Don't take our word for it. Verify.
Demonstrable compliance, verifiable certifications and auditable infrastructure: the documentation your DPO, your auditor or a public tender panel needs.
- GDPR
- eIDAS
- Decree-Law 12/2021
- FIPS 140-2 Level 3
Legal framework
Built within European law, not adapted to it.
The three legal pillars that frame the service, and what each one guarantees in practice.
GDPR: Regulation (EU) 2016/679
Data processing in the EU (Portugal), with no transfers to third countries. Full traceability, data minimisation and records of processing available to clients who need to include them in their own compliance records.
eIDAS: Regulation (EU) No 910/2014
Registered Email relies on qualified timestamps and certificates issued by providers on the EU trusted list, recognised in every Member State.
Portuguese Decree-Law 12/2021
The statute that implements eIDAS in Portugal and provides the framework for electronic registered delivery services. The platform operates within that framework, with proof of sending and delivery that carries evidential value in court.
Technical certifications
Cryptography is not a promise. It is audited hardware.
The technical certifications behind certified communications, verifiable by any auditor.
Thales HSM: FIPS 140-2 Level 3
Cryptographic operations for certified communications run on Hardware Security Modules certified to FIPS 140-2 Level 3, the same standard used in banking. Keys never leave the hardware, not even in the event of an attack.
Qualified certification authorities
The qualified timestamps and certificates are issued by Asseco and Multicert, trust service providers on the EU Trust List, supervised by the competent national authorities.
SSL/TLS certificates
Sooma also partners with the certification authorities Asseco and Multicert to issue Wildcard SSL/TLS certificates for clients: the same chain of trust that protects our own infrastructure.
Due diligence
Documentation for your evaluation process.
If you are evaluating Sooma in a procurement process, audit or public tender, the team provides the compliance documentation you need: technical description of the infrastructure, data processing agreement, privacy policy and evidence of the applicable certifications. Talk to us and tell us what your process requires.
Request documentation →Frequently asked questions
Certifications and compliance
The questions DPOs, auditors and tender panels ask us most often.
Does Sooma's Registered Email have the same legal validity as a registered letter?
It does not have the formal equivalence, but it has evidential value in court: under Article 43 of the eIDAS Regulation, data sent through an electronic registered delivery service cannot be refused as evidence for being electronic, and the date and time are attested by a qualified timestamp. The formal equivalence to registered mail with acknowledgement of receipt, laid down in Portuguese Decree-Law 12/2021, applies to qualified services.
Who issues the qualified certificates?
Qualified trust service providers (Asseco and Multicert), on the EU Trust List and supervised by the competent authorities.
Can I use Sooma's documentation in my own GDPR audit?
Yes. We provide the information needed for our clients' records of processing and compliance assessments. Talk to the support team.
Is Sooma subject to the US CLOUD Act?
No. Sooma is an EU company (Portugal), with its infrastructure in the EU, subject exclusively to European law, unlike providers subject to US jurisdiction, regardless of where their servers are located.
Compliance that is verified, not rubber-stamped.
Request the documentation your process needs from our team in Europe.