mbag.ai runs on the same platform as Mailbuttons, the Agent Mail API this site is a consumer-facing front end for. Its infrastructure and legal posture are Mailbuttons' infrastructure and legal posture.

# Where your data lives

Customer data — including the contents of email passing through your mailbox and the audit logs derived from it — is stored within the United Kingdom and European Economic Area. Primary hosting is a UK-based VPS in the Greater London region. Object storage and message-queue infrastructure run on the same UK host.

Customer data leaves the UK/EEA only via two narrow paths: Cloudflare (DNS and edge protection) and Anthropic (LLM inference, only when the hosted-agent feature is enabled — you can disable this, and no customer email content leaves the UK/EEA). A third US-incorporated sub-processor, Backblaze, holds encrypted off-site backups in its EU Central region (Amsterdam); data is encrypted client-side before transit and never leaves the EEA at rest.

# Who operates it

mbag.ai is operated by Code Cutter Limited, registered in England & Wales, company number 08453060.

# Compliance posture

UK-incorporated, EU/UK-hosted. ISO 27001 policies are in force now, with certification planned for 2027.

There is no aspirational claim beyond that: no SOC 2, no completed pen test, no certification badge to show yet. What's true today is the hosting location, the legal entity behind it, and the policy set already governing how we handle data.