EmailConnect
EmailConnect receives email sent to your own domains and delivers each message to your webhook as clean, structured JSON. Spam scoring, DKIM/SPF/DMARC results and attachment handling are included, and the entire chain runs inside the European Union.
What is EmailConnect?
EmailConnect is an inbound email service that turns every message sent to one of your addresses into a structured JSON payload delivered to a webhook of your choice. You point the MX records of a domain or subdomain at the platform, create one alias per workflow — support@, invoices@, calendar@ — and each alias POSTs to its own endpoint. The payload is documented field by field: sender name and address, recipient with its plus-address tag already parsed, subject, body in plain text, HTML and server-side Markdown, extracted links with their domain and anchor text, attachments with filename, MIME type, size and download URL, a spam score from rspamd, DKIM, SPF and DMARC results, a content classification, and SHA-256 integrity hashes of both the body and the raw message. Every delivery is signed with HMAC-SHA256 following the open Standard Webhooks convention, so your endpoint can prove the request genuinely came from EmailConnect. Small attachments arrive inline as base64 — up to 128 KB on the free plan, 2 MB on paid ones — while larger files are offloaded to EU-hosted S3 and reached through a download URL; the total message ceiling is 10 MB. Alias rules whitelist or block senders, filter by attachment type and act on the spam score before anything reaches your code, and a REST API creates aliases, lists domains and retrieves delivery logs. The product is deliberately narrow. It sends nothing, it runs no language model over your mail, and it attempts no template parsing or OCR: the publisher's stated position is that interpretation belongs to your own automation layer. Its second commitment is jurisdictional — the whole chain runs on Hetzner in Germany and Scaleway in France, behind a Dutch company, with no American subprocessor in the email path. Because it works by forwarding rather than OAuth, it never touches your primary mailbox, which is the argument its founder built the product on after watching IT departments reject full-mailbox integrations. It is published by XADI, a one-person Dutch company run by Xander Groesbeek.
What it does
- Receive email on your own domain and deliver it to any HTTP endpoint as structured JSON
- Route each alias to its own webhook, so one domain drives many independent workflows
- Split traffic with plus-addressing: invoices+acme@ arrives with the tag already parsed
- Filter spam with rspamd and return DKIM, SPF and DMARC verdicts in the payload
- Scan attachments with ClamAV and reject infected files before your endpoint is called
- Deliver attachments inline as base64 or offload them to EU-hosted S3 with a download URL
- Create and configure domains, aliases and webhooks programmatically through a REST API
When to use EmailConnect / When not to
A quick filter to help you decide if EmailConnect is the right fit.
When to use EmailConnect
- Back-end and full-stack developers who want inbound email as a plain HTTP POST rather than an SDK or a mailbox integration
- European teams for whom data residency is a hard requirement, not a preference, and who need GDPR compliance built into the architecture
- Automation builders working in n8n, Make or Zapier who need an email trigger without writing a connector
- Support and operations teams routing support@, invoices@ or orders@ into ticketing, accounting or ERP systems
- Indie hackers and small software companies who need a cheap, predictable email intake layer with a permanent free tier
When not to use EmailConnect
- Anyone looking for an AI email assistant that reads messages and drafts replies — the publisher explicitly refuses to run language models over your mail
- Teams that need to send email: the service is inbound-only and offers no outbound or transactional sending
- Organisations shopping for a complete helpdesk or ticketing product rather than a data feed into one they already run
- Users expecting ready-made field extraction from invoice or form templates, or OCR of scanned attachments
- Buyers who require an independently audited provider, since no SOC 2 or ISO 27001 certification is published
How to use EmailConnect
A typical end-to-end flow, from setup to results.
- Create a free account on app.emailconnect.eu — no credit card is required
- Add your domain and verify it by adding the MX and TXT records the dashboard gives you
- Create an alias such as support@ or invoices@ and point it at your webhook URL
- Alternatively, skip the domain entirely and use a plus alias under your account's system address
- Create a verified test endpoint in one click through the built-in webhooktest.eu integration, and watch payloads land in EmailConnect's own log viewer
- Simulate real conditions with mock responses: status codes, delays and response bodies
- Verify the Standard Webhooks HMAC-SHA256 signature on your endpoint before processing anything — Node.js, Python and Laravel samples are published
- Tighten the alias with rules: sender whitelists, blocked domains, attachment-type filters and spam thresholds
- Or take the no-code route: a Webhook node in n8n, a Custom Webhook module in Make, a Catch Hook trigger in Zapier
- Move to the REST API once you need to create and configure aliases from your own application
Pros & Cons
Pros
- Genuine EU sovereignty: Hetzner in Germany, Scaleway in France, a Dutch publisher and no US subprocessor in the email path
- Unusually transparent privacy posture — subprocessors named one by one, and a payment flow where Mollie acts as an independent controller so the vendor never sees your name, email or card
- No OAuth mailbox access at all, which is what makes the tool approvable by security teams that reject full-mailbox integrations
- Permanent free plan with three aliases and 100 emails a month, no credit card, and a paid entry point at only 12.95 EUR per month
- Rich, fully documented payload with working handler samples in Node.js, Python and PHP, and webhook signing on an open convention rather than a house scheme
- Predictable billing: no setup fee, no contract, overage charged per thousand emails so workflows never stop, and a cost calculator that shows the Maker-to-Business break-even
- Active and candid changelog — the July 2026 entry openly admits that the spam.isSpam field had been wrong since launch
Cons
- Inbound only: nothing is ever sent, so replying still requires a separate provider
- No template-based field extraction and no OCR — all interpretation stays your responsibility
- Email retention is one hour on Free and Maker, which leaves little room to replay or debug a failing endpoint
- The free plan omits spam filtering and webhook signing, and virus scanning only starts at Business
- No independent security certification: no SOC 2, no ISO 27001, only self-declared practices and third-party scan badges
- A one-person company, which brings a real continuity risk for anything business-critical
- Euro-only pricing, English-only interface and documentation, and no company presence on LinkedIn or any social network to follow
Pricing & Plans
A permanent free plan is available, covering three aliases, one custom domain and 100 emails per month with no credit card required. The lowest paid entry point is the Maker plan at 12.95 EUR per month, quoted inclusive of 21% Dutch VAT; EU businesses with a validated VAT number and customers outside the European Union are charged at 0%. Annual billing is offered at a discount whose amount is not published.
- 3 aliases
- 1 custom domain
- 100 emails per month
- basic classification and link extraction
- inline attachments up to 128 KB
- one-hour retention
- community support
- 5 aliases
- 1 custom domain
- 1
- 500 emails per month
- spam filtering
- webhook signing
- custom headers
- Markdown conversion
- 25 aliases
- 3 custom domains
- 10
- 000 emails per month
- up to three of your own S3 connections
- ClamAV virus scanning
- custom payload builder
- delete-email API endpoint
- 100 aliases
- unlimited domains
- 100
- 000 emails included
- queryable audit logs
- multiple S3 connections
- Data Residency Mode
- negotiated overage rates
Data, GDPR & hosting
A consolidated view of how EmailConnect handles your data.
GDPR overview
Compliance is presented as architectural rather than contractual. The publisher is Dutch, the processing chain runs entirely on Hetzner in Germany and Scaleway in France, and no US subprocessor appears anywhere in the email path — the stated aim being zero exposure to the CLOUD Act, FISA 702 or the Patriot Act. Concrete elements are published: a named list of subprocessors with purpose and data shared for each, Article 28 processor obligations, a DPA (signed DPAs on the enterprise tier), a data protection officer at dpo@emailconnect.eu, GDPR export from account settings, an Article 30 audit trail, and a stated response time of 14 days for data subject requests instead of the 30 the regulation allows. Two gaps remain: an Article 27 representative is said to be appointed but is never named, and no independent security certification is published.
Who owns the data?
The terms of service state that you keep ownership of everything you send through the platform. By using the service you grant EmailConnect only a limited licence to process and forward your email as far as delivery requires — nothing broader. The publisher positions itself as a processor under Article 28 of the GDPR, acting on your instructions, while you remain the controller. It undertakes to delete customer and end-user data at the end of the agreement if you ask. On the Platform tier, Data Residency Mode goes further: message content is never written to the central database at all, attachments live in your own S3 bucket, and only routing metadata stays with the vendor. The service is governed by Dutch law.
Reuse rights
Because you retain ownership and EmailConnect only holds a delivery licence, you may reuse the parsed data freely — store it, index it, feed it to your own models, resell the product built on top of it — without asking permission. The vendor commits to using the data only to run the service: receive, filter, parse and deliver. It states that it does not mine data or build user profiles, does not share personal data publicly or with third parties beyond its declared subprocessors, and uses no language model on message content. One exception is documented: where there are reasonable grounds to suspect abuse, a compliance review of up to 48 hours may inspect metadata only — subject lines, addresses, URLs, attachment filenames, timestamps and volumes — never the message body. Those captures are deleted seven days after the review ends, you are notified afterwards under Article 14, and you may object under Article 21.
Data retention & training
Hosting summary
All processing stays within the European Union. Hetzner in Germany hosts the application, the PostgreSQL database and Redis, isolated in a VPC with no public access, and is described in the privacy policy as the primary data centre; its servers are said to run on hydropower. Scaleway in France runs the SMTP servers, the email processing itself and the S3 object storage that holds attachments and invoices. The company is registered in the Netherlands, where its self-hosted monitoring tools also live. No American subprocessor appears in the email path — GitHub, Notion and Claude Code are declared as development tools handling no customer data. On the Platform tier, Data Residency Mode processes message content in memory and never writes it to the central database, keeping only routing metadata while attachments go to the customer's own S3 bucket. A DNS lookup on 5 September 2026 resolved the domain to 46.225.58.80, a Hetzner address in Nuremberg, Germany.
Things to keep in mind
Risks and trade-offs to weigh before adopting EmailConnect.
- Retention is one hour on Free and Maker: if your endpoint is down longer than that, the message content is gone and cannot be replayed
- The free plan has no spam filtering and no webhook signing, so an unsigned endpoint left open in production can be called by anyone who guesses the URL
- Virus scanning only begins at the Business tier — on cheaper plans, attachments reach your systems unscanned
- The July 2026 changelog reveals that spam.isSpam was false on every message ever delivered, including obvious spam; any code branching on it never fired and must be rewritten against spam.score
- Displayed prices include 21% Dutch VAT, so the real net cost differs depending on your status and can surprise a buyer comparing headline figures
- Fees are charged in advance and are non-refundable, and unused email credits are forfeited if the account is terminated for a terms violation
- Trusting one person's infrastructure with your entire inbound email flow concentrates a lot of operational risk in a single point of failure
Setup & Integrations
Technical difficulty
Moderate, and mostly front-loaded. You need a domain whose DNS you control, since setup means adding MX and TXT records, plus an HTTP endpoint able to receive a POST. Verifying the HMAC signature is your responsibility, though ready-made samples for Express, Flask and Laravel are published. Two shortcuts lower the bar considerably: a plus alias under your account's system address removes the DNS step entirely, and n8n, Make or Zapier will accept the webhook with no connector to install. The built-in webhooktest.eu integration gives you a verified test endpoint in one click.
Deployment
Integrations
Supported languages
Behind EmailConnect
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement EmailConnect.
Frequently asked questions
What does EmailConnect actually do?
Do I have to give it access to my mailbox?
Where is my data hosted?
Is there a free plan?
What does the cheapest paid plan cost?
What happens if I go over my monthly volume?
Does it use AI to read or classify my email?
How do I know a webhook request really came from EmailConnect?
How long are my emails kept?
Is there a mobile app?
Should you pick EmailConnect?
EmailConnect is a narrow tool that knows exactly how narrow it is. It receives email and hands it to your code as clean JSON — nothing more. There is no outbound sending, no helpdesk, no language model reading your messages, and the publisher argues at length that each of those omissions makes the core job more reliable. Judged on that promise, it delivers: the payload is documented field by field, deliveries are signed on an open convention, spam scoring and DKIM, SPF and DMARC verdicts travel with every message, and the free tier is permanent rather than a countdown. Its real differentiator is jurisdictional. Running end to end on Hetzner in Germany and Scaleway in France, behind a Dutch company with no American subprocessor in the email path, it offers European teams something a data processing agreement bolted onto US infrastructure cannot. The payment flow, where Mollie acts as an independent controller so the vendor never sees a name or a card number, shows the same instinct applied where most companies would not bother. The reservations are equally clear. Retention of one hour on the cheaper plans leaves almost no room to replay a failed delivery. Spam filtering and webhook signing are absent from the free plan, and virus scanning starts only at Business. There is no independent certification, the Article 27 representative is announced but never named, and the company is one person — a real continuity question for anything business-critical. For a European engineering team that needs a dependable email intake primitive and can live inside those limits, the entry cost is close to zero and the fit is excellent. For anyone expecting a full email platform, it is the wrong product, and honestly says so.
- Choosing a selection results in a full page refresh.
- Opens in a new window.