Exclaimer’s Azure datacenters and data residency
Exclaimer hosts its email signature service on 14 Microsoft Azure datacenters in seven geographically separated active-active pairs, meaning two datacenters per region process email at the same time. In normal operation, Exclaimer keeps customer data in the customer’s region, and if one datacenter fails, its partner takes over automatically.
At a glance
For server-side email signatures, Exclaimer processes email in transit and stores directory data in your region to support data residency requirements.
Exclaimer runs 14 Microsoft Azure datacenters in seven geographically separated active-active pairs, one pair per region.
If a datacenter fails, its partner takes over automatically, and average availability is 99.99%.
Your region is set when your subscription is created, and Exclaimer doesn’t move your data to another region unless you ask.
Where does Exclaimer process your data?
Exclaimer hosts its email signature management service in the following regions:
Microsoft 365
Region | Azure datacenters |
|---|---|
US | East US (Virginia) and West US (California) |
Canada | Canada Central (Toronto) and Canada East (Quebec) |
Europe | West Europe (Netherlands) and North Europe (Ireland) |
UK | UK South (London) and UK West (Cardiff) |
Germany | Germany West Central (Frankfurt) and Germany North (Berlin) |
Australia | Australia East (New South Wales) and Australia Southeast (Victoria) |
UAE | UAE North (Dubai) and UAE Central (Abu Dhabi) |
Google Workspace
Region | Azure datacenters |
|---|---|
US | East US (Virginia) and West US (California) |
Europe | West Europe (Netherlands) and North Europe (Ireland) |
Keeping customer data in region supports GDPR, CCPA, HIPAA, and data residency requirements. Exclaimer also aligns with the data protection standards of the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) in the UAE.
How is your region chosen?
When you start a new Exclaimer subscription, we set your region automatically with a geolookup of your location. We expect that to match where Microsoft hosts your Microsoft 365 tenant, although it may not for global organizations. If your region is wrong, contact support and we can move your subscription.
If you buy through Microsoft Marketplace, the region is selected there and can’t be changed later. If you buy directly from Exclaimer, you can request a move to a different region through support, and Exclaimer makes the change with you.
Our cloud endpoints page lists the countries each region serves.
How do paired datacenters work?
Each pair functions as a High Availability (HA) Cluster. Both datacenters process email at the same time, and Exclaimer synchronizes data only between the two. Maintenance runs on one datacenter in a pair at a time.
What happens if a datacenter goes down?
If a datacenter fails, its partner takes over its traffic automatically, with no manual intervention. Each datacenter in a pair can handle the full regional load.
Exclaimer designs failover to keep data in your region. Inside a datacenter, Azure load balancers route traffic away from affected nodes, and health checks flag faults in real time.
Automated monitoring runs 24/7/365 and triggers predefined escalation chains.
Follow active incidents on the status page and in the Trust Center.
Customers can get post-incident reports. Exclaimer maintains documented business continuity and disaster recovery plans and tests them periodically.
If Exclaimer processing is unavailable, mail still delivers through Microsoft 365 or Google Workspace, because Exclaimer isn’t the mail transfer agent and doesn’t queue or block email. The email signature may not be applied until the service recovers or fails over.
“When I assess a vendor, I want to know where my data lives and what happens when something fails. If the answer to the second question changes the answer to the first, that’s a problem. That’s why we keep both datacenters in each pair inside the same region.”
What stays in your region, and what doesn’t?
In normal operation, your data stays in your region, with four exceptions: configuration choices you make, applicable legal requirements, limited, controlled access for authorized support or security purposes, and the sub-processors that support the service. Our security measures state these exceptions. The Trust Center lists each sub-processor, its location, and the data it handles.
For EU and EEA customers, personal data is processed in European datacenters in Germany, the Netherlands, and Ireland, and in normal operation it doesn’t leave the EEA. UK customer data is hosted in the United Kingdom, and Exclaimer doesn’t transfer data between its UK and EU/EEA environments. If technical support is provided from outside the EEA, EU Standard Contractual Clauses cover the transfer.
What Exclaimer processes and stores
Data | What happens to it |
|---|---|
Email content | Processed in transit with server-side email signatures, then returned to your mail flow. Exclaimer doesn’t store bodies, attachments, or subject lines, and already-encrypted emails bypass processing. |
Directory attributes, configuration data, and email signature templates | Stored in your region’s cluster, encrypted at rest with AES-256, and logically segregated by tenant. |
Sender, recipient, and email signature ID metadata | Encrypted in your region and kept for up to seven days for troubleshooting. |
Outlook add-in | The add-in adds the email signature in your email client on your device. The email body stays in the client, and Exclaimer doesn’t receive it. Analytics and headline content also need server-side configuration. |
How Exclaimer uses email data | Exclaimer reads an email only to decide which signature to apply and where it goes in the message. |
Which certifications are Microsoft’s, and which are Exclaimer’s?
Azure holds its own certifications, including ISO/IEC 27001 and SOC 2. Exclaimer undergoes its own audits, being independently certified for SOC 2 Type 2, ISO/IEC 27001, and ISO/IEC 27018, among others. An external certification body, BARR Certifications, issues both ISO certifications, and both cover the information security management system that supports the development and supply of Exclaimer’s cloud solution.
Exclaimer has held ISO/IEC 27001 certification since 2016, and its annual SOC 2 Type II audits cover security, availability, and confidentiality across a 12-month observation period.
The most recent ISO and SOC 2 Type II renewals were completed in February 2026.
For the full list of certifications, see our Security page. The Trust Center holds:
Certificates and penetration test summaries
The SOC 2 Type II report, on request once you sign a non-disclosure agreement (NDA)
The sub-processor list, with each sub-processor’s location and the data it handles
A Business Associate Agreement, on request, for healthcare organizations subject to HIPAA
The Data Processing Agreement (DPA) is part of Exclaimer’s end user license agreement (EULA), so customers who accepted the EULA since May 2018 are covered automatically, and standalone agreements are available on request. Karl Bagci is Exclaimer’s Data Protection Officer.
You can read the DPA on Exclaimer’s DPA page.
Frequently asked questions about Exclaimer’s SOC 2 Type II compliance
Yes. Exclaimer runs on 14 Microsoft Azure datacenters, grouped into seven geographically separated active-active pairs.
You don’t choose your region. We set it automatically with a geolookup when your subscription is created, and it can’t be changed afterwards. Moving to another region means creating a new subscription. If you buy through Microsoft Marketplace, the region is selected there and can’t be changed later.
Exclaimer doesn’t receive your email body when you use the Outlook add-in on its own. Your email client renders the email signature on your device, so the body of the email stays in your email client.
The Trust Center holds certificates, penetration test summaries and the sub-processor list. Exclaimer’s SOC 2 Type II report is available on request once you sign a non-disclosure agreement (NDA). Healthcare organizations can request a Business Associate Agreement there. You can read the Data Processing Agreement on Exclaimer’s DPA page.
Exclaimer’s Google Workspace solution uses four Azure datacenters in two regions, while Exclaimer’s Microsoft 365 solution uses 14 Azure datacenters across seven regions, organized into seven geographically separated active-active pairs. Exclaimer built its cloud solution on Azure for Microsoft 365 first, and most of its customers and email volume come from Microsoft environments, so Google Workspace email is routed to a smaller set of regional datacenters.
Talk to Exclaimer's security team
If your vendor review needs documentation, context, or audit evidence that isn't covered here or in the Trust Center, our security team can walk you through the specifics directly.
Contact our security team →