How eusend keeps your email data in the EU

When we say "EU email infrastructure," we don't mean an EU region of an American cloud. We mean European providers, under European ownership, running software we operate ourselves. This post is a short tour of what actually happens when you call our API.

The path of an email

You POST /emails, and everything after that stays on European machines:

curl -X POST https://api.eusend.dev/emails \
  -H "Authorization: Bearer eu_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "from": "receipts@yourdomain.com",
    "to": "customer@example.com",
    "subject": "Your receipt",
    "html": "<p>Thanks for your order!</p>"
  }'

The API server validates and queues the message, a worker renders and signs it (DKIM keys are encrypted at rest with AES-256-GCM), and our own mail transfer agent — KumoMTA, running on hardware in Falkenstein — delivers it to the recipient's inbox. No third-party relay ever sees the message.

Where things live

Component	Software/Provider	Location
API + workers	Our stack, on Hetzner	Nuremberg, Germany
Database	PostgreSQL 18, managed by UpCloud	Frankfurt, Germany
Mail delivery	KumoMTA, on Hetzner	Falkenstein, Germany
Object storage	UpCloud	Helsinki, Finland

Why European providers, not an EU region?

Because an "EU region" of a US cloud provider is still subject to US law — the CLOUD Act doesn't care where the data centre is. What matters isn't only where the disk sits, but who can be compelled to reach for it. Hetzner is German, UpCloud is Finnish; neither has a US parent to be served an order through.

That's the line we hold for your email data — recipients, message content, delivery events, attachments. It lives on those four rows and nowhere else.

We're not going to claim more than that. A few US-owned services sit around the product: Cloudflare handles DNS and the edge in front of the site, Sentry (in its EU region) collects our error traces, and Polar is the seller of record for billing. This website and the dashboard used to be served from Vercel; since September 2026 they run on our own machine in Frankfurt, alongside everything else. None of them store your recipient lists or the mail you send. One caveat, stated plainly: because Cloudflare sits in front of the dashboard, the pages you view there — which can show recipients and message content — pass through its network in transit, and so do the bounce and complaint reports mailbox providers send about your mail. The sending API itself does not go through Cloudflare. The full list, with what each one does and the transfer safeguard it relies on, is on our sub-processors page — and it's the page we'd rather you judge us by than any sentence on a landing page.

Sovereignty isn't a compliance checkbox. It's an architecture decision you make on day one.

The trade-off is real: we run our own MTA, our own deliverability tooling. We think it's worth it, and we'll write about the messy parts here too — IP warming, bounce classification, and what it takes to keep a self-hosted MTA off the blocklists.

Why billing goes through a US company

Polar is the seller of record for eusend. Although it was founded by Swedes, it operates as a US-based company and is built on top of Stripe. When you upgrade, you are buying from Polar, which handles the payment, the invoice and the VAT, and resells the subscription to you on our behalf. That makes Polar an independent controller of your billing data, not a processor of your email data.

What Polar sees: your name, email address, billing address, any tax ID you give it, your payment method, and — if you turn on overage — a single number per month: how many emails you sent above your plan.

What Polar never sees: the emails you send, who you send them to, your contacts, your domains, your logs or your API keys. None of that leaves the infrastructure in the table above.

If you pay by card, your payment travels over Visa or Mastercard, both American, whichever provider sits in front of them. Europe's own alternatives — SEPA Direct Debit, Wero — exist but aren't yet what most customers pay with. That doesn't make Polar's role the same as a card network's, which is why we spell out what it holds above.

We chose a seller of record because selling software across the EU means collecting and filing VAT in every member state. A seller of record does that job for us. Polar was the one with the developer experience and usage-based billing we needed. We looked at European alternatives, but the EU-based ones we considered came with higher payout fees or a shakier track record.

That is a trade-off, not a principle, and we want to be fully transparent about it. Once a European seller of record matches what Polar does, we'll move. If it's a blocker for you today, talk to us and we'll look at alternative methods of payment.

What's next

This blog is where we'll publish engineering notes like this one, plus product updates. If you're building something that needs email and you'd rather it stayed in Europe, create an account — signups are open.