner. Programmatic consumers can poll the JSON endpoint.
DNS, TLS, CDN, and static hosting for non-mail subdomains (marketing site and docs)
Global edge (no mail content)
Fallback relay for our own system mail (password resets, alerts, provisioning notices). Not used for your outbound mail, which our own servers deliver
Global
Billing and subscription payments
NG / GB
Dedicated server hosting: compute, storage, and encrypted off-site backups
Germany (EU)
Out-of-band relay for status and incident notices, so outage email survives an outage of our own mail stack
EU (France)
Onward delivery of those push notifications to iOS and macOS devices, downstream of Firebase
Global
Delivers new-mail push notifications to the mobile and desktop apps
Global
Off-provider, append-only copy of the encrypted backup repository
United States (us-east-005, Virginia)
Reporting a security issue
Email security@lockally.com. Acknowledgement within 24 hours; preliminary triage within 72.
Machine-readable disclosure contact is at /.well-known/security.txt per RFC 9116.
Incident history
No customer-impacting incidents to date.
Live status: status.lockally.com.