GDPR Compliant Email API with EU Data Residency

The controller-processor relationship is governed by whichever legal system can compel the processor. That is a function of where the processor is incorporated, not where its servers sit. A US-incorporated company operating a data center in Frankfurt is still a US company, answerable to US courts and US legal process.

Omnivery's parent company is incorporated in the Czech Republic, so EU law governs the group parent. That is a structurally different position from a provider whose parent company is itself American and merely offers an EU region.

Omnivery has a US office in Austin, Texas. It is a sales and commercial front. It performs no operations. All operations sit under the Czech entity, which owns and runs the platform, and that includes the US data centers - the machines serving US data residency are operated by the Czech entity, not by the US office. Contracting is usually by region, but the entity that processes your data is the Czech one in every case.

With Twilio or SendGrid, the entity holding the data is American. With Omnivery, the American office holds no customer data and operates nothing, so there is no US entity in possession, custody or control of it.

The Clarifying Lawful Overseas Use of Data Act allows US authorities to compel a US-based provider to produce data in its possession, custody or control regardless of the country in which that data is physically stored. This is the specific reason EU data residency alone does not resolve the question.

That test turns on possession, custody or control. The Act reaches data a US entity holds or controls; it does not manufacture a route to data no US entity holds.

If your email processor is SendGrid, the contracting entity is Twilio, a US company, and it holds your data - so the exposure is direct. If it is Mailgun or Mailjet, the group parent is Sinch AB of Sweden but Mailgun Technologies, Inc. is a US-incorporated subsidiary that operates part of the service, and Sinch states that it relies on the EU-U.S. Data Privacy Framework for it.

Omnivery's US office in Austin is a sales and commercial function only. It runs no infrastructure and holds no customer data. Every operation, including the US data centers, is run by the Czech entity. There is therefore no US entity with possession, custody or control of Omnivery customer data for a CLOUD Act request to attach to - which is a different and stronger position than an EU data center operated by an American company.

Where personal data is transferred to a third country, GDPR requires a lawful transfer mechanism plus, following Schrems II, a transfer impact assessment showing that the destination country's surveillance regime does not undermine the safeguards. In practice this means Standard Contractual Clauses, supplementary measures, and periodic reassessment as the legal position shifts. It is ongoing work, and it is work that never fully concludes.

Providers in the Sinch group state reliance on the EU-U.S. Data Privacy Framework for the US-incorporated part of the business. Frameworks of this kind have twice been invalidated by the Court of Justice of the European Union, in Schrems I and Schrems II. Building a compliance position on top of one means accepting the risk of having to rebuild it.

Omnivery's processing entity is the Czech company, so for an EU controller the relationship is EU to EU. There is no third-country transfer within it to legitimize, which removes the SCC and transfer-impact-assessment burden rather than leaving you to maintain it. Omnivery relies on no adequacy framework, so there is nothing in the arrangement that a future court decision can invalidate.

This holds even if you select US data residency, because the US data centers are operated by the Czech entity. Residency is a choice about where the machines are; it does not introduce a US processor.

Article 5(1)(c) requires that personal data be limited to what is necessary. The cleanest way for an email processor to satisfy it is to hold less data.

Omnivery never stores the content of email messages. The password reset link, the invoice, the medical appointment detail passes through and is not retained. Only delivery metadata is kept, for a maximum of 30 days, and strict privacy mode fully anonymizes that metadata. This is the platform's default behavior rather than a setting to locate and switch on, which matters because a default cannot be silently misconfigured back into a retention problem. Providers that store full message bodies and event histories leave you with a larger data set to inventory, secure, justify, and produce on a subject access request.

Article 28 makes the processor responsible for its sub-processors, and makes them your concern as controller. A provider running on a hyperscaler adds that hyperscaler to your compliance surface, along with whatever the hyperscaler subcontracts.

Omnivery operates on its own physical infrastructure, so the core email delivery service has no US sub-processors and no hyperscaler underneath it. The sub-processors that do exist relate to optional features you choose to enable, and every one of them processes in the EU.

Four things, in descending order of importance: the jurisdiction of the contracting entity, because that determines who can compel the processor; how much personal data the platform retains, because data minimization is easiest to satisfy by holding less; whether a third-country transfer mechanism is required; and whether the security of processing is independently certified. Data center location matters, but it is the weakest of the four - an EU data center operated by a US company does not remove US legal process from the picture.

No, and this is the most common misunderstanding. Data residency describes where data sits. Jurisdiction describes who can compel its production. The US CLOUD Act allows US authorities to require a US-incorporated provider to hand over data in its possession, custody or control regardless of the country where it is stored. A US provider offering an EU region has changed the storage location without changing the legal reach over it.

No. Omnivery's processing entity is the Czech company, so for an EU controller the relationship is EU to EU and contains no third-country transfer to legitimize. No SCCs and no transfer impact assessment are required for it, and Omnivery relies on no adequacy framework, so there is nothing a future court decision can invalidate. This remains true if you select US data residency, because the US data centers are operated by the Czech entity. You should still complete your own Article 28 due diligence and execute the Data Processing Agreement published at /legal/dpa.

No. The Austin office is a sales and commercial function. It runs no infrastructure and holds no customer data. Every operation is performed by the Czech entity, including the US data centers offered for US data residency. The CLOUD Act reaches data that a US entity has in its possession, custody or control, so with no US entity holding or controlling the data there is nothing for such a request to attach to. This is materially different from SendGrid, where the contracting and operating entity is Twilio, a US company, or from Mailgun and Mailjet, where the US-incorporated Mailgun Technologies, Inc. operates part of the service and Sinch relies on the EU-U.S. Data Privacy Framework for it.

There are no US sub-processors in the core email service. US-incorporated vendors apply only to optional, customer-selectable features. Specifically, the optional e-mail validation feature is provided by Bouncer Sp. z o.o., a Polish company, which processes in EU-based AWS cloud infrastructure in the Frankfurt region - so Amazon Web Services is a subprocessor of Bouncer, and Amazon is a US-headquartered group. If you do not enable validation, none of your data reaches either. The optional SMS feature uses ProfiSMS s.r.o., a Czech company. The full list with addresses, purposes and processing locations is published at Sub-processors.

Omnivery never stores the content of email messages, so personal data inside the message body is not retained by the processor at all. Only delivery metadata is kept, for a maximum of 30 days. A strict privacy mode is available that fully anonymizes message metadata. This is default platform behavior rather than a configurable option, which means it cannot drift back into a retention problem through misconfiguration.

SendGrid's contracting entity is Twilio, a US company, so the CLOUD Act applies and an EU controller needs a transfer mechanism. SendGrid stores email content, offers EU data residency only on higher tiers, and runs on AWS, which adds a hyperscaler to your sub-processor assessment. SendGrid holds ISO 27001 but does not publish ISO 27701 or HIPAA certification. Omnivery is an EU entity, stores no message content, caps metadata at 30 days, runs on its own infrastructure, and holds ISO 27701 and HIPAA alongside ISO 27001. See the detailed SendGrid alternative comparison.

Mailgun and Mailjet both sit under Sinch AB. Sinch's documentation states that Mailgun Technologies, Inc., a US-incorporated subsidiary, complies with the EU-U.S. Data Privacy Framework. Relying on an adequacy framework is lawful. This framework is, however, the successor to two arrangements that the Court of Justice of the European Union invalidated, in Schrems I and Schrems II. A compliance position built on a framework carries the risk of needing to be rebuilt. With an EU processor there is no framework in the chain to depend on.

Yes, more directly than ISO 27001. ISO 27001 covers information security management generally; ISO 27701 extends it specifically to the processing of personally identifiable information, which maps closely onto GDPR obligations. Omnivery holds both. Among transactional email providers, ISO 27701 is unusual - it is the certification that speaks to privacy management rather than security alone.

Yes. Omnivery holds ISO 27701 for privacy information management and publishes an independently issued HIPAA certificate, and its EU incorporation means GDPR obligations are met by an EU processor rather than through a transfer mechanism. For organizations handling both EU personal data and Protected Health Information, that avoids running two vendors. See HIPAA compliant email for the healthcare detail.

Yes. Omnivery offers EU or US data residency as a customer choice, on infrastructure it owns in both cases. Both are operated by the Czech entity, so selecting US residency changes where the machines are without changing who the processor is or which legal system governs it. That is the reverse of the usual arrangement, where a US company offers an EU region and the operator remains American.

Omnivery natively supports SendGrid API v3, Mailgun API v3 and SparkPost API v1. Update the API key and endpoint and the existing integration works. One-click migration is available from the dashboard and transfers suppression lists, bounces and unsubscribes. Kiwi.com completed a full migration from SendGrid and Mailgun in 45 minutes with zero code changes. Changing processor is usually less work than maintaining a transfer impact assessment.

The Data Processing Agreement is at /legal/dpa and the sub-processor list, with each entity's address, processing purpose and processing location, is at /legal/gdpr. The privacy policy covers Omnivery's own processing as a controller.