Letro is hosted in Switzerland. Production infrastructure runs on Infomaniak, a Swiss provider, and is operated by Letro Tech GmbH, a Swiss company registered in Schwyz. For the Cloud tier there are no relay nodes or storage locations outside Switzerland.
What is stored, and where
Letro is an encrypted and evidential platform, so two categories of data exist:
- Message content and attachments — end-to-end encrypted on the sender's device using Matrix Olm/Megolm. The homeserver stores only ciphertext; Letro cannot read it.
- Delivery and audit metadata — the timestamped record of who sent what to whom, when it was delivered and when it was read. This is what makes a Letro record usable as evidence. See How end-to-end encryption and auditability coexist.
Both categories are stored on the homeserver that serves your organisation.
By deployment tier
- Cloud — Letro's shared infrastructure on Infomaniak, Switzerland; operated by Letro Tech GmbH; residency: Switzerland.
- Dedicated — a single-tenant homeserver on Letro-managed Swiss infrastructure, isolated per customer; operated by Letro Tech GmbH; residency: Switzerland.
- Sovereign — your own infrastructure, in your jurisdiction, including air-gapped; operated by your organisation with Letro providing software and support; residency: determined by you.
Customers do not currently select a specific Swiss region for Cloud or Dedicated deployments. Where a customer requires it, we will consider region placement on request.
Federation and cross-border movement
Letro is built on Matrix's homeserver model. If a room stays within one homeserver, its data stays on that homeserver. Federation between homeservers is opt-in and controlled by the administrator: only approved homeservers can exchange room data, over authenticated server-to-server APIs. Data crosses a border only when you choose to federate with an environment in another jurisdiction.
Backups
Letro performs encrypted backups of Cloud and Dedicated homeservers on Infomaniak infrastructure in Switzerland, so that audit records survive infrastructure failure. Backups contain the same ciphertext and metadata as the primary system and are retained for one week on a rolling basis.
Legal framework
Letro processes data under the Swiss Federal Act on Data Protection (FADP) as the primary framework, and supports customers' obligations under the EU GDPR and the UK GDPR.
Support access
Support staff cannot read message content — it is encrypted end to end and Letro does not hold the keys. Support can see the operational metadata needed to diagnose delivery and sync issues, and that access is logged.
