Your email metadata reveals who you talk to, when, and how often. Where that data is stored determines who can legally access it — with or without your knowledge.
Most email providers are headquartered in the United States, where federal law allows warrantless surveillance of non-US persons' communications and compels companies to hand over data stored anywhere in the world. Others operate in countries that share intelligence across alliances of 5, 9, or 14 nations.
RacterMX stores your data in Iceland — outside all surveillance alliances, with full GDPR protection by law.
How email providers compare on jurisdiction, surveillance exposure, and privacy law.
| Provider | Jurisdiction | Data Storage | Surveillance Exposure | Privacy Laws |
|---|---|---|---|---|
| RacterMX | 🇮🇸 Iceland (Texas LLC) | Iceland | None — outside all Eyes alliances | Icelandic Data Protection Act, GDPR via EEA, strongest internet freedom rating globally |
| Resend | 🇺🇸 United States | United States | FISA 702, CLOUD Act, NSLs, Patriot Act | Limited federal privacy law, no comprehensive data protection |
| SendGrid (Twilio) | 🇺🇸 United States | United States | FISA 702, CLOUD Act, NSLs, Patriot Act | Limited federal privacy law, no comprehensive data protection |
| Mailgun (Sinch) | 🇺🇸 United States | United States | FISA 702, CLOUD Act, NSLs, Patriot Act | Limited federal privacy law, no comprehensive data protection |
| Postmark (ActiveCampaign) | 🇺🇸 United States | United States | FISA 702, CLOUD Act, NSLs, Patriot Act | Limited federal privacy law, no comprehensive data protection |
| Amazon SES | 🇺🇸 United States | Multiple US regions | FISA 702, CLOUD Act, NSLs, Patriot Act | Limited federal privacy law, no comprehensive data protection |
| ImprovMX | 🇫🇷 France | France / EU | French intelligence laws (DGSI), EU data retention directives | GDPR, but France is a Nine Eyes member |
| Fastmail | 🇦🇺 Australia | Australia / US | Australia's Assistance and Access Act (AA Act), Five Eyes | AA Act allows compelled backdoors with gag orders |
| ProtonMail | 🇨🇭 Switzerland | Switzerland | Swiss intelligence cooperation agreements | Strong privacy laws, but Swiss MLAT allows cooperation |
| Tutanota (Tuta) | 🇩🇪 Germany | Germany | German intelligence (BND), Nine Eyes via EU cooperation | GDPR, but Germany is a Fourteen Eyes member |
| Forward Email | 🇺🇸 United States | United States | FISA 702, CLOUD Act, NSLs | Limited federal privacy law, no comprehensive data protection |
| SimpleLogin (Proton) | 🇨🇭 Switzerland / 🇫🇷 France | Switzerland | Swiss MLAT, French Nine Eyes membership | Mixed — Swiss hosting but French parent company context |
The majority of email infrastructure companies — Resend, SendGrid, Mailgun, Postmark, Amazon SES, Forward Email — are incorporated in the United States and store data on US soil. This subjects them to a set of federal surveillance laws with no equivalent in most democracies.
Allows the NSA to conduct warrantless bulk collection of communications involving non-US persons. In practice, US persons' data is routinely swept up through "incidental collection" — and can be searched by the FBI without a warrant. Reauthorized in April 2024 with expanded definitions of "electronic communications service provider."
Compels US companies to hand over data stored anywhere in the world, regardless of where the data is physically located or what local privacy laws apply. A US company hosting data in Germany must still comply with a US government order — even if doing so violates GDPR.
The FBI can demand customer data — including email metadata, account records, and transaction history — without judicial approval. NSLs come with a gag order: the company cannot tell you they received one, cannot tell you your data was disclosed, and faces criminal penalties for doing so.
Unlike the EU (GDPR), Iceland (Icelandic Data Protection Act), or even Brazil (LGPD), the United States has no comprehensive federal data protection legislation. Privacy protections are fragmented across sector-specific laws (HIPAA for health, FERPA for education) with no general right to data protection.
The "Eyes" alliances are intelligence-sharing agreements between nations that cooperate on signals intelligence (SIGINT) collection. If your email provider operates in any member country, your data can be shared across the alliance — without your knowledge or consent.
🇺🇸 United States · 🇬🇧 United Kingdom · 🇨🇦 Canada · 🇦🇺 Australia · 🇳🇿 New Zealand
The core alliance. Members share raw signals intelligence freely, including intercepted communications and metadata. Originated from the post-WWII UKUSA Agreement (1946).
Five Eyes + 🇩🇰 Denmark · 🇫🇷 France · 🇳🇱 Netherlands · 🇳🇴 Norway
Extended partners with access to shared intelligence. France's DGSI and Denmark's FE have been documented participating in joint surveillance operations.
Nine Eyes + 🇩🇪 Germany · 🇧🇪 Belgium · 🇮🇹 Italy · 🇸🇪 Sweden · 🇪🇸 Spain
Formally known as SIGINT Seniors Europe (SSEUR). Members cooperate on signals intelligence collection and analysis. Germany's BND has been documented sharing bulk metadata with the NSA.
If your email provider is headquartered in any of these 14 countries, your data can be accessed and shared across the alliance through intelligence cooperation agreements — without a warrant, without notification, and without your consent.
Iceland is not a member of any Eyes alliance.
RacterMX chose Iceland because no other jurisdiction offers a comparable combination of privacy law, independence from surveillance alliances, and internet infrastructure.
For a deeper look at Iceland's privacy infrastructure, renewable energy, and data center advantages, see our dedicated Iceland page.
Start forwarding email through the world's most privacy-friendly jurisdiction. Free tier available, no credit card required.
Get Started Free →