GDPR-compliant email for EU companies
Review where messages are stored, where AI processing runs, and which other services receive data. Our email infrastructure and self-hosted AI run in Finland; our DPA names the ancillary subprocessors and the data each receives.
| Requirement | How euromail meets it |
|---|---|
| Where data is processed | API ingestion, Redis queues, the Rust SMTP engine, and PostgreSQL storage all run in Hetzner's Helsinki data center (hel1). No edge nodes or replicas outside the EU. |
| Sub-processors | EuroMail delivers directly to recipient mail servers from Finnish IPs, without an external delivery relay. Those recipient servers may be outside the EU. AI processing is self-hosted in Finland without a cloud fallback. Ancillary services, including US payment processing, are listed in the DPA. |
| Data Processing Agreement | Included in our terms on every plan, including Free, and names Finland as the processing location for email content under GDPR Article 28. Read it from the legal section whenever procurement needs it. |
| Schrems II / transatlantic transfer | Our email storage and AI processing run in Finland. Assess the recipient destinations and ancillary subprocessors relevant to your use of the service; the DPA lists their data access, locations and safeguards. |
| Right to erasure & portability | Full account export/erase, or a single recipient's data scoped to one address for a data subject access request — both are API endpoints, not support tickets. |
Why this matters for procurement
A procurement review can start with concrete facts: email storage, the delivery engine and AI inference run in Finland. The DPA then shows which ancillary services receive data, including billing outside the EU. See euromail vs Amazon SES for a comparison of delivery infrastructure.
Export and erase, by API
Article 20 portability and Article 17 erasure are endpoints, not support tickets. Per-email export and erasure are rate limited to one request per minute per account and cover metadata, delivery events, and suppression/unsubscribe entries — without touching the rest of the account.
curl "https://api.euromail.dev/v1/gdpr/[email protected]" \
-H "Authorization: Bearer em_live_..."
200 OK { metadata, delivery events,
suppression + unsubscribe entries }Related
-
EU data residency
Email infrastructure and self-hosted AI run in Hetzner Helsinki (hel1). Ancillary services are listed separately in the DPA.
-
GDPR tooling
Account and per-email export/erase endpoints for Articles 15, 17, and 20.
-
euromail vs Amazon SES
Why "EU region" on a US-headquartered provider isn't the same as EU-only infrastructure.