Compliance, built in
Data export, erasure, and audit logging are product features with API endpoints, not an enterprise add-on or a support ticket.
DSARs answered with a request
A data subject asks what you hold on them: GET /v1/gdpr/export with their address returns it. They ask to be forgotten: DELETE /v1/gdpr/erase removes it. Article 20 account export and Article 17 full account deletion are equally self-serve. Erasure is per-email precise, not all-or-nothing.
curl -X DELETE \
"https://api.euromail.dev/v1/gdpr/[email protected]" \
-H "Authorization: Bearer em_live_..."Deleted on schedule, logged for the record
Email bodies are purged 30 days after sending automatically; the delivery record, email events, and inbound content are purged on their own daily jobs (up to 7 months, 90 days, and 30 days respectively); suppression entries persist so protection outlives the data. Every account action lands in an audit log (timestamp, actor, action, IP), kept for 365 days or until the account is deleted, ready for the day an auditor asks.
- Email body retention
- 30 days, then purged
- Delivery record retention
- Up to 7 months
- Audit log
- 365 days, every action
- DSAR endpoints
- Per-email export & erase