{"generated_at":"2026-10-23T16:04:02.015Z","facts":{"primary_region":"Germany, EU (Contabo GmbH dedicated server)","backup_region":"Two copies. Germany, EU (second, isolated dedicated server) and United States (Backblaze B2, us-east-005) as an off-provider copy","backup_encryption":"AES-256 (restic), encrypted on our servers before upload. Neither backup host holds the key; the repository password is custodied off-box by the operator, so the US copy is ciphertext Backblaze cannot read","tenant_isolation":"Logical (per-tenant Postgres rows + Stalwart directory partition)","breach_disclosure_sla":"72 hours from confirmed breach to tenant notification","breach_contact":"security@lockally.com","dpa_url":"mailto:compliance@lockally.com","pen_test_cadence":"Quarterly self-pen-test; third-party annually from W26"},"subprocessors":[{"name":"Cloudflare, Inc.","purpose":"DNS, TLS, CDN, and static hosting for non-mail subdomains (marketing site and docs)","region":"Global edge (no mail content)","url":"https://www.cloudflare.com","data":["DNS queries","TLS termination metadata for non-mail subdomains"],"since":"2026-04-01"},{"name":"Zoho Corporation (ZeptoMail)","purpose":"Fallback relay for our own system mail (password resets, alerts, provisioning notices). Not used for your outbound mail, which our own servers deliver","region":"Global","url":"https://www.zoho.com/zeptomail/","data":["recipient address","content of system notices"],"since":"2026-05-01"},{"name":"Paystack Payments Ltd.","purpose":"Billing and subscription payments","region":"NG / GB","url":"https://paystack.com","data":["admin email","billing-card metadata (not the PAN)","subscription state"],"since":"2026-05-25"},{"name":"Contabo GmbH","purpose":"Dedicated server hosting: compute, storage, and encrypted off-site backups","region":"Germany (EU)","url":"https://contabo.com","data":["account","mail content","mail metadata","access logs","encrypted backups"],"since":"2026-06-01"},{"name":"Brevo (Sendinblue SAS)","purpose":"Out-of-band relay for status and incident notices, so outage email survives an outage of our own mail stack","region":"EU (France)","url":"https://www.brevo.com","data":["admin email address","content of status and incident notices"],"since":"2026-07-14"},{"name":"Apple Inc. (APNs)","purpose":"Onward delivery of those push notifications to iOS and macOS devices, downstream of Firebase","region":"Global","url":"https://developer.apple.com/notifications/","data":["device push token","sender address and subject line of a new message (subject withheld for end-to-end encrypted mail)"],"since":"2026-08-02"},{"name":"Google LLC (Firebase Cloud Messaging)","purpose":"Delivers new-mail push notifications to the mobile and desktop apps","region":"Global","url":"https://firebase.google.com","data":["device push token","sender address and subject line of a new message (subject withheld for end-to-end encrypted mail)"],"since":"2026-08-02"},{"name":"Backblaze B2","purpose":"Off-provider, append-only copy of the encrypted backup repository","region":"United States (us-east-005, Virginia)","url":"https://www.backblaze.com","data":["encrypted backups (ciphertext; Backblaze holds no decryption key)"],"since":"2026-09-29"}]}