Vendor profile
Sophos Email: where is customer data stored and processed?
Sophos Email stores and processes customer content in several countries, mainly via AWS in Ireland, Germany, the UK and Switzerland, and via Microsoft data centres in the Netherlands, Sweden and the USA. Customers can choose an AWS region at setup, but the documentation does not state which EU regions apply to Email. The data processing agreement has been read but does not state where data is stored. Sub-processors such as Google Cloud, SendSafely and Echoworx process data in the USA and Canada for customers outside the EU/EEA. The most important missing piece is the concrete storage location for Email and which group companies have access.
See the map and sourcesWhere data is stored and processed
| Activity | In the EU/EEA | Outside the EU/EEA |
|---|---|---|
| Storage | Ireland, Germany, Netherlands, Sweden, Europe (country not stated) | United Kingdom, Switzerland, USA |
| Processing | Ireland, Germany, Netherlands, Sweden | United Kingdom, Switzerland, USA |
| Login and user account | Netherlands | – |
| Logs and telemetry | Germany | United Kingdom |
| Analytics and metadata | Germany, Netherlands | – |
| Notifications and email | – | – |
| Support | – | – |
| Group companies | Germany | – |
| AI features | Germany, Netherlands, Sweden | USA |
Ownership and agreements
| Owner | Sophos Group PLC (United Kingdom) |
|---|---|
| Headquarters | United Kingdom |
| Data processing agreement | Found and read |
| Certifications | ISO/IEC 27001, SOC 2 |
Sub-processors (42)
| Name | Country | Purpose |
|---|---|---|
| Amazon Web Services, Inc | USA, Storbritannia, Irland, Tyskland, Ca | Data centre services, cloud infrastructure, Generative AI and identity access |
| Aiven Ltd. [Apache Kafka] | AWS-regioner | Cloud infrastructure services |
| Fullstory, Inc | USA, Tyskland | Session replay, product analytics, digital experience insights |
| Genesys Telecommunications Laboratories, Inc. | Ireland | Cloud based contact centre, technical support and call routing |
| Google Cloud EMEA Limited | USA | Cloud infrastructure services, analytics tools |
| Logz.io | Germany | Storage of log files, observability |
| Raintank Inc, d/b/a Grafana Labs | USA, Irland, Storbritannia | Operational dashboard (metrics) services |
| Salesforce Inc. | USA | CRM, metrics and technical support services |
| SendSafely Inc (B2B) | Irland, Tyskland | Technical support helpdesk and filesharing system |
| Sierra Technologies Inc | USA | Conversational AI chat bot for customer support |
| Ada Support Inc. | USA, Canada | Technical support and chat bot services |
| Akamai Technologies Inc | USA | Content Delivery Network and edge proxy |
| Blue Ocean Contact Centres Inc. | Canada | Technical support helpdesk |
| Box Inc | Tyskland, Irland, Frankrike, Canada, Jap | Secure storage of forensic data and incident-related files |
| Constella Intelligence, Inc. | USA, Tyskland, Irland | Detect and alert on compromised credentials and identity threats |