EU data residency promises are getting picked apart

Fastmail announced an EU data region, and the HN thread immediately went to work stress-testing the claim. The first comment asks which cloud provider is actually hosting the data, noting that AWS, Azure, and Google are all American companies subject to Five Eyes data disclosure orders and gag clauses. Fastmail's own article apparently admits: 'If what you need is a guarantee that your data remains only in the EU, we don't have that.'

The pattern here is that 'EU data region' is becoming a marketing checkbox that sophisticated buyers are learning to interrogate. The legal reality of hosting on US-owned infrastructure inside EU borders is genuinely murky, and the HN crowd knows it. Jurisdiction follows ownership of the infrastructure layer, not the geographic location of the servers.

A separate thread on CSS vulnerabilities in email clients (targeting Fastmail and ProtonMail among others) added another layer: even privacy-focused email providers have attack surfaces that are hard to communicate to users.