EU Data Residency

Postkit is built from the ground up with EU data residency. Every byte of your data -- email content, metadata, tracking events, and account information -- stays within the European Union. This is not a configuration option or a premium feature. It is the only way Postkit operates.

What EU data residency means

All of Postkit's infrastructure runs in EU data centers operated by EU-based providers. There is no replication to non-EU regions, no failover to US data centers, and no third-party services that route data outside the EU.

This means:

• Your email content is processed and stored exclusively in the EU
• Recipient metadata (addresses, delivery status, timestamps) never leaves the EU
• Tracking events (opens, clicks, bounces) are recorded and stored in the EU
• Account data (API keys, domain configurations, webhook settings) resides in the EU
• Logs and analytics are generated and retained within EU infrastructure

When you send an email through Postkit, the data crosses EU borders only in one case: the actual SMTP delivery to the recipient's mail server, which by definition must reach wherever the recipient's server is located. This is inherent to how email works and applies to every email service provider.

Infrastructure layers

Every layer of Postkit's stack runs on EU-based infrastructure:

Compute

All application servers -- the API Gateway, Send Worker, Webhook Worker, Inbound Processor, and Tracking Server -- run on compute instances in EU data centers. There are no edge functions, CDN workers, or satellite nodes outside the EU.

Database

PostgreSQL, the single source of truth for all Postkit data, runs in an EU data center. All data at rest is stored on EU-located disks. Backups are stored in the same EU region.

Cache and message queues

Redis (used for API key caching, rate limiting, and idempotency) and NATS JetStream (used for all inter-service communication) both run on EU-located infrastructure. The persistent message streams that guarantee email delivery are stored in the EU.

Object storage

S3-compatible object storage, used for inbound email attachments and template assets, is hosted by an EU-based provider in an EU data center. No objects are replicated to non-EU regions.

SMTP engine

Postal, the SMTP engine that handles outbound email delivery and DKIM signing, runs in an EU data center. SMTP credentials, DKIM private keys, and delivery logs all remain in the EU.

DNS and networking

Domain verification, DNS record management, and internal service networking all operate through EU-hosted infrastructure.

GDPR compliance by design

EU data residency is a foundational requirement for GDPR compliance, but Postkit goes beyond just keeping data in the EU:

No US subprocessors

Postkit does not use any US-based cloud services for data processing or storage. This eliminates the risks associated with US surveillance laws and the ongoing uncertainty around EU-US data transfer frameworks like the Data Privacy Framework (successor to Privacy Shield and Safe Harbor).

Data processing agreements

Postkit acts as a data processor on behalf of your organization (the data controller). A Data Processing Agreement (DPA) is available that documents the technical and organizational measures in place to protect personal data.

Right to erasure

When a contact exercises their right to be forgotten, you can delete their data through the API. Postkit supports full deletion of email records, contact information, and associated tracking events. Suppression records (which are necessary for legal compliance to prevent re-sending to opted-out addresses) are retained with minimal data.

No cross-border data transfers

Since all data stays in the EU, there are no cross-border data transfers that require Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or adequacy decisions. This simplifies your compliance posture significantly.

Data minimization

Postkit collects and stores only the data necessary for email delivery and the features you use. Tracking data (opens, clicks) is only collected when you explicitly enable tracking for your emails.

What this means for your application

If you use Postkit for transactional email, your compliance team can rely on these guarantees:

• All transactional email data (content, metadata, tracking events) is processed and stored in the EU
• No data transfers to non-EU countries for processing or storage
• EU-based providers at every infrastructure layer -- no US cloud dependencies
• DPA available documenting technical and organizational measures
• Deletion API supporting right-to-erasure requests

For GDPR audits, your Data Protection Impact Assessment (DPIA) for email processing can reference Postkit's EU-only architecture as a technical measure that reduces cross-border transfer risk to zero.

What's next?

• Quickstart to start sending from EU infrastructure
• Email Delivery Pipeline for a detailed look at how emails are processed within EU infrastructure