The Email API That’s
Compliance-Ready, EEA-Hosted.
Treat compliance as a current, documented operating concern. ApexMail includes GDPR-oriented workflow APIs, audit-capable plans, and security-review material for Enterprise evaluation. HIPAA availability and SOC 2 certification are not currently offered.
- Consent tracking and management across 6 consent types
- Security-questionnaire requests assessed case by case from current review material — no standardized SIG, CAIQ, or HECVAT pack is a product entitlement
- Right-to-be-Forgotten erasure workflow with audit events
Compliance Workflows
How long we keep your data
We retain personal data only as long as necessary for the purposes it was collected. Retention windows per data category are summarized below; Enterprise contracts can extend event and email-content retention as described in your agreement.
| Data Category | Retention Period |
|---|---|
| Account data | Duration of contract + 30 days |
| Billing records | 7 years (Estonian accounting law) |
| Email content | 7 days by default (plan-dependent, up to 730 days for Enterprise) |
| Event logs | 30 days by default (7 days on the Free plan); plan-dependent, up to 730 days for Enterprise |
| Support tickets | 2 years after resolution |
Retention is enforced by automated job schedules; deletions are recorded in the audit trail. See our privacy policy for the data-subject rights that apply alongside these windows.
Enterprise Compliance Workflows
Track audit events, manage DSR requests, record consent, and generate security-review answer packs from live evidence.
Questionnaire Automation
| Framework | Generated Output | Evidence Sources | Audit Artifact |
|---|---|---|---|
| SIG | Normalized answer pack | Security control mapping, current documentation, and incident information | SHA-256 hash |
| CAIQ | Cloud-control mapped answers | Access, encryption, logging, subprocessors | Evidence manifest |
| HECVAT | Higher-ed security review pack | Privacy, consent, continuity, and current service-status information | Markdown report |
Audit Trail
| Timestamp | Actor | Action | Resource | IP Address |
|---|---|---|---|---|
| 2025-01-15 14:23:01 UTC | admin@acme.com | api_key.create | key_prod_****7f2a | 203.0.113.42 |
| 2025-01-15 14:18:33 UTC | ops@acme.com | domain.verify | mail.acme.com | 198.51.100.8 |
| 2025-01-15 13:55:12 UTC | dpo@acme.com | rtbf.execute | user_****3e9f | 192.0.2.17 |
| 2025-01-15 13:41:07 UTC | system | webhook.deliver | wh_****a1b2 | — |
Right to Be Forgotten (RTBF)
Data subject submits erasure request via API or dashboard
Identity verification and scope confirmation
Execute scoped erasure across configured data stores
Log completion evidence for compliance review
Consent Ledger
| Subject | Purpose | Status | Granted | Expires |
|---|---|---|---|---|
| user_****3e9f | Transactional email | Active | 2024-06-01 | 2025-06-01 |
| user_****a1b2 | Marketing email | Revoked | 2024-03-15 | — |
| user_****7f2a | Analytics tracking | Active | 2024-09-20 | 2025-09-20 |
Data Processing Agreements on Autopilot
Prepare DPA workflows with maintained clauses, jurisdiction context, processing activities, and a signature request path for legal review.
- Customized to your jurisdiction and processing activities
- Includes declared processing activities
- Standard Contractual Clauses (SCCs) included
- Versioned and timestamped for audit trails
- Document package available for legal review
Ready to Sleep Better at Night?
ApexMail provides email infrastructure with GDPR-oriented workflows, audit-capable plans, and a factual security-review process. HIPAA availability and SOC 2 certification are not currently offered.
Current security documentation and applicable questionnaire material can be reviewed during an Enterprise evaluation.
Contact compliance@apexmail.ee for the current review materials.