Fastmail Security and Privacy in 2026: Where Your Data Lives
A look at Fastmail the company rather than the app: who owns it, where your email is stored, how it handles legal requests, its new EU data region, what it does and doesn't encrypt, and why it keeps AI out of the inbox.
A deep dive into Fastmail the company, not the app: who owns it, where your email is stored, how it handles legal requests, its EU data region, its security stack and tamper-proof archive, and why keeping AI out of the inbox is a feature, not a bug.
Instead of hunting for yet another email provider to review, I went back to one of the real staples of the space: Fastmail.
Regular readers may remember my general review of Fastmail. That post covered the day-to-day experience and features. This one looks at the company itself: how it protects your data, what it believes in, where your email lives and how well it would survive a bad day.
The short version is that Fastmail doesn’t chase trends or hype. It never tried to reinvent email. It just delivers one of the fastest, most capable, most stable and best-value email services around.
Wondering how Fastmail compares with Proton Mail? I put them head to head in Proton Mail vs Fastmail 2026: Privacy or Productivity? If you’re weighing up a more opinionated inbox, see HEY vs Fastmail.
Short answer: Fastmail is secure and unusually transparent, but it isn’t zero-access. It encrypts mail in transit and at rest, you can choose EU or US primary storage, and legal requests have to go through Australian law. It does not offer built-in end-to-end encryption, and Fastmail stays an Australian company wherever your data sits.
Reader offer: 10% off Fastmail for your first year. Use my referral link to get 10% off any Fastmail plan for a full year, with the 30-day free trial still included.
At a Glance: Who Fastmail Is (and Isn’t) For
| User Profile | Best Fit? | Core Value Drivers / Key Trade-offs |
|---|---|---|
| Privacy-minded individuals | Ideal | Masked Email, anonymous image proxying, no ads, no AI built into the inbox and a choice of EU or US data storage. |
| Power users and desktop-client fans | Ideal | Standard IMAP, SMTP, CalDAV and CardDAV, plus JMAP. Works with Apple Mail, Thunderbird and Outlook with no bridge software. |
| Small businesses and freelancers | Strong fit | Custom domains and the tamper-proof Professional Email Retention Archive at no extra cost on the Professional plan. |
| European users and EU-based businesses | Strong fit | Primary storage in Amsterdam at no extra charge. The company is still Australian, and emergency backups and system logs sit in the US. |
| Large enterprises | Partial fit | No directory integration or office suite on the scale of Google Workspace or Microsoft 365. |
| Zero-access purists | Alternative needed | No built-in end-to-end encryption. Look at Proton Mail (try it here) or Tuta. |
| Budget-only consumers | Alternative needed | No free tier; a subscription is required after the 30-day trial. |
So Why Is My Email on Google Workspace?
You might be wondering: if I rate Fastmail so highly, why is my primary email on Google Workspace?
The answer is cost. I signed up for Workspace to get better access to Gemini, including NotebookLM, and email came bundled in. I moved my domain over to give Gmail for business another go. That left my Fastmail account redundant. Since I only use my own domain, not a @fastmail.com address, I closed it to save a few pounds a month. (If you’re not on your own domain yet, here’s why using your own email domain makes sense: it’s exactly what made leaving painless.)
I like Gmail and its tight links with the Google ecosystem, but I miss Fastmail’s speed and simplicity. I suspect I’ll be back before long. I’ve written up my time with Gmail in Workspace in Is Paid Google Workspace Gmail Worth It?
Who Owns Fastmail?
The name doesn’t really capture what the company is. Fastmail is based in Melbourne, Australia, with a second hub in Philadelphia, and was founded in 1999. It’s privately owned and independent. It doesn’t publish exact subscriber numbers, but industry estimates suggest around 400,000 to 500,000 paying customers, managing between one and two million email accounts.
CEO Bron Gondwana leads the company, and founder Rob Mueller is still involved as CTO. I like seeing a founder still at the helm, because it helps keep the engineering values from being watered down by short-term shareholder pressure.
Its history is a lesson in resilience too. Opera Software bought Fastmail in 2010, and when Opera’s priorities shifted, the staff bought the company back in 2013. It has been independent ever since, and in 2015 it acquired Pobox.
Fastmail also earns its money from simple subscriptions, not venture capital or advertising. There’s no pressure to mine your data or bolt on features to follow a trend. The company makes money by keeping you happy, which is how it should be. I dig into why that matters in free vs paid email: what you really pay with.
| Company Fact | Fastmail |
|---|---|
| Founded | 1999 |
| Headquarters | Melbourne, Australia (second hub in Philadelphia, USA) |
| Legal jurisdiction | Australia |
| Ownership | Private and independent since the 2013 staff buyback from Opera |
| Leadership | Bron Gondwana (CEO), Rob Mueller (founder and CTO) |
| Business model | Paid subscriptions only; no advertising, no venture capital |
| Customer loyalty | Over 90% annual renewal rate, according to Fastmail |
| Infrastructure | Own servers in co-located facilities; no rented public cloud |
Refreshing Honesty
I’ve run SaaS businesses for over 25 years, and honesty has always been a core value for me. It should be a given, but anyone who has looked closely at big tech knows it isn’t.
Fastmail explains its privacy and security policies in plain English, and it publishes a Data Transparency Report for anyone to read. It also doesn’t run smear campaigns or shout “we’re better than Google because we don’t do X”. It lets the service speak for itself, and its customers seem to agree: Fastmail says more than 90% of them renew every year.
Where Is Fastmail Data Stored? Choosing the EU Region
On 3 August 2026, Fastmail launched an EU Data Region. You can now keep your primary copy of your email and files on dedicated servers in Amsterdam rather than only in the United States. Existing and new customers can pick their region in Settings, and the EU region was pre-selected for accounts with a European billing address.
This matters for a few reasons:
- Compliance. European businesses and privacy-minded users with GDPR or internal rules can keep their main data inside the EU.
- Speed. Traffic stays close to home, so things load faster in and around Europe.
- Hardware control. Fastmail runs its own physical servers in an Amsterdam facility instead of renting space from AWS or Google Cloud, which keeps third-party clouds away from your data.
- No extra cost. Many providers charge a premium to choose where your data is stored. Fastmail doesn’t.
| Data Residency | EU Region | US Region |
|---|---|---|
| Primary copy of mail and files | Amsterdam, Netherlands | Philadelphia or St. Louis, USA |
| Live replica (failover) | United States | The other US site |
| Emergency backups | Philadelphia, USA | Philadelphia, USA |
| System logs | United States | United States |
| Account metadata | Replicated to all sites | Replicated to all sites |
| Hardware | Fastmail-owned, co-located | Fastmail-owned, co-located |
| Extra cost | None | None |
| Governing law | Australia | Australia |
One caveat on jurisdiction: your primary storage moves to Europe, but Fastmail is still an Australian company, subject to Australian law wherever your data sits. Emergency backups are held in the US, system logs are consolidated in the US, and some account data (such as your email addresses and basic account metadata) is replicated to every site. Fastmail is upfront about this: it says that if you need a guarantee that your data remains only in the EU, it doesn’t offer that. If jurisdiction is your main concern, my Swiss vs German email privacy breakdown shows how much it matters.
How Your Data Is Stored and Protected
Fastmail doesn’t rent from the big cloud providers. Its in-house team manages its own hardware, with data encrypted at rest on disks inside locked server racks.
Your email is also copied several times over. There are at least two copies on separate servers in your main location (Amsterdam or the US), plus a live replica in a different region ready to take over if the primary site goes down. On top of that, automated off-site backups are taken every few hours for every account, independent of the live system. Those snapshots are currently held in Philadelphia.
Proof Over Promises: The Transparency Report
Plenty of providers make big privacy claims. Fastmail backs its claims with numbers, through its public Data Transparency Report.
The report shows how it handles legal requests. Under the Australian Privacy Principles, Fastmail can’t hand data to foreign authorities directly, so it rejects informal or direct overseas demands. Every request has to come through Australian law enforcement and meet Australian legal standards before it counts. Because it’s a paid service, it attracts far fewer bad actors, and it handles only a handful of valid requests worldwide each year. In 2025 there were 16 valid requests, and Fastmail actioned five of them.
The report splits requests into basic subscriber details and actual email content, and Fastmail pushes back on broad “fishing expeditions”. It also explains how foreign requests, such as US CLOUD Act inquiries, go through official mutual assistance channels.
| Data Access Requests | 2024 | 2025 |
|---|---|---|
| Valid requests received | 16 | 16 |
| Requests actioned | 13 | 5 |
| Subscriber information disclosed | 5 | 2 |
| Stored communications disclosed | 8 | 3 |
| Via mutual law enforcement treaty | 11 | 2 |
| Australian Federal Police | 3 | 10 |
| Australian state police | 2 | 4 |
Figures as listed in Fastmail’s Data Transparency Report, checked in October 2026. Fastmail notes that the counts can double-count some items and that year-on-year comparisons are difficult, so read the trend with care.
Is Fastmail Secure? Security in Practice
Your main email address is effectively the master key to your digital life, covering your finances, healthcare and online accounts. If you’ve never checked how exposed yours is, read Have I Been Pwned: breach risks for email. Fastmail protects it with a comprehensive security stack, including passkeys, two-step verification and extra password prompts for sensitive actions.
Data is encrypted in transit using TLS 1.3 and Perfect Forward Secrecy, and at rest on physical disks. Fastmail also uses HSTS headers to block SSL-stripping and man-in-the-middle attacks, and a strict Content Security Policy so only verified Fastmail code runs in your webmail. A bug bounty programme invites outside researchers to find problems before attackers do.
| Security Feature | Fastmail | What It Protects Against |
|---|---|---|
| Passkeys | Yes | Phishing and password reuse |
| Two-step verification | Yes | Stolen or guessed passwords |
| Re-authentication for sensitive actions | Yes | Someone using an unlocked, signed-in session |
| TLS 1.3 with Perfect Forward Secrecy | Yes | Interception, including later decryption of recorded traffic |
| HSTS | Yes | SSL stripping and man-in-the-middle attacks |
| Strict Content Security Policy | Yes | Malicious scripts running in the web app |
| Encryption at rest | Yes | Physical theft of disks |
| Anonymous image proxy | Yes, on by default | Tracking pixels revealing your location and device |
| Bug bounty programme | Yes | Undiscovered vulnerabilities |
| Built-in end-to-end encryption | No | A compromised or compelled provider (PGP and S/MIME work via third-party apps) |
Privacy Built Into the Inbox
Remote images in emails are a favourite tracking trick, since they can reveal your location and device. I explain just how much they give away in the invisible spy in your inbox. Fastmail blocks this by default by requesting remote images anonymously on your behalf before they reach you.
It also has Masked Email, which lets you create a unique throwaway address for every sign-up. Your real address stays private, and companies have no easy way of linking your accounts together. Here’s why masked email beats disposable email for most people.
Who Can See Your Mail?
Inside the company, staff follow a least-privilege rule. An engineer can’t just open your inbox. They need a specific, justified request, usually tied to a support ticket where you’ve given permission, and every access is logged and audited. Fastmail says that in its 25-year history it has never had to take action over staff misusing data, backed by sanctions that go as far as dismissal and prosecution.
The Honest Take on End-to-End Encryption
Fastmail doesn’t offer built-in end-to-end encryption (E2EE) in its web app, and it explains why. E2EE needs both sides to exchange keys securely, and most of the email world isn’t set up for that. In a web app, the server supplies the decryption code anyway, so it adds little protection against a compromised server. It would also break useful features like full-text search, previews and spam filtering.
Fastmail does support PGP and S/MIME through third-party desktop apps. If your threat model demands absolute secrecy, its advice is to use a dedicated tool like Signal instead of standard email. I think that’s a sensible, honest position.
Know the limits: Fastmail encrypts your mail in transit and at rest, but it is not zero-access encrypted, so Fastmail could technically read stored mail if compelled. If your threat model requires that the provider can never read it, look at Proton Mail or Tuta. My explainers on what zero-access encryption really means and who zero-access email is actually for will help you decide.
Spam Control and Digital Rights
The spam filter scores every message against criteria you can customise, with presets and detailed controls. The aim is to avoid false positives that bury important mail.
Fastmail also backs digital rights groups, including Electronic Frontiers Australia, Digital Rights Watch and the Australian Privacy Foundation, and takes part in industry bodies such as the Communications Alliance, to push for better privacy laws. It also contributes to open standards through the IETF and to open-source projects such as the Cyrus IMAP server.
A Resilience Feature I Love: The Professional Email Retention Archive
With my business continuity hat on, the Professional Email Retention Archive is a standout. ⭐⭐⭐⭐⭐
It quietly keeps a tamper-proof, read-only copy of every email sent and received. Unlike an archive folder, it can’t be cleared or edited by individual users.
- Resilience. If a rogue employee wipes their inbox, or an account is compromised, your paper trail stays intact.
- Compliance. It helps businesses that must keep a record of all their email for auditing, legal discovery or regulatory duties.
- Tamper-evident. Only account admins have access, and switching it on or off sends an alert email, so you can confirm nobody has quietly disabled it.
- No hidden premium. For new signups it’s included in Business Professional with no extra per-gigabyte charge. (Legacy business accounts that predate April 2024 are charged $2 per GB per month for it.)
Switch it on from day one: retention only covers mail sent and received after you enable it. Anything older isn’t captured.
No AI in My Email, Thank You Very Much
Apologies to my trusty AI assistant, without which half of these posts would be unreadable. Even so, I don’t think AI belongs inside an email app.
Features that rewrite your messages, suggest canned replies and summarise your inbox are mostly marketing hype. I need them about as much as I need an itchy foot on the motorway.
So it’s a relief that Fastmail hasn’t crammed an assistant into the inbox, when many rivals won’t even let you switch theirs off. In Fastmail’s own words, “There’s no chatbot bolted onto the inbox, and your mail isn’t being piped through a model in the background.” Its privacy policy also states that it does not, and never has, trained AI on customer data.
The core app stays entirely human. The only AI link is an opt-in MCP server, launched in April 2026, for people who want to connect their own AI tool. If you never set it up, nothing changes.
If you switch the MCP server on: you authorise it through an OAuth consent screen with three permission levels: read-only, write, and send. Treat it like any other app that can reach your mailbox, and start with read-only.
Email should be personal, warts and all. Sending one isn’t like publishing a polished blog post, drafting a legal letter or proofreading a thesis. I want people to know I wrote it, and not a corporate template. So thank you, Fastmail, for keeping email raw and authentic.
Fastmail Plans and Pricing in 2026
Fastmail prices in US dollars, and every plan starts with a free trial of up to 30 days. Prices below are as listed on Fastmail’s pricing page in October 2026. The headline figure is the annual-billing rate per month; monthly billing costs more.
| Plan | Annual billing | Monthly billing | Users | Storage | Custom Domains | Retention Archive |
|---|---|---|---|---|---|---|
| Individual | $5/month ($60 a year) | $6 | 1 | 60 GB (50 GB mail, 10 GB files) | Yes | No |
| Duo | $8/month ($96 a year) | $10 | 2 | 60 GB each | Yes | No |
| Family | $11/month ($132 a year) | $14 | Up to 6 | 60 GB each | Yes | No |
| Business Basic | $3/user/month ($36 a year) | $4 | Per user | 6 GB | No | No |
| Business Standard | $5/user/month ($60 a year) | $6 | Per user | 60 GB | Yes | No |
| Business Professional | $9/user/month ($108 a year) | $10 | Per user | 150 GB | Yes | Included |
Signing up through my referral link takes 10% off any of these plans for your first year.
Comparative Matrix: Fastmail vs. the Alternatives
| Feature | Fastmail | Proton Mail | Google Workspace |
|---|---|---|---|
| Jurisdiction | Australia | Switzerland | United States |
| Choice of Data Region | EU or US, all plans, no extra cost | Stored mainly in Switzerland (outside the EU) | Higher-tier editions only |
| Native IMAP/SMTP | Yes (direct) | Via Bridge app (paid plans) | Yes (direct) |
| Unlimited Aliases | Yes (Masked Email) | Plan dependent | Limited aliases per user |
| Zero-Access Storage by Default | No | Yes | No |
| AI Built Into the Inbox | None | Optional writing assistant | Gemini built in |
| Public Transparency Report | Yes | Yes | Yes |
| Business Model | Paid only | Freemium | Paid only |
| Free Trial | Up to 30 days | Free plan | 14 days |
| Full Review | You are here (and the Fastmail review) | Proton Mail review | Workspace Gmail review |
| Try It | 10% off your first year | Try Proton Mail | 14-day trial |
Want a closer head-to-head? See Proton Mail vs Fastmail, HEY vs Fastmail, or my StartMail review for an EU-based alternative.
Pros and Cons
| Strengths | Weaknesses |
|---|---|
| Independent and subscription-funded since the 2013 staff buyback | No built-in end-to-end encryption |
| Owns its hardware, with a choice of EU or US storage at no extra cost | Australian jurisdiction applies wherever your data is stored |
| Plain-English transparency report with very few valid requests | Emergency backups and system logs stay in the US |
| No AI in the inbox and no AI training on customer data | No free tier beyond the 30-day trial |
| Tamper-proof retention archive included on Business Professional | No full office suite for larger organisations |
Frequently Asked Questions
Is Fastmail secure?
Yes, by mainstream standards. It uses TLS 1.3 with Perfect Forward Secrecy, encrypts data at rest, supports passkeys and two-step verification, and runs a bug bounty. The trade-off is that it isn’t zero-access, so it protects you from outsiders far better than it protects you from the provider itself.
Is Fastmail end-to-end encrypted?
No. Mail is encrypted in transit with TLS 1.3 and at rest on Fastmail’s disks, but it is not zero-access encrypted. You can use PGP or S/MIME through a third-party desktop app if you need end-to-end encryption. For what “secure” should mean in practice, see what does secure email actually mean?
Where is Fastmail based, and who owns it?
Fastmail is based in Melbourne, Australia, with a second hub in Philadelphia, and is privately owned and independent. Its staff bought it back from Opera Software in 2013. Australian law applies to it wherever your data is stored.
Where is Fastmail data stored?
You can choose. The EU region keeps your primary mail and files in Amsterdam; the US region uses Philadelphia or St. Louis. Emergency backups for everyone are held in Philadelphia, and system logs are consolidated in the US.
Does Fastmail use AI on my email?
No. There’s no AI built into the Fastmail apps, and Fastmail says it has never trained AI on customer data. An optional MCP server lets you connect your own AI tool if you want to.
Can US authorities get my Fastmail data?
Not directly. Fastmail only responds to requests made through Australian law enforcement. US requests, including those under the CLOUD Act, have to go through the formal treaty process and meet Australian legal standards.
Is there a Fastmail free trial?
Yes. Every plan comes with a free trial of up to 30 days.
Which plan includes the email retention archive?
Business Professional. It’s included at no extra charge and covers all mail from the point you switch it on.
The Bottom Line
Fastmail remains the gold standard for anyone who values speed, independence and real privacy over gimmicks. In an industry full of forced AI, ad tracking and murky data practices, it stands out: it owns its infrastructure, offers EU data residency for your primary copy, vets legal requests strictly and keeps the inbox human. It isn’t zero-access, and it won’t pretend to be. Whether you want to protect your personal mail or your business continuity with tamper-proof archiving, paid, independent software like this is worth every penny.
If you’re ready to take back control of your inbox, you can try Fastmail risk-free with a 30-day trial. If you decide to stay, signing up through my referral link gives you 10% off your subscription for your entire first year.
Try Fastmail and save 10% on your first year. Start with the 30-day free trial, and if you stay, my referral link takes 10% off your subscription for a full year.
Disclosure: This article contains affiliate links. If you subscribe to Fastmail using my referral link, you get a 10% discount for a full year and I receive a referral credit at no extra cost to you. The Proton Mail links are also affiliate links. I only recommend services I personally use and trust.
