Skip to content
Independently verified · Quarterly re-audit
EU VETTED

addy.io

VERIFIED
Email aliasing · United Kingdom
Founded 2019 · addy.io ↗

England-and-Wales-governed email-alias service (formerly AnonAddy), hosted in the Netherlands; unlimited aliases, PGP-encrypted forwarding and reply-from-alias on paid tiers, open-source and self-hostable. Its operating legal entity is not named in its own Terms or Privacy Policy.

In short

addy.io, in the Email aliasing category, is a European service with Netherlands as its hosting location and at most minor, transient US exposure under the CLOUD Act.

Assessment notes

addy.io's own Terms of Use state governing law as "the law of England and Wales", but neither the Terms nor the Privacy Policy name an operating legal entity, company number, or registered address anywhere on the site. Public sources disagree on who actually operates the service (a comparison repository says "Netherlands", other web results say "Addy Pty Ltd" in Geelong, Australia), and neither claim is corroborated by any addy.io primary source, so country_iso is left null and ownership_signal is other. Mailbox/alias data at rest sits on servers in the Netherlands (UpCloud); Stripe and NOWPayments handle payments, Amazon SES sends the newsletter, and Cloudflare Turnstile is a login captcha, none of which are the primary data-at-rest path, so CLOUD Act exposure is assessed as minor rather than material. The determining factor for compliance_score is that no DPA is published anywhere on the site, which caps this listing at 3/5 regardless of the otherwise reasonable EU hosting posture.

CLOUD ACT
OWNERSHIP
SUB-PROCS
5 · 3 US
CLOUD Act by deployment

Exposure depends on how you run this product.

Hosted SaaS (default)

Vendor-operated: the sub-processors below apply.

Self-hosted (open-source)

Deploy on your own EU infrastructure and you control hosting and every sub-processor.

Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
  • Card-free payment available
    Accepts cryptocurrency (Bitcoin, Monero, Ethereum and others) via NOWPayments on yearly plans, alongside cards.
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About addy.io

addy.io (renamed from AnonAddy in 2024) was created in 2019 by developer Will Browning and offers open-source email aliasing under AGPL-3.0, self-hostable via Docker (github.com/anonaddy/anonaddy) or usable as a hosted service. Neither the Terms of Use nor the Privacy Policy on addy.io names an operating legal entity, company number, or registered address; the Terms state only that they "shall be governed by and construed in accordance with the law of England and Wales". Public sources disagree on who operates the service: a public comparison repository lists the jurisdiction as "Netherlands", while other web results describe the operator as "Addy Pty Ltd" in Geelong, Australia; neither claim is corroborated by any addy.io primary source, so this listing records the legal entity and country_iso as not established. The Privacy Policy states servers are located in the Netherlands (UpCloud); named third parties are Stripe and NOWPayments for payments, Amazon SES for newsletter delivery, and Cloudflare Turnstile for captcha. Free, Lite ($1/month billed yearly) and Pro ($3/month billed annually, or $4/month billed monthly) tiers scale from 10 to unlimited aliases; Lite and Pro add custom domains, catch-all (enabled by default on custom domains), PGP-encrypted forwarding (bring-your-own GPG/OpenPGP key), and reply-from-alias, the last of which is deliberately withheld from the Free plan to curb spam and abuse. addy.io passed an independent security audit by Securitum in September 2023 with no significant vulnerabilities found, though this is a one-off audit rather than a recurring certification.

SUB-PROCESSORS

Sub-processor map · 5

Source ↗
  • Amazon Simple Email Service (SES) US
    United States

    Newsletter delivery

  • Cloudflare Turnstile US
    United States

    Captcha / bot protection on login and registration

  • Stripe US
    United States

    Card payment processing

  • NOWPayments EU
    Netherlands

    Cryptocurrency payment processing (yearly plans)

  • UpCloud EU
    Finland

    Hosting of alias and forwarded-email data at rest (servers located in the Netherlands)

3 of 5 sub-processors are US-incorporated. Limited CLOUD Act exposure via these ancillary sub-processors.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-07-10).
FEATURES

Capability matrix

Email aliases 10 aliases
Custom domain Yes
Reply from alias Yes
PGP-encrypted forwarding Yes
Catch-all domain Yes
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option Yes
PRICING

Pricing & tiers

FREEMIUM
from €0.87/mo
billed annually
View pricing page ↗
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    addy.io/privacy…
    Open ↗
  • Terms of Service
    addy.io/terms…
    Open ↗
ALTERNATIVES

Alternatives in this category

SimpleLogin
Switzerland · Founded 2019
EU-BASED

Paris-founded (2019) email-alias service acquired by Proton AG in 2022; unlimited aliases, custom domains, PGP forwarding and catch-all on Premium, hosted across Proton/UpCloud data centres in DE, CH, NL and FR.

Public DPA Sub-processors Open source
FROM
€3.5/mo
CLOUD ACT
MINOR
AdGuard Mail
Cyprus · Founded 2024
EU-HOSTED

Cyprus-registered (AdGuard Software Ltd) free/paid email-alias and temp-mail service that reached general availability (v1.0) in June 2025; core forwarding runs on Amazon SES (US), and no DPA is published.

Public DPA Sub-processors Open source
FROM
€2.99/mo
CLOUD ACT
MATERIAL
AliasVault
Netherlands · Founded 2024
EU-SOVEREIGN

Dutch sole proprietorship (XIVISOFT / Leendert de Borst), open-source password manager with built-in receive-only email aliases; email aliases cannot send or reply, only receive. Free cloud tier hosted in Germany, AGPL-3.0 and fully self-hostable.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
NONE