GDPR and UK data residency for transactional email

Because you cannot send someone an email without giving the sender their email address, and an email address is personal data. Add the subject line and body — which routinely contain a name, an order, a reset link — and a transactional email provider processes personal data on your behalf on every single send.

That makes you the controller and us the processor, and it means Article 28 requires a written contract between us before you send the first message. The Data Processing Agreement is the terms we intend to offer for that, published in full so you can review them now — but it is still in draft pending legal review, so it is not yet a contract you can rely on. If your assessment needs an executed Article 28 agreement today, that is a conversation rather than a click.

Sending is in the UK. Every message is dispatched through Amazon SES in London (eu-west-2). That is the region the code configures, and it is visible in the headers of mail you receive from us — it is checkable, not asserted.

Storage at rest is not claimed. The application database is a managed platform, and we do not have a residency guarantee for it in writing from that provider. So we do not state one. If UK or EU storage residency at rest is a hard requirement in your assessment, the honest answer today is that we cannot satisfy it, and you should know that now rather than during an audit.

Every sub-processor is named with its location in the Privacy Policy: Amazon Web Services, Convex, Clerk, Vercel, Stripe, Sentry. The DPA commits us to 30 days' notice before that list changes, which is only a keepable commitment because there is exactly one list and both documents render from it.

Article 5(1)(e) says personal data must not be kept longer than necessary. For email that is a sharper obligation than it sounds, because the message body is the richest personal data in the system and the least useful to retain.

Each account sets a retention window of 30, 90 or 365 days, or indefinite. Past the window an hourly job strips the HTML body, the plain text and any attachments, while keeping the delivery record — so status, timestamps and engagement survive and you do not lose your statistics by shortening retention. New accounts are provisioned at 90 days rather than indefinite, because a default of "keep everything for ever" is the storage limitation principle failing silently.

Access and portability. One click produces a JSON export of the account, its domains, suppressions, webhooks, usage and message metadata. If any part had to be capped it tells you which, rather than quietly returning a short file — a portability export that silently drops rows is the same defect it exists to prevent.

Erasure. Account deletion is self-serve and genuine: sending identities, the payment record, then every row belonging to the account, then the login — in that order, so a failure part-way cannot lock someone out of an account that still holds their data.

For your users, not just you. If one of your recipients exercises a right against you, the data you need is reachable through the API rather than through a support request to us.

API keys are stored only as SHA-256 hashes and shown once, so nobody — including us — can recover one from the database. Keys carry a scope, so the credential pasted into a third-party tool can send but cannot read your mail. Webhooks are HMAC-signed, and an endpoint whose hostname resolves to a private address is refused at delivery time — a check on the resolved IP, which is not a defence against active DNS rebinding and is not claimed as one. Every row carries an account identifier and every query is scoped to it at the data layer.

The full list, including an explicit account of what is not in place, is on the security page.

No. Not SOC 2, not ISO 27001. We are small and early, and a certification bought at this size measures the audit rather than the engineering.

We would rather you found that out on this page than three weeks into a procurement cycle. If your review has a hard certification requirement, we do not meet it today and no amount of the above changes that.

Sending is in the UK. Sub-processors are named with their locations in the Privacy Policy, and where a transfer outside the UK is involved the intended mechanism — the UK IDTA to the EU SCCs — is set out in the DPA, which is in draft and so not yet executed. Read those two documents rather than a summary of them here — on this subject a paraphrase is worth less than the text, and the text is short.