FOR THE PERSON SENT HERE TO SAY NO
The questions on your form, answered before you ask them.
Somebody wants to buy this and you have to decide whether it is allowed. You need to know where the data sits, who can read it, how long it is kept, how it gets deleted, and what happens when a data subject asks. All of it is written down, and the parts we do not have are written down too.
The processing agreement is included on every plan, including free.No SOC 2, no ISO 27001, no third-party penetration test yet. Those are stated on the security page rather than implied away.
WHERE WE SIT
Your mail goes out the way it does today. We write down what happened.
Your appyoursSends one request: who it goes to, which template to use, and the values to fill in.
Spoolwaythis is usWe fill in your template, hand it to your server, and write down every step.
Your mail serveryoursAmazon SES, Mailgun, Postmark, or your own server. We never send as if the mail were ours.
Your customeryoursGets the email, the same as they do today. Your address, your reputation.
and every step above is written down
THE RECORDsearchable later — and kept for exactly as long as you decide
Did that email actually go out?Your mail server’s own reply, word for word, with the time it was accepted.
What exactly did it say?The message itself, stored encrypted, for as long as your retention policy says — or never stored at all.
Who else can send as us?Every key is named and belongs to a person. Revoke one without breaking the rest.
WHAT CHANGES FOR YOU
Four things, in plain words.
Canadian hosting, one regionEverything runs on Oracle Cloud in ca-toronto-1. There is no region picker, because there is one region — said plainly rather than sold as a feature.
A DPA on every plan, no SCCs neededA processor’s obligation under GDPR Art. 28, not an upsell, and free accounts get the same contract. Data at rest in Canada is covered by the EU adequacy decision for Canada, so EU customers need no Standard Contractual Clauses for it.
Retention you configure, deletion you can seeSet how long message bodies are kept — down to zero — per account and per template. Expiry is a dated event in your audit log, not a silent disappearance.
Right to erasure, actually implementedAn erasure request removes the personal data across every table that holds it, and the ledger records what was done.
THE INTEGRATION
The short version
data at rest Canada · Oracle Cloud ca-toronto-1 transit TLS, terminated at Cloudflare's edge subprocessors three, named and dated DPA every plan, including free certifications none yet — and we say so
WHAT WE DO NOT DO
We never send mail as if it were ours, and we never show a delivery we cannot prove.
There is no plan where we become your sender. Your server keeps your reputation. Where a mail server cannot report back, the record stops at the handoff and says so — no green tick standing in for a fact nobody has.
what we hold, and what we do not have yet →ALSO WRITTEN FOR
Your transport. Your record.
Running in five minutes.
connect your mail server → name the product → send a testStart free — no card requiredFree forever tier · caps pause, never auto-upgrade