Q: Do you store my email content?
MailerLogic stores only the data required to process and deliver your emails:
- Email metadata (sender, recipient, subject, timestamps)
- Delivery events (queued, sent, delivered, opened, clicked, bounced, complained)
- Diagnostic information for deliverability troubleshooting
Email bodies and attachments are stored temporarily during processing and transmission and are automatically purged once delivery is complete, based on your retention policy.
Enterprise customers may configure:
- Content retention windows as low as 0–1 hours
- Metadata-only mode (no body persistence)
- EU-only processing for GDPR-aligned workloads
This approach follows SOC 2 data minimization principles and GDPR Article 5(1)(c).
Q: Where is my data stored?
MailerLogic runs entirely on AWS infrastructure. Your data is stored exclusively within the region assigned to your account.
Primary GDPR Region (EU customers):
- 🇩🇪 EU-CENTRAL-1 – Frankfurt, Germany
- Frankfurt is our dedicated GDPR-aligned region and preferred by many organizations due to Germany's strong data protection laws and regulatory environment.
Other supported regions:
- 🇺🇸 US-EAST-1 – Virginia, USA (default for global customers)
Data remains within the chosen region unless you explicitly configure cross-regional exports or webhook endpoints outside that region.
Q: Are you SOC 2 compliant?
MailerLogic is built on BrainCert's established SOC 2 Type II–audited operational framework. This includes:
- Strict access control and least-privilege policies
- Continuous monitoring and log aggregation
- Secure SDLC and code review workflows
- Formal incident response and change-management processes
- Annual third-party audits and penetration tests
MailerLogic inherits these controls and upholds the same standards for security, confidentiality, and availability.
SOC 2 reports are available to Enterprise customers under NDA.
Q: Is MailerLogic GDPR compliant?
Yes. MailerLogic supports GDPR compliance through:
- EU data residency (Frankfurt region)
- Data minimization: only required metadata is retained
- Right to erasure: deletion of logs, metadata, and events upon request
- Data Processing Addendum (DPA) available to all customers
- Encryption in transit and at rest for all stored and transmitted data
- No profiling, data sharing, or secondary use of customer information
MailerLogic acts as a Data Processor, while you (the customer) remain the Data Controller.
Q: How is my data protected?
We enforce strong encryption and multi-layer security controls:
- TLS 1.2+ for all SMTP & API communications
- AWS KMS (AES-256) encryption for all data at rest
- Automated backups stored within the same region
- Per-tenant isolation for API activity, logs, and sending infrastructure
- Continuous monitoring for anomalies and abuse
- WAF + rate-limiting + threat detection at the edge
Internal access is restricted, audited, logged, and regularly reviewed.
Q: Who can access my data?
Only a limited set of authorized MailerLogic engineers may access metadata for:
- Deliverability analysis
- Abuse or fraud detection
- Security investigations
- Customer-requested troubleshooting
Access is governed by SOC 2 controls, MFA, just-in-time access, and extensive logging. MailerLogic never sells data or shares it with third parties.
Q: How long do you retain logs and events?
Default retention policies:
- Message events: 30 days
- Delivery logs: 7–30 days
- Webhook logs: 7 days
- Message content: purged immediately after processing (unless retention is configured)
Enterprise customers can configure custom retention periods from 1 day to 1 year.
Q: Do you provide email authentication and anti-abuse controls?
Yes. MailerLogic enforces:
- SPF, DKIM, DMARC validation
- Optional BIMI
- Automated IP/domain warm-up
- Real-time spam scoring
- Throttling and anomaly detection
- Bounce, complaint, and reputation monitoring
Accounts may be rate-limited or paused if unusual or harmful activity is detected to protect IP reputation and deliverability.
Q: Do you sign DPAs and support GDPR audits?
Yes. We provide:
- Data Processing Addendum (DPA)
- GDPR-compliant contractual terms
- Details on sub-processors
- Support for DPIAs (Data Protection Impact Assessments)
- Assistance with customer compliance questionnaires
Q: Do you undergo third-party security testing?
Yes. MailerLogic undergoes:
- Annual third-party penetration testing
- Continuous vulnerability scanning
- Code dependency security monitoring
- Periodic red-team exercises as part of BrainCert's SOC 2 program
Pen test reports can be shared with Enterprise customers under NDA.
Q: Can I rotate my API key?
Yes, use the /api/customer/rotate-key endpoint. The old key is invalidated immediately, so update all applications with the new key.
Q: Can I rotate my SMTP password?
Yes, use the /api/smtp-credentials/rotate endpoint with your X-API-Key header.
Q: How do I implement unsubscribe?
We automatically add:
- List-Unsubscribe header (standard email client unsubscribe)
- One-click unsubscribe (RFC 8058 compliant)
- Unsubscribe link
You can also manage suppressions via API.