Where your data is
Last reviewed 3 November 2026
Every place Ascripto keeps or handles your organisation’s data, and from where it can be reached. This page states facts; the commitments are Annexes 2 and 3 of our Data Processing Agreement, and when they change, this page changes with them.
Where it is kept
The service runs in one place: Microsoft Azure’s Germany West Central region, in Frankfurt, Germany, within Microsoft’s EU Data Boundary. Two exceptions, both for email we send: our own mail server in Amsterdam, the Netherlands, and Microsoft’s email service, whose data location is Germany.
| Data | Kept in | On infrastructure of |
|---|---|---|
| Your directory and signatures: names, email addresses, job titles, phone numbers and the other fields your signatures use; the signatures; audit findings; the Outlook add-in’s records | Frankfurt, Germany | Microsoft (Azure) |
| The message log: sender and recipient addresses, Message-ID, time and delivery outcome of mail through our relay | Frankfurt, Germany | Microsoft (Azure) |
| Mail through our relay (Microsoft 365) | Passes through our relay in Frankfurt, Germany, and back to your tenant. Its content is not stored | Microsoft (Azure) |
| Clicks on tracked links and banner loads | Frankfurt, Germany | Microsoft (Azure) |
| Brand images, served to recipients’ mail clients | Frankfurt, Germany | Microsoft (Azure) |
| Accounts and sign-in: your administrators’ and users’ names, email addresses, sign-in methods, sessions and the record of what they do; our staff’s record of what they do | Frankfurt, Germany | Microsoft (Azure) |
| Directory access tokens and keys | Azure Key Vault, Frankfurt, Germany | Microsoft (Azure) |
| Backups of all the above, nightly, kept 30 days | Frankfurt, Germany, and nowhere else | Microsoft (Azure) |
| Email we send: sign-in codes, password resets, invitations, notices | Our own mail server in Amsterdam, the Netherlands; if it cannot be reached, Azure Communication Services, data location Germany | Akamai (Linode); Microsoft |
| Notices our relay sends to a sender about a message it could not deliver | Azure Communication Services, data location Germany. Microsoft says that email it sends may transit or be processed in other geographies | Microsoft |
| Our servers’ logs, kept 30 days | On each server: Frankfurt, Germany; Amsterdam, the Netherlands for the mail server | Microsoft (Azure); Akamai (Linode) |
| Billing: the billing contact’s name and email address, the billing details, what was charged. Never who your people are, only how many | Stripe, Dublin, Ireland, as our privacy policy describes | Stripe |
Google and Microsoft, whose platforms you connect, are your own providers: your directory and mailboxes stay where your agreements with them keep them.
Who can reach it, and from where
- Ascripto is operated from Poland, and the people who run it work from within the European Economic Area. Their access to your data is through a support grant that is limited in time, carries a reason, is recorded, and is visible to you (DPA section 4).
- Microsoft’s support staff outside the European Economic Area may have incidental access when supporting us, under the Standard Contractual Clauses in Microsoft’s data processing terms and, where Microsoft is certified, the EU–US Data Privacy Framework. Which countries that may be cannot be known in advance; Microsoft lists its sub-processors on its Service Trust Portal.
- Akamai’s staff and sub-processors outside the European Economic Area may have incidental access to the mail server, under the Standard Contractual Clauses in Akamai’s data protection addendum; Akamai lists them in its Trust Center.
The Data Processing Agreement names every sub-processor before it starts. Its Annexes 4 to 7 set out what the laws of Japan, South Korea, Taiwan and Hong Kong ask of us as your processor.
For your privacy notice
The laws below make you, as the employer, tell your people where their data is handled. These paragraphs are written for you to adapt; they describe Ascripto’s part only.
Japan (APPI)
For the “external environment” your notice describes (PPC guidelines, Q&A 10-25):
Our employees’ personal data used for email signatures is handled on our behalf by Ascripto, operated from Poland, on servers of Microsoft Azure in Frankfurt, Germany; email the service sends is handled on a server in Amsterdam, the Netherlands. Germany, Poland and the Netherlands are member states of the European Union, whose system for protecting personal information the Personal Information Protection Commission recognises as equivalent to Japan’s (Enforcement Rules, Article 15(1)). The service provider’s support staff outside the European Union may have incidental access when supporting it; which countries that may be cannot be identified in advance.
South Korea (PIPA)
The items Article 28-8(2) asks your privacy policy (개인정보 처리방침) to state:
| Items | Names, email addresses, job titles, departments, phone numbers and the other directory fields our signatures use; for mail through the relay, sender and recipient addresses and delivery records. Message content passes through and is not stored. No resident registration number or credit information |
|---|---|
| Where, when, how | Germany (Microsoft Azure, Frankfurt), and the Netherlands for email the service sends; over encrypted connections, continuously, from when our directory is connected |
| Recipient | Ascripto, privacy@ascripto.com |
| Purpose, retention | Creating, deploying and auditing our email signatures, and adding them to mail; while the person is in our directory, then deleted within the periods of Ascripto’s Data Processing Agreement, Annex 1 |
| Refusing | Ask [your privacy contact] to leave you out: we then exclude you from what Ascripto reads, and your signature is no longer managed by it |
The legal basis: Article 28-8(1)(5), the Personal Information Protection Commission’s recognition of the European Union on 16 September 2025.
Taiwan (PDPA)
We commission Ascripto to process our employees’ names, job titles, contact details and the other directory fields our email signatures use, for creating and managing those signatures (Personal Data Protection Act, Article 4). Ascripto processes them on servers of Microsoft Azure in Frankfurt, Germany, and sends email from a server in Amsterdam, the Netherlands; it is operated from Poland.
Hong Kong (PDPO)
The classes of persons to whom your personal data may be transferred include our email signature provider, Ascripto, which processes it for us in Frankfurt, Germany, and sends email from Amsterdam, the Netherlands.