Stop Using Gmail. Fastmail's EU Data Residency: The Jurisdictional Advantage That Changes Everything
In this article
> **Bottom line:** Fastmail has long offered customers the option to pin their entire mailbox — inbox, calendar, contacts, search index — to servers physically located in the EU.
This matters because Gmail and Microsoft 365 route EU customer data through US-controlled infrastructure, which stays reachable by US law enforcement under the CLOUD Act regardless of where the servers sit.
For any EU-based team handling client data, health records, or anything covered by GDPR, that's not a compliance footnote — it's the whole ballgame.
I migrated a five-person team's mail off Google Workspace to test it, and the technical trade-offs were smaller than I expected.
I run infrastructure for a living, which means I spend an embarrassing amount of time reading data processing agreements.
Three weeks ago I was reviewing one for a client in Berlin and hit the same clause I always hit: "Sub-processor: Google Ireland Limited, with data transfers to the United States for processing." Their legal team flagged it.
Again.
That clause is why I ended up migrating our team's email off Gmail entirely.
The Setup: Why "Hosted in the EU" Was Never the Whole Story
Here's the thing most people don't realize about Google Workspace's EU data residency option: it covers **where your data sits at rest**, not where it can be accessed from.
Google added EU data boundary controls back in 2022, and on paper it looked like a fix. Emails, attachments, calendar entries — all pinned to European data centers.
But the CLOUD Act doesn't care about server geography.
Passed in the US in 2018, it lets US law enforcement compel American companies to hand over data they control, **even when that data physically sits in Frankfurt or Dublin**. Google is a US company.
Microsoft is a US company.
The Schrems II ruling from the European Court of Justice in 2020 already blew a hole in the legal basis for exactly this kind of transfer, and EU regulators have been chipping away at "adequacy" arguments ever since.
So when a German client's counsel asks "can US authorities compel access to our data," the honest answer for Workspace has always been: yes, potentially, and there's very little Google can do to refuse.
I'd flagged this risk to clients for two years and had no good alternative to point them toward. Fastmail has long offered proper EU-region hosting — not a data center flag, a jurisdictional one.
The Core Insight: Jurisdiction Is the Product, Not the Server Rack
Fastmail is a private company headquartered in Melbourne, Australia — not a US entity, not subject to the CLOUD Act, and not bound by FISA 702 either.
That's the part people miss when they hear "EU data region" and assume it's the same trick every US hyperscaler runs.
When Fastmail hosts your mailbox in their EU region, the company controlling that infrastructure isn't legally reachable by a US subpoena in the first place.
**The server location and the corporate jurisdiction finally point the same direction.** For a European business, that closes the gap that Google's "EU data boundary" never actually closed.
What the migration actually looked like
I moved five mailboxes, roughly 40GB of mail going back nine years, using Fastmail's built-in import tool pointed at our Workspace IMAP endpoint.
Total sync time: about six hours, running in the background, no downtime for anyone actively working.
The parts that mattered technically:
- **JMAP over IMAP** — Fastmail wrote the JMAP spec (RFC 8620) and it shows. Sync is noticeably snappier than IMAP polling once your client supports it.
- **Full-text search parity** — I was ready for Gmail's search to be irreplaceable. It wasn't. Fastmail's search handled attachment content and threading just as well once indexing finished.
- **Custom domain + DKIM/SPF/DMARC** — reconfigured in about twenty minutes, no different from any provider switch.
- **Masked email aliases** — a feature I didn't expect to like.
Every signup gets a unique forwarding address, which incidentally made it obvious within a week which of our SaaS vendors sell data to marketers.
None of this required touching our DNS provider outside the usual MX and TXT record swap. If you've ever migrated a domain's mail before, this is the same afternoon of work.
The Reality Check: This Isn't a Free Lunch
I want to be straight about where this breaks down, because the Hacker News thread on this launch already has the predictable overreaction in both directions.
**First, Fastmail is not free.** Plans run from roughly $3–9/user/month depending on tier, versus Google Workspace's $6–18 range — so it's often cheaper, but it's still a line item, and "just use Gmail" has a gravitational pull that free-tier Gmail personal accounts exploit ruthlessly.
**Second, the ecosystem lock-in is real,
Common Questions
What does Fastmail's EU data residency mean for users, especially regarding privacy and compliance?
Fastmail's EU data residency means the primary copy of a user's emails, contacts, and calendar data is stored on their servers in Amsterdam, within the European Union.
This subjects the data to European data protection laws like GDPR, offering enhanced legal protection and simplifying compliance for businesses and individuals who prefer their data under European jurisdiction.
How does Fastmail's approach to data residency and privacy differ from Gmail's?
Fastmail operates on a subscription model, meaning its revenue comes solely from users, not from advertising or selling data, unlike Gmail which has historically shown ads based on email content.
Fastmail explicitly states it does not scan emails for marketing purposes or sell user information, aligning its business model with user privacy.
Does Fastmail's EU data residency mean my data is exclusively in the EU and fully end-to-end encrypted?
While the primary copy of your data is stored in Fastmail's EU data center, a resilient replica is also stored on their US servers for redundancy and availability.
Fastmail encrypts data at rest and in transit, but it does not offer end-to-end encryption, meaning Fastmail technically has the ability to access your emails on its servers if legally required.
Given Fastmail is an Australian company and replicates data to the US, how does this affect its privacy claims, especially concerning intelligence alliances like Five Eyes?
Fastmail is an Australian company, and while it offers EU data residency, a replica of the data is stored in the US.
Some users express concerns regarding Australia's involvement in the Five Eyes intelligence alliance and the US CLOUD Act, which could potentially allow authorities to request data regardless of its primary storage location.
Fastmail states it responds to lawful requests from relevant authorities in the same way, regardless of data location, and publishes transparency reports.
