One of the platforms we build and run for a client lets business customers email documents in. Each customer company gets its own address on a subdomain, and whatever arrives there is read and filed automatically. Most of the senders are European companies, and so is most of what they send: contracts, invoices and scanned paperwork with names and addresses on it.
Email is the right channel for this kind of work. The people sending the documents are often not the platform's users at all. They are suppliers, partners and service providers who will never log in to another portal, but who already send documents by email every day. Giving each customer an address to forward to, or to copy in, means the documents arrive where they belong without asking anyone to change how they work.
Behind that address sits an inbound email provider. It receives the mail for the subdomain, then posts each message to our endpoint as a webhook with links to download the attachments. From there the platform reads the documents and files them. The provider never decides anything, but every document passes through it.
That makes the inbound email provider a processor of our client's data, listed in their data processing agreement. We compared four providers. This is what to check, what we found in each vendor's own documentation, and the limit we accepted.
At a glance
- Candidates: Postmark, Twilio SendGrid, Resend and Lettermint.
- Deciding factor: where inbound mail and attachments are stored and processed.
- Choice: Lettermint, a Dutch company that hosts and processes email only in the EU.
- Trade-off: a 25 MB message limit, smaller than Postmark's or SendGrid's.
What we needed
- Inbound mail delivered to our endpoint as a webhook, with attachments we can download.
- Scans in whatever format customers use, including TIFF.
- Enough room per message for a set of scanned documents.
- Data stored and processed in the EU, so our client can explain where their customers' documents go in one sentence.
- Outbound sending from the same provider later, for transactional replies.
Why EU hosting decided it
GDPR does not require data to stay in the EU. A US provider can be used lawfully, and all three US candidates offer a data processing agreement with Standard Contractual Clauses for transfers out of the EEA. Calling them non-compliant would be wrong.
The difference shows up in practice. With a US provider, the client has to explain a transfer to every customer whose legal team asks: the clauses, the transfer assessment and the US access question. With a provider that stores and processes everything in the EU, there is no transfer to explain. For a B2B product sold to European companies, that question comes up in procurement, and a one-line answer is easier for everyone.
How the four compared
Every point below comes from the vendor's own pages, checked in November 2026.
- Postmark stores its data in the US, at a data centre near Chicago and on AWS, and says it has no plans for EU servers. Transfers rely on Standard Contractual Clauses. Inbound attachments can total 35 MB, the largest limit of the four.
- Twilio SendGrid offers EU data residency, but it needs a separate EU subuser, the EU API endpoint and an EU dedicated IP, which means a Pro or Premier plan. Data can still leave the EU for support and troubleshooting, and its data residency pages do not mention Inbound Parse at all. Inbound messages can be up to 30 MB.
- Resend can send from Ireland, but its GDPR page says it stores customer data in the US, including message content and webhook payloads, and that region choice does not change where data is stored. Transfers rely on Standard Contractual Clauses and the EU-US Data Privacy Framework.
- Lettermint is a Dutch company. Its subprocessor list puts hosting with UpCloud in the Netherlands and encrypted backups with OVHcloud in Germany, and every subprocessor on it is in Europe. Messages can be up to 25 MB.
The trade-off we accepted
Lettermint's 25 MB limit covers the whole message, and attachments grow by about a third when they are encoded for email. That leaves roughly 18 MB of actual files per message. Most documents are far smaller, but a set of high-resolution scans can come close.
For the rare set that does not fit, the answer is to send it across several emails, which is also what the provider recommends. We decided that was a better trade than moving every document through a US provider to gain 10 MB.
Their support
The documentation answered most of our questions. For the rest we emailed Lettermint, and one of the co-founders replied the next day with direct answers to all three: inbound and outbound mail share one monthly allowance, TIFF attachments are accepted, and the 25 MB limit is the same on every plan. He also explained what that limit means for real attachments and how to handle large scan sets, which told us more than the pricing page did.
Account verification went the same way. Within hours of our request they asked one clear question, how our company's website relates to the domain we send from, so they could confirm we were allowed to use it. When your provider is going to sit between your client and their customers' documents, that kind of check is reassuring rather than annoying.
What to check before going live
- Which hosts serve the attachment download links, so the platform downloads only from an allowlist.
- Whether inbound mail counts toward the same monthly allowance as outbound mail. On some providers it does, which changes the plan you need.
- How long the provider keeps inbound messages and attachments, and whether that can be shortened.
- A test webhook with an attachment, end to end, before pointing the MX record at the provider.
- Account verification. Our account belongs to 38Shift, but the domain belongs to our client, and the provider asked how the two are connected. Say so in the verification request and you save a round trip.
Conclusion
If your users are European businesses and the mail carries their documents, check where the provider stores inbound data, not only where it sends from. Region settings often control sending only. Then weigh the size limits against what your users actually send. For us, EU hosting was worth a smaller limit.
