BLUN · Mailing's security posture in plain language: encryption in transit and at rest, role-based access with hardware-key MFA, a published sub-processor list, and full GDPR rigor — Art. 28 DPA, Art. 33 breach notice, Art. 17 erasure, all of it. No US replication in the default flow.
Encryption, access control, sub-processors, compliance. The boring foundations done properly.
Data is protected end-to-end across the request path, on disk, and in every uploaded asset.
Roles, MFA, audit log. The principle is least privilege, the practice is hardware keys.
Short list. Published. EU-first. Anyone touching user data is here, by name and by purpose.
The legal scaffolding behind the keys and the cipher suites.
Two data centres, both in Germany, both yours. No replicas in the United States — by design, not by toggle.
BLUN · Mailing runs primary out of EU-hosted Nuremberg with synchronous failover to Falkenstein. Backups are encrypted at rest and stored in the same EU region. There is no default replication path that crosses the Atlantic.
If something goes wrong, here's exactly what happens. Four steps, written down before they're needed.
Anomaly detection on auth, send-rate, and admin actions. On-call paged within 60 seconds, internal channel notified, clock starts.
Affected surface taken offline or quarantined. Credentials rotated. Audit log frozen for forensic capture, blast radius mapped.
Affected users emailed within 72h under GDPR Art. 33. Data Protection Authority notified where required. Status page updated.
Public, blameless postmortem within 14 days. Root cause, timeline, mitigation, follow-up actions, all written and shared.
Found a vulnerability? Let us know. Responsible disclosure is paid disclosure.
Email a clear writeup with reproduction steps. We acknowledge within 24 hours, triage within 5 working days, and patch critical issues within 30 days. Eligible reports are paid in EUR; we publicly credit reporters who want it.
security@blun.aiFive questions we get every week from security and procurement teams.
All sending and storage runs on EU-hosted servers in Germany. Primary in Nuremberg (DE-NUE-A1), failover in Falkenstein (DE-FAL-B2). Backups stay in the same EU region. There is no US replication in the default flow, and no toggle that quietly enables it.
Production access is gated by RBAC, hardware-key MFA, and a per-action audit log. The list of humans with production credentials is short — currently the founder and a small named on-call rotation. Every privileged action is logged with timestamp, IP, role, and reason.
Detect, contain, notify within 72 hours under GDPR Art. 33, then publish a blameless postmortem within 14 days. Affected users get a direct email naming the scope, the data involved, our containment steps, and a written follow-up of remediation actions.
EU-hosted is ISO 27001 certified at the hosting layer. BLUN · Mailing itself targets SOC 2 Type 2 in Q3 2026 — observation period is running now. We commission an external pen-test every six months from an independent EU firm; the executive summary is available under NDA.
Email contact@blun.ai from the address on file, or use the in-app erasure flow under Settings → Privacy. Hard delete from production completes within 30 days; backup expiry within 35 days. We confirm in writing once the cycle is done.
EU-hosted, GDPR-native, audit-logged. Start free, upgrade when the volume justifies it.
