Data sovereignty: where your DMARC data actually lives
DMARC reports are not anonymous statistics. They contain the IP addresses of every server that sent mail as your domain — and IP addresses are personal data under GDPR the moment they can be linked, even indirectly, to a natural person. This page states plainly where that data goes and under whose legal jurisdiction.
What a DMARC report actually contains
A DMARC aggregate (RUA) report lists every source IP that sent mail claiming to be from your domain, how many messages, and whether they passed SPF/DKIM alignment. For a small organisation, a source IP frequently identifies a specific employee's home connection, a specific SaaS tool's outbound relay, or a specific third-party sender acting on your behalf — this is exactly the kind of "identifiable, even if indirectly" data GDPR Article 4(1) covers, not an anonymous number.
Forensic (RUF) reports go further still — by RFC 6591 they can carry a near-complete copy of the original failing message, headers included. MonitorBase never stores the message body and redacts recipient local-parts before anything touches a database (our privacy policy describes exactly what is kept) — but the header data that remains is still personal data, and still has to live somewhere under some country's law.
Where "somewhere" is, for us
Database and authentication: self-hosted Supabase (Postgres + GoTrue) on Scaleway infrastructure in Paris, France. Payments: Mollie, a Dutch payment service provider. Outbound email: Scaleway Transactional Email, a French provider. Inbound DMARC report email: AhaSend, a Dutch provider. DNS and CDN: Bunny.net, based in Slovenia (DNS.services remains the domain registrar only — it does not manage DNS records). Every sub-processor that touches your DMARC data is headquartered in the EU, processing data in the EU, under EU law — not "EU region of a non-EU company," the company itself.
The full list of sub-processors, with what each one processes and where, is in our Privacy Policy at /privacy.
Why the company's country matters, not just the server's
This is the part that's easy to miss: choosing "EU region" hosting from a US-headquartered company does not remove US jurisdiction over your data. The US CLOUD Act (2018) lets US law enforcement compel a US company to produce data it controls, regardless of where that data is physically stored — a European datacenter address on the invoice doesn't change who can be legally compelled to hand the data over. This is a well-documented tension between GDPR and US law, not a MonitorBase-specific claim about any particular competitor.
MonitorBase's answer isn't a legal disclaimer about this tension — it's removing the premise. None of our sub-processors are US companies, so there is no US legal entity in the chain for a CLOUD Act request to reach in the first place.
Full sub-processor register, retention windows, and account-deletion mechanics: see our privacy policy.