Security & Compliance

Built to pass your security review.

EU-only email delivery, encryption everywhere, transparent sub-processors, and GDPR compliance by design. Everything your procurement team needs in one place.

Infrastructure

EU-only email delivery

All email delivery is processed in AWS SES eu-west-1 (Ireland). Email content never leaves the European Economic Area for delivery purposes.

EU database hosting

Application database hosted in Supabase eu-central-1 (Frankfurt). Delivery metadata, account data, and event logs stay in the EU.

Multi-provider failover

SES Ireland primary, Brevo France failover. Both providers operate within the EU. Circuit breakers route around unhealthy providers automatically.

Application hosting

Hosted on Vercel with EU edge compute. API requests are processed at the nearest edge location; SCCs govern any non-EU processing.

Encryption & access control

TLS in transit

All API traffic is encrypted with TLS. SMTP delivery uses opportunistic TLS with STARTTLS.

AES-256 at rest

All stored data — delivery metadata, account data, event logs — is encrypted at rest with AES-256.

Hashed API keys

API keys are hashed with SHA-256 before storage. Plain-text keys are shown once at creation and never stored.

Webhook signing

All webhook payloads are signed with HMAC-SHA256. Verification is documented in the manual.

Data retention

Data typeRetentionNotes
Email content7 daysProcessed in transit; stored only for delivery retry window
Delivery metadata90 daysBounce codes, delivery timestamps, complaint flags
Engagement data90 daysOpen and click events (if tracking enabled)
Account dataActive + 30 daysDeleted within 30 days of account termination
Billing records7 yearsRequired by Dutch law

Sub-processors

ProviderPurposeLocationTransfer basis
AWS SESEmail deliveryEU (eu-west-1, Ireland)No international transfer
SupabaseDatabaseEU (eu-central-1, Frankfurt)No international transfer
ClerkAuthenticationUnited StatesSCCs
StripePaymentsUnited StatesSCCs
VercelApplication hostingUS / EU edgeSCCs

Changes to this list are communicated in advance per DPA Section 9. Enterprise customers requiring a countersigned DPA can request one at legal@truncus.co.

Compliance & incident response

GDPR compliant

Van Moose BV is registered in Amsterdam, Netherlands (KvK: 97411698). We process data under GDPR Article 28 as a data processor.

72-hour breach notification

In the event of a data breach affecting customer data, we notify within 72 hours per GDPR Article 33.

Data subject rights

We assist with access, rectification, erasure, restriction, portability, and objection requests within 72 hours.

Public status page

Real-time delivery metrics, provider health, and platform status available at truncus.co/status with a JSON API.

Questions about security?

Contact us at security@truncus.co or legal@truncus.co for procurement inquiries.

Start free
Security — Truncus Email Execution Layer