EU data privacy
DMARC monitoring that keeps report data in the EU.
DMARC reports describe your mail flows, and forensic (RUF) reports can contain names, addresses, and message details. DMARC Vision is built so you can use those signals without sending the data outside the EU or exposing it to routine access.
Where your report data is processed
Reports are received, processed, and stored in the AWS Stockholm region (eu-north-1). The service is operated by Nansec Software AB, a Swedish company.
How RUF reports are handled
Forensic reports are useful because they show what failed, so the service keeps the signal and limits the exposure.
- Personal data in RUF reports is pseudonymised before it is stored for analysis, so day-to-day work never shows it.
- The original report is stored separately, encrypted, under strict access control.
- Originals are deleted automatically after 14 days. Until then, an authorised customer representative can request one through support.
Who else processes data
The sub-processors, what each one does, and where it processes data are published in Appendix 5 to the General Terms. You are told at least 30 days before a new sub-processor starts processing your personal data, and you can object.
The documents a review asks for
The data processing agreement (Appendix 4) and the security measures (Appendix 5) are public, versioned, and part of the General Terms you sign.