How eusend keeps your email data in the EU

When we say "EU email infrastructure," we don't mean an EU region of an American cloud. We mean European providers, under European ownership, running software we operate ourselves. This post is a short tour of what actually happens when you call our API.

The path of an email

You POST /emails, and everything after that stays on European machines:

curl -X POST https://api.eusend.dev/emails \
  -H "Authorization: Bearer eu_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "from": "receipts@yourdomain.com",
    "to": "customer@example.com",
    "subject": "Your receipt",
    "html": "<p>Thanks for your order!</p>"
  }'

The API server validates and queues the message, a worker renders and signs it (DKIM keys are encrypted at rest with AES-256-GCM), and our own mail transfer agent — KumoMTA, running on hardware in Falkenstein — delivers it to the recipient's inbox. No third-party relay ever sees the message.

Where things live

Component	Software/Provider	Location
API + workers	Our stack, on Hetzner	Nuremberg, Germany
Database	PostgreSQL 18, managed by UpCloud	Frankfurt, Germany
Mail delivery	KumoMTA, on Hetzner	Falkenstein, Germany
Object storage	UpCloud	Helsinki, Finland

Why European providers, not an EU region?

Because an "EU region" of a US cloud provider is still subject to US law — the CLOUD Act doesn't care where the data centre is. What matters isn't only where the disk sits, but who can be compelled to reach for it. Hetzner is German, UpCloud is Finnish; neither has a US parent to be served an order through.

That's the line we hold for your email data — recipients, message content, delivery events, attachments. It lives on those four rows and nowhere else.

We're not going to claim more than that. A few US-owned services sit around the product: Vercel serves this website and the dashboard front-end, Cloudflare handles DNS and the edge in front of them, Sentry (in its EU region) collects our error traces, and Polar is the seller of record for billing. None of them receive your recipient lists or the mail you send. The full list, with what each one does and the transfer safeguard it relies on, is on our sub-processors page — and it's the page we'd rather you judge us by than any sentence on a landing page.

Sovereignty isn't a compliance checkbox. It's an architecture decision you make on day one.

The trade-off is real: we run our own MTA, our own deliverability tooling. We think it's worth it, and we'll write about the messy parts here too — IP warming, bounce classification, and what it takes to keep a self-hosted MTA off the blocklists.

What's next

This blog is where we'll publish engineering notes like this one, plus product updates. If you're building something that needs email and you'd rather it stayed in Europe, create an account — signups are open.