Security overview · Updated September 9, 2026
Security and data processing
Understand where mailbox data is stored, how service features process it, and what to confirm for your organization.
Connections and email processing
The web application is served over HTTPS. Venmail servers process readable email content to provide mailbox and automation features. This is not a blanket end-to-end encrypted or zero-access email service. Connection encryption, storage protection, and content processing are separate controls.
Mailbox storage
Paid managed plans currently use the same shared storage infrastructure. Nigeria, South Africa, and Europe selections record a future region preference; they do not place data in those regions today. Custom Storage uses customer-provided storage and is a separate plan. Storage placement does not by itself confine application processing, email delivery, backups, or third-party processing to the same location. Confirm the full processing scope for your deployment.
AI and third-party processing
Email analysis can send message content and extracted attachment text to Groq, a third-party AI provider. Review the Privacy Policy and AI Principles, and discuss current account controls before using sensitive content. Do not assume a storage-region choice disables AI processing or that a universal AI opt-out applies to every feature.
Domain setup and access
A custom-domain business workspace requires a paid plan and domain setup. Configure and verify the domain authentication records supplied during setup. Review account access and integration permissions, and confirm the administrative controls available for your plan with our team.
Security evidence and regulated workloads
Request the controls, processing locations, subprocessors, retention arrangements, and contractual terms that apply to the service you intend to use. This overview does not establish a certification, audit result, service-level agreement, or regulatory compliance for a particular workload. Those requirements should be assessed against deployment-specific evidence.