EU-resident sending, encryption in transit everywhere, transparent sub-processors, and GDPR compliance by design. Everything your procurement team needs in one place.
Email delivery runs on AWS SES eu-west-1 (Ireland) as primary, with Scaleway TEM (fr-par, France) as the second provider; failover works where a domain is authenticated with both. Both legs send from EU regions.
Application database hosted in Supabase eu-central-1 (Frankfurt). Delivery metadata, account data, and event logs are stored there, in the EU.
Outbound email sends via AWS SES in Ireland (eu-west-1), failing over to Scaleway TEM in France (fr-par) when SES is unavailable — both EU-resident. Circuit breakers detect failures fast and surface the exact error — no silent failures.
Hosted on Vercel. API functions run in the fra1 region (Frankfurt); pages are served from Vercel's global edge network, and SCCs govern any non-EU processing.
All API traffic is encrypted with TLS. SMTP delivery uses opportunistic TLS with STARTTLS.
Delivery metadata, account data and event logs are stored in Supabase Postgres (eu-central-1), encrypted at rest with AES-256 by the storage layer. Rate-limit and circuit-breaker counters in Upstash Redis (eu-central-1) are not encrypted at rest; they hold API-key identifiers, sending-domain names and integer counters only. Truncus adds no second encryption layer of its own; we name the mechanism rather than implying one we built.
API keys are hashed with SHA-256 before storage. Plain-text keys are shown once at creation and never stored.
All webhook payloads are signed with HMAC-SHA256. Verification is documented in the manual.
| Data type | Retention | Notes |
|---|---|---|
| Email content | 7 days | Processed in transit; stored only for delivery retry window |
| Delivery metadata | 90 days | Bounce codes, delivery timestamps, complaint flags |
| Engagement data | 90 days | Open and click events (if tracking enabled) |
| Account data | Active + 30 days | Deleted within 30 days of account termination |
| Billing records | 7 years | Required by Dutch law |
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| AWS SES | Email delivery (primary) | EU (eu-west-1, Ireland) | No international transfer |
| Scaleway TEM | EU failover email delivery where a domain is authenticated with both providers | EU (fr-par, France) | No international transfer |
| Supabase | Database | EU (eu-central-1, Frankfurt) | No international transfer |
| Clerk | Authentication | United States | SCCs |
| Stripe | Payments | United States | SCCs |
| Vercel | Application hosting | US / EU edge | SCCs |
| Cloudflare | DNS for truncus.co and inbound email routing for info@truncus.co | US / global edge | SCCs |
| Upstash | Rate-limit counters, breaker state (no email content, recipients or IPs) | EU (Frankfurt); US parent | SCCs |
| Telegram | Internal alerts, Van Moose domains only (no customer data) | Non-EU | No customer data |
| AWS Route 53 | DNS hosting for customer subdomains delegated to Truncus (DNS records only; no email content) | Global service; US parent (SCCs apply) | SCCs |
| Google Workspace | Our support mailbox: email sent to info@truncus.co and internal operational notifications, which can contain account email addresses and sending-domain names (no customer email content) | US parent (SCCs apply) | SCCs |
Changes to this list are communicated in advance per DPA Section 9. Enterprise customers requiring a countersigned DPA can request one at legal@truncus.co.
Truncus is a Van Moose product, Amsterdam. We process data under GDPR Article 28 as a data processor.
In the event of a data breach affecting customer data, we notify within 72 hours per GDPR Article 33.
We assist with access, rectification, erasure, restriction, portability, and objection requests within 72 hours.
Real-time delivery metrics, provider health, and platform status available at truncus.co/status with a JSON API.
Contact us at security@truncus.co or legal@truncus.co for procurement inquiries.
Start free