Email API data residency means where your provider keeps the email you send through it. Mailfully is a US-based email API. We send from servers in the United States, and we store account data, email logs and received mail there too.
An email API can keep much more than a delivery receipt. Mailfully stores the sender and recipient addresses, subject line, message body and attachment details for every email, so you can open the debug log and see exactly what was sent. That's handy when a customer swears the password reset never arrived. It also means your customers' data lives on our servers for a while, and anyone running a vendor review will want to know where.
Location is one of five questions worth asking any provider. Here are all five, with Mailfully's answers.
Key takeawaysAn email API can keep full message content for a retention window, so ask where it's stored and for how long.Ask separately about sending, stored logs, received mail, subprocessors and deletion.Mailfully's sending servers, API and dashboard are in the United States, and account data, email logs and received mail are stored there, encrypted at rest.US hosting answers the location question only. It isn't a SOC 2 report or a HIPAA agreement.
1. Where are your emails sent from?
Mailfully's sending servers, API and dashboard are all hosted in the United States, so every email you send through us leaves from the US.
When you ask other providers, ask about sending and storage separately. A provider can store your logs in one country and send from another.
2. Where are message content and logs stored, and for how long?
Mailfully stores message content and logs in the United States, encrypted at rest. They're kept for your plan's retention window: 30 days on Free, Starter and Growth, and 90 days on Scale. Growth plans bought before October 19, 2026 keep 60 days. After the window, message content ages out of the log. Plans are on the pricing page.
Your suppression list is the one exception, and it's on purpose. An address that hard-bounced or filed a complaint stays suppressed after the window closes, because deleting that record would mean mailing the address again.
For any provider, ask whether they keep the full message or only delivery events, and how long the window is on your plan.
3. Where does received mail go?
If you use inbound email with Mailfully, received mail, its attachments and the raw message are stored in the United States, encrypted at rest. They're deleted at the end of your plan's retention window, the same 30 or 90 days as sent mail.
Inbound mail is written by people outside your company, like customers replying to support or vendors sending receipts. If your provider receives mail for you, put it on the review list.
4. Who else handles your data?
Mailfully lists every subprocessor, what it does and the data it receives in our privacy policy. We give notice before adding one that handles customer message data, so you can object. We don't sell personal data, and we don't use your email or your recipients' data to train machine-learning models.
The subprocessor list is where a provider's data map gets wider than its own servers. Read it, and check where each service runs if your review needs that level of detail.
5. What happens to your data when you leave?
You can export your message logs and suppression list from the Mailfully dashboard at any time. To delete an organization, email privacy@mailfully.com and we'll do it for you.
After a deletion we keep a record of it: the organization's name, its members' email addresses, the domains it added, the IP address it signed up from, and the date and reason. If you also ask us to erase your data, that record shrinks to the fact that a deletion happened and when, except for accounts closed for abuse. Billing records held by our payment processor and backups stay until their own retention ends. The privacy policy covers each one.
Ask every provider the same thing: what's deleted, what's kept, and for how long.
What US hosting doesn't cover
Mailfully doesn't have a SOC 2 or ISO 27001 report yet, and we don't sign HIPAA business associate agreements. If your review requires those, US hosting won't get you through it on its own, and we'd rather you know that before you sign up.
What we do have is on our security page. The API and dashboard answer over HTTPS only. API keys are stored as hashes and shown once, and a key can be read-only or tied to one sending domain. Webhooks are signed so you can check a request came from us.
Try it
If your vendor review asks where email data lives, Mailfully's answer is the United States for sending, logs and received mail. Check the subprocessor list for the services around it. The free plan includes 3,000 emails a month, and test mode lets you try the API without delivering to a real inbox. Start free.