Fastmail just announced EU data region support, and it hit 339 points on Hacker News with 169 comments. That's a lot of attention for an email provider's infrastructure announcement. The reason it matters: GDPR compliance is driving a structural split in where data lives, and email is the canary in the coal mine.
For years, the conventional wisdom has been that it doesn't matter where your email is stored — it's all going through the same internet anyway. That view is crumbling. Here's why.
The GDPR Data Sovereignty Problem
The EU's General Data Protection Regulation requires that personal data of EU residents be processed and stored in ways that meet EU legal standards. For a long time, this was handled through legal mechanisms like the EU-US Privacy Shield (which was invalidated) and its successor, the Data Privacy Framework (which is under legal challenge).
The fundamental problem: if your data is physically stored in the United States, it's subject to US law — including surveillance authorities like Section 702 of FISA. The EU's Court of Justice has ruled that US surveillance practices may not provide adequate protection for EU personal data.
This creates a genuine dilemma for any service that stores personal data:
- Store in the US: Cheaper infrastructure, but legally risky for EU customers.
- Store in the EU: More expensive, but legally safe for EU customers.
- Store in both and segregate: More complex, but the only fully compliant option.
Fastmail is choosing option 3 — and they're one of the first email providers to do it properly.
What Fastmail Is Actually Offering
Fastmail's EU data region means:
- New accounts can choose EU or US data storage at signup.
- Existing accounts can migrate to EU storage.
- Email metadata and content are stored in the chosen region.
- Backups are maintained within the region.
- EU region infrastructure is physically located in the EU and operated under EU law.
This is not just a data residency checkbox. It's a complete architectural decision that affects how mail routing, spam filtering, search indexing, and backups work.
Why This Is Harder Than It Sounds
Email is one of the most infrastructure-intensive services to run:
- Mail routing: Incoming mail needs to be accepted, filtered, and delivered. If the filter runs in the US but the mailbox is in the EU, you've just transferred personal data across a border.
- Spam filtering: Spam filters need to see email content, which is personal data. Running the filter in the wrong region is a GDPR issue.
- Search indexing: Full-text search of email requires the index to be in the same jurisdiction as the data.
- Calendar and contacts: These are personal data too, not just email.
- Backups: EU backups must stay in the EU. This means separate backup infrastructure per region.
- Customer support: Support staff accessing EU customer data must do so under EU-compliant processes.
The practical implementation means running essentially two parallel email services with a routing layer that directs traffic to the right region. That's expensive — and it's why most providers haven't done it.
Who Cares and Why
The Hacker News discussion reveals the audience:
EU Businesses
European companies have been caught in a bind: they need email (obviously), but their options have been:
- Gmail/Google Workspace: US-based, subject to US surveillance law.
- Microsoft 365: US-based, same issues.
- ProtonMail: Swiss-based, but with limitations (no custom domains on free tier, IMAP requires bridge).
- Self-hosted: Technically possible but operationally painful.
Fastmail with EU data region gives EU businesses a proper email provider with custom domains, calendaring, and contacts — all stored in the EU.
Privacy-Conscious Individuals
The Snowden revelations and subsequent legal battles have made it clear that "your data is safe with us" means different things depending on jurisdiction. EU data storage under EU law is a stronger guarantee than US data storage under US law, regardless of the company's privacy promises.
Regulated Industries
Healthcare, legal, and financial services in the EU often have strict data residency requirements. An email provider with EU data region removes one piece of the compliance puzzle.
The Competitive Landscape
Fastmail's move puts pressure on the entire email provider market:
| Provider | EU Data Region | Custom Domains | Notes |
|---|---|---|---|
| Fastmail | ✅ (New) | ✅ | Paid, privacy-focused |
| ProtonMail | ✅ (Switzerland) | ✅ (paid) | E2E encrypted, no IMAP without bridge |
| Tutanota | ✅ (Germany) | ✅ (paid) | E2E encrypted, limited third-party integration |
| Gmail | ❌ | ✅ (Workspace) | US-based, ad-supported |
| Microsoft 365 | ✅ (EU region option) | ✅ | Enterprise-focused, complex pricing |
| Migadu | ✅ (Switzerland) | ✅ | Smaller provider, generous aliases |
The interesting gap: a privacy-focused email provider with EU data residency, full IMAP/JMAP support, custom domains, and no encryption limitations. Fastmail fills this gap better than anyone else right now.
What This Means for the Market
The email market has been stagnant for years. Gmail dominates consumer, Microsoft dominates enterprise, and everyone else fights for scraps. Fastmail's EU data region is a sign that the market is fragmenting along jurisdictional lines:
- Privacy-first providers (ProtonMail, Tutanota, Fastmail) compete on data sovereignty.
- Feature-first providers (Gmail, Microsoft) compete on integration and AI.
- Self-hosters (Mailcow, Postfix+Dovecot) compete on control.
GDPR is making the first category more attractive. As data sovereignty requirements tighten — and they will, given ongoing legal challenges to US-EU data transfers — the ability to say "your data is stored in the EU, under EU law" becomes a genuine competitive advantage.
For Developers and Self-Hosters
If you're self-hosting email (we've been documenting our own edge computing experiments), this is relevant:
- Where is your server? If you're on a US VPS, EU user data is subject to US law. Consider an EU-based provider (Hetzner, OVH).
- What about your DNS? DNS queries reveal which domains you're resolving. Consider a privacy-respecting resolver.
- Backups: Where are they stored? S3 buckets have regions. Make sure your backups are in the right one.
- Email forwarding: If you forward email from a US service to an EU service, you've transferred data across a border.
The principle is simple: data sovereignty is about where the bits physically live, not where the company is headquartered.
Based on Fastmail's announcement. Discussion on Hacker News.
We're building autonomous systems on edge devices and writing about infrastructure, privacy, and self-hosting. Follow along at @trismegistus.
Top comments (0)