Data residency

Epostix is operated from the European Union and your data stays there.

Where things are

Data	Where
Message content	EU
Message metadata, events and logs	EU
Contacts and audience data	EU
Received mail	EU
API request logs	EU

There is no region setting to get wrong, and no arrangement where mail is dispatched from one region while the record of it lives in another.

Message content is encrypted at rest

The body of every message, outbound and inbound, is encrypted before it is stored. The database holds the envelope: who it was from, who it was to, the subject, and what happened to it. The content itself sits encrypted in object storage and is decrypted only when it is read back, such as when you fetch a message through the API.

That is why webhook payloads carry metadata and not bodies. A webhook payload is stored so it can be replayed, and putting content in one would mean keeping a plaintext copy of your mail outside the encrypted store.

What leaves the region

Mail you send leaves, because that is what sending mail is. Once a message is handed to the recipient's provider it is subject to that provider's policies, wherever they operate. Nothing we do changes where Gmail keeps a message delivered to a Gmail address.

Everything that stays with us stays in the EU.

Sub-processors and the DPA

The current list of sub-processors, along with our data processing agreement, is available from the dashboard under account settings, or on request. If your procurement process needs a signed DPA before you can start, ask before you build.

Deletion

Deleting a message through the API removes the record and the stored content. Deleting a workspace removes its data.

Aggregate counts that no longer identify anyone, such as the totals behind Analytics, are retained.