German baremetal hosting: what stays in the EU

I'm Sebastian, CTO at ReceiveHQ (Cortena B.V.). Use-case #6: after retries and resend, the quieter question — where does the mail actually live?

The problem

Topics 2–5 covered fan-out, recipient filters, anti-spam, and delivery survival. None of that helps if the payload still lands on US-region infrastructure by default. For German legal, tax, healthcare, and similar customers, residency is not a checkbox — it is the exam.

We ran Cortena for years with Postmark inbound: great product, wrong continent. When outbound/dunning forced consolidation, we looked for an EU inbound relay at a sane price and found almost nothing. So we built ReceiveHQ on the same posture as the rest of Cortena: self-managed baremetal, short EU-heavy subprocessors, public trust pages.

What stays in Germany / the EEA

ReceiveHQ hosts inbound mail content and related application data in the EU — specifically Germany — so payloads, parse artifacts, and delivery logs stay under EU jurisdiction by default. No US region for core mail storage.

Item	Declaration
Operator	Cortena B.V. (Netherlands)
Primary hosting country	Germany
Infrastructure	Hetzner Online GmbH
Deployment	Private Kubernetes on dedicated / bare-metal servers
Object storage	Cortena-operated MinIO on the same German infra (14-day evidence window for raw .eml / logs)

What lives there:

• Captured inbound messages and MIME parse artifacts
• Delivery attempt logs and activity console records
• Tenant configuration and console account records

Customer-configured webhook destinations are under your control — they are not Cortena subprocessors. If you point a webhook at a US SaaS, that hop is yours to justify.

How access is controlled

• Encryption in transit (TLS) and at rest (encrypted volumes)
• Role-based access; production MFA
• SMTP ingest can be CIDR-restricted
• Webhooks support HTTPS and optional Basic auth
• Operational access is logged so it can be reviewed

Subprocessors (the short list)

| Sub-processor | Country | Purpose |
| --- | --- |
| Hetzner Online GmbH | Germany | Core infra — servers, private K8s, DB, object storage, SMTP edge |
| Abusix.com | US / Germany | Metadata only — DNSRBL lookups for sender IP/domain when you enable blocklists; no mail content |

Live list: sub-processors. Hosting declaration: hosting. DPA: dpa. Imprint: imprint.

Why this cut of the story matters

The canonical spine is unchanged: tired of shipping European data through American infrastructure → Cortena baremetal K8s + short EU subprocessors → Postmark inbound as a pragmatic compromise → finance-critical mail forced consolidation → no great EU inbound at sane price → ReceiveHQ.

Hosting is not a marketing badge. It is the reason multi-endpoint fan-out, filters, anti-spam, and retries are useful for the customers we already serve: evidence you can open, residency you can point to, and a public page when procurement asks "where is the mail?"

Setup sketch

1. https://receivehq.com — magic-link sign-in
2. Domain + MX → mx.receivehq.com, verify
3. Endpoints + filters / anti-spam as in prior posts
4. Read hosting and DPA before the security review
5. For signed DPAs: [e-mail] · DPO: [e-mail]

Next

Why compliance pages matter (DPA, sub-processors, hosting, imprint).

Try: https://receivehq.com · €10/mo or €100/yr · 100k inbound · first 10 free

Disclosure: I work on ReceiveHQ as CTO & Co-founder of Cortena B.V.