AdGuard Mail
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Cyprus-registered (AdGuard Software Ltd) free/paid email-alias and temp-mail service that reached general availability (v1.0) in June 2025; core forwarding runs on Amazon SES (US), and no DPA is published.
AdGuard Mail offers EU hosting in Cyprus, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Email aliasing.
Assessment notes
AdGuard Mail is operated by AdGuard Software Limited, a Cyprus-registered company (HE 332952, Limassol), whose own EULA sets Cyprus as the governing jurisdiction. AdGuard's own company pages state only a 2009 Cyprus founding; widely cited secondary sources (Wikipedia, company-profile aggregators) describe the company as originally founded in Moscow, Russia in 2009 before relocating headquarters to Cyprus around 2014, a detail AdGuard's own materials do not mention or corroborate, and current beneficial ownership beyond the Cyprus registration was not established from any primary source. Cyprus is an EU member state, but with the founding-control origin unresolved this listing takes ownership_signal: other rather than eu_owned. The determining factor for compliance_score is twofold: no DPA is published anywhere, and the Privacy Policy names Amazon SES, a US-owned service, as the mechanism used for email forwarding, i.e. the product's core function (not an ancillary one) routes through US infrastructure, which the rubric treats as material CLOUD Act exposure rather than minor.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- 3 · 1 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About AdGuard Mail
AdGuard Mail is a product of AdGuard Software Limited, a Cyprus-registered company (HE 332952, registered address Anexartesias and Athinon 79, Nora Court, Flat/Office 203-205, 3040 Limassol) whose own EULA sets Cyprus as the governing jurisdiction. AdGuard's own company pages state the company was "founded in 2009, with the HQ in Limassol and the team of experienced specialists working from all around the globe", without further origin detail. Widely cited secondary sources (Wikipedia and multiple company-profile aggregators) describe AdGuard as originally founded in Moscow, Russia in 2009, relocating its headquarters to Cyprus around 2014; AdGuard's own official pages do not mention this, and no primary source found by this review corroborates or refutes it beyond the secondary accounts, so the origin claim is recorded here as unconfirmed by AdGuard itself but not omitted. Current beneficial ownership beyond the Cyprus registration (third-party aggregators report one undisclosed institutional investor) was not established from any primary source. The product itself launched in beta in December 2024 and reached general availability at version 1.0 in June 2025, adding reply-from-alias and additional alias domains behind a paid subscription; it is no longer in beta. The Free plan offers 10 aliases, 1 recipient and 2,000 forwarded emails per month from a single shared alias domain; the paid Full plan (from €2.99/month, or €16.80/year) raises this to 1,000 aliases, 50 recipients, unlimited forwarding, reply-from-alias and a choice of 3 alias domains, none of which are user-owned custom domains. The Privacy Policy names Amazon SES as the service used for email forwarding, meaning the product's core function routes through US-owned infrastructure, alongside Paddle.com Market Ltd and PayPro Global, Inc. for payments. No DPA or sub-processors list beyond the general Privacy Policy is published.
Sub-processor map · 3
-
Amazon Simple Email Service (SES) USUnited States
Email forwarding, the product's core function
-
Paddle.com Market Ltd non-USUnited Kingdom
Payment processing and merchant of record
-
PayPro Global, Inc. non-USCanada
Payment processing
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Simple Email Service (SES) | United States | Email forwarding, the product's core function | US |
| Paddle.com Market Ltd | United Kingdom | Payment processing and merchant of record | non-US |
| PayPro Global, Inc. | Canada | Payment processing | non-US |
Source: the vendor’s published sub-processor list, read 10 Jul 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of AdGuard Mail
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Switzerland · €3.50/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
United Kingdom · €0.87/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
NetherlandsEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
SimpleLogin
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€3.50/mo |
addy.io
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
€0.87/mo |
AliasVault
Netherlands
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |