Data residency

Transactional email that stays in the EU

Every email API says it is GDPR compliant. Ask where the message body is stored and the answer is usually Virginia. Here is ours, in the order a data protection officer asks — and nothing on this page is a region you have to pick: it is the only one there is.

Five sub-processors, all named

DigitalOcean, Amazon Web Services, Paddle, Sentry and Google. That is the whole list, and the privacy page says what each one receives. Paddle is the one non-EU name: it sells you the subscription as merchant of record, so the invoice carries the VAT that applies to you. It receives your billing details; it never sees a message.

What "processor" means here

For the mail you send, we are the processor and you are the controller. Your recipients are your contacts, not ours: we hold their addresses to deliver your mail and to keep a suppression list, and for nothing else. The privacy page forms the data processing terms between us — what is held, where, and for how long — and a test in the codebase fails the build if the page ever promises a retention the code does not enforce.

Your own domain, your own key

There is no shared sending domain. Every message is signed with a DKIM key generated for your domain, from a bounce address on your domain, so the mail is yours to the receiver as well as to the regulator. The domain page checks each record and shows exactly which one is missing.

Questions to ask any vendor

1. Where is the database — not the "region", the city?
2. Where are message bodies archived, and for how long?
3. Where do error reports and logs go?
4. Who are the sub-processors, by name, and what does each receive?
5. Which of these can I change, and which are fixed?

Our answers are above. The last one is the honest tell: on PigeonAtlas none of it is configurable, because there is nowhere else it could go.