Where are forwardemail.net servers located?

[cemalokten]

I've looked over your FAQ and did a little searching, can't find a difinitive answer.

Would be good to know where your servers are located, geographically.

Thanks.

[titanism]

Hi there @cemalokten, at any time you can go to https://forwardemail.net/ips and see the IP's for all of our servers.

You can then do a reverse lookup if desired on the IP addresses, using a tool such as https://www.maxmind.com/en/geoip-demo. You can search on your preferred search engine with a keyword such as "geo ip lookup" to find other services.

Screenshot:

All of our servers are in the United States, and we have no plans at this time to move outside the USA. We have transitioned from Digital Ocean and Vultr to DataPacket, and we are migrating a few more servers in the next 2-4 weeks and then should be completely on DataPacket in their Denver region. These servers are baremetal servers running with custom hardware (AMD Ryzen processors with NVMe SSD drives) and 2x uplinks.

More details are available at https://discuss.privacyguides.net/t/forward-email-new-features/24845/45. Our website's about page mentions our server transition, and our GDPR/DPA pages list our subprocessors.

[titanism]

There are no plans for non-USA hosting right now. If you wanted to, you could self-host, and @shaunwarman has led the effort there. I believe the minimum server requirements are IPv4/IPv6, reverse PTR, 8 GB RAM, and 4 CPU. We will chime in here once self-hosting is ready (#321).

We have thought about this a lot though. The way our systems are designed are extremely secure (even we cannot access your SQLite storage files since they're encrypted, and especially if not if you use OpenPGP to encrypt your messages). We're not at the scale right now that makes sense for us to spin up another domain on another TLD (e.g. `forwardemail.tld), and any other service out there that does stuff like this is doing it plainly wrong in our opinion. You should not separate the website database from the storage database, and this is what other servers do. So basically part of your data lives on one server in the US, and another lives in another country. Database aren't designed typically to be split up like this, however with our approach this is feasible in the future (since we use SQLite).

The right approach for something like this is to do it on a completely different domain name (e..g forwardemail.tld) where the tld is the other country. It's not correct to split up where the data lives (e.g. when you access the website, the data you're accessing should also live on the servers located in whatever country of choice). The way most systems are designed don't allow this, so we'd have to come up with our own approach (which we have an idea of what we'd do, but it just doesn't make sense right now and is very time intensive to build out). You don't want to be accessing a website and then the website data (e.g. your log in information, alias configuration, etc) is on a US-based server and your mailboxes are on a EU-based server for example.

That being said, we have put a lot of effort into ensuring that we are GDPR compliant, as we have our own processor overseas, and we also have a DPA on our website (see https://forwardemail.net/en/gdpr and https://forwardemail.net/en/dpa).

Another issue for us is trusting a 3rd party overseas in a jurisdiction that's not ours, and would be extremely costly if something happened.