The Email API With
Compliance Built In.
Stop treating compliance as an afterthought. ApexMail includes GDPR workflow APIs, HIPAA BAA lifecycle tooling, SOC 2 evidence workflows, and generated SIG, CAIQ, and HECVAT answer packs for Enterprise customers.
- Consent tracking and management across 6 consent types
- SIG, CAIQ, and HECVAT answer packs generated from Trust Portal evidence
- Right-to-be-Forgotten erasure workflow with audit events
Compliance Workflows
Enterprise Compliance Workflows
Track audit events, manage DSR requests, record consent, and generate security-review answer packs from live evidence.
Questionnaire Automation
| Framework | Generated Output | Evidence Sources | Audit Artifact |
|---|---|---|---|
| SIG | Normalized answer pack | SOC 2 controls, Trust Portal docs, incidents | SHA-256 hash |
| CAIQ | Cloud-control mapped answers | Access, encryption, logging, subprocessors | Evidence manifest |
| HECVAT | Higher-ed security review pack | HIPAA BAA state, privacy, consent, continuity | Markdown report |
Audit Trail
| Timestamp | Actor | Action | Resource | IP Address |
|---|---|---|---|---|
| 2025-01-15 14:23:01 UTC | admin@acme.com | api_key.create | key_prod_****7f2a | 203.0.113.42 |
| 2025-01-15 14:18:33 UTC | ops@acme.com | domain.verify | mail.acme.com | 198.51.100.8 |
| 2025-01-15 13:55:12 UTC | dpo@acme.com | rtbf.execute | user_****3e9f | 192.0.2.17 |
| 2025-01-15 13:41:07 UTC | system | webhook.deliver | wh_****a1b2 | — |
Right to Be Forgotten (RTBF)
Data subject submits erasure request via API or dashboard
Identity verification and scope confirmation
Execute scoped erasure across configured data stores
Log completion evidence for compliance review
Consent Ledger
| Subject | Purpose | Status | Granted | Expires |
|---|---|---|---|---|
| user_****3e9f | Transactional email | Active | 2024-06-01 | 2025-06-01 |
| user_****a1b2 | Marketing email | Revoked | 2024-03-15 | — |
| user_****7f2a | Analytics tracking | Active | 2024-09-20 | 2025-09-20 |
Data Processing Agreements on Autopilot
Prepare DPA workflows with maintained clauses, jurisdiction context, processing activities, and a signature request path for legal review.
- Customized to your jurisdiction and processing activities
- Includes declared processing activities
- Standard Contractual Clauses (SCCs) included
- Versioned and timestamped for audit trails
- Document package available for legal review
Ready to Sleep Better at Night?
ApexMail provides compliance-critical email infrastructure with GDPR workflows, SOC 2 evidence automation, HIPAA BAA lifecycle tooling, and generated SIG, CAIQ, and HECVAT answer packs.
Security documentation, control evidence, and SIG/CAIQ/HECVAT answer packs are available during Enterprise review.
Contact compliance@apexmail.ee for a hashed security-review report.