Regions and security
You choose where email is processed.
Each domain has its own region, with São Paulo as the default. Protect login with two-step verification and learn what we store and for how long.
- São Paulo, United States, Ireland or Japan
- Two steps and sessions
- 30-day history
What Postal does
Where, how and for how long
Choose where emails are processed
Each domain has its own region. The default is São Paulo, and you can pick regions in the United States, Ireland or Japan when it makes sense for your audience.
See domains and DNSWhat lives where
The domain's region applies to the emails sent. Payments and the AI assistant are handled by vendors that may also process data outside Brazil. The Privacy Policy has the details.
Read the Privacy Policy- The region is set per domain and can't be changed later: to change it, add another domain
- Each domain can use a different region
- Emails also pass through the servers of the recipients' providers
Passwords and keys are never stored in plain text
We store only the hash of passwords and API keys, and we encrypt your domain's private DKIM keys. Connections use HTTPS and TLS.
- Signed webhooks, with blocking of internal network addresses
- TLS required on delivery, if you turn it on for the domain
LGPD: who is who, and for how long
Your contacts' data is yours: you are the controller and Postal acts as the processor, handling that data only to provide the service. We don't sell data or use the content of your emails for advertising or to train AI models.
Read the Privacy Policy- Requests for access, correction or deletion: through the contact form
- Data processing agreement (DPA) on request, through the contact form
- When you close the account, we delete or anonymize the data, except what the law requires us to keep
Your account, with and without extra protection
Each person can turn on two-step verification and see where their account is signed in.
Password only
- Anyone who finds out the password gets into the account
- No way to see where the account is signed in
- No one on the team knows who has secured their own login
Two steps and sessions
- Besides the password, login asks for a code from the authenticator app
- You can also sign in with a code sent to your email, no password
- Email alerts for sign-ins from a new device and changes to two-step verification
- Sensitive actions ask you to confirm it's you
- Every request made with an API key is recorded in the logs for 30 days
Frequently asked questions
Is all my data kept in Brazil?
It depends on the domain's region. Emails from domains in São Paulo are processed in Brazil; those from other regions, in the region's country. Payments and the AI assistant may also be processed outside Brazil. Section 5 of the Privacy Policy explains. For details on where the dashboard and database are hosted, talk to us through the contact form.
Do you use my emails to train AI?
No. The Privacy Policy states that email content and contact data are not used for advertising or to train AI models.
Can I request the data processing agreement (DPA)?
Yes. Request it through the contact form. It also appears in Settings, Documents.
How long do you keep emails?
Emails, webhook deliveries and API logs are kept for 30 days and then deleted automatically. Events sent by your app are kept for 90 days. If you need more history, store the events you receive through webhooks or use exports.