Security / trust page (GDPR) — Resend

Cited by

Facts read from this source

• GDPR compliant Report an error

  “Resend is GDPR compliant.”

• GDPR self audit Report an error

  “Unlike SOC 2 or ISO 27001, GDPR is not a best practice standard but rather a law. Because of this, most companies self-audit to align their operations and technology with the GDPR controls. Resend followed this approach.”

• Vanta monitoring Report an error

  “Resend also uses Vanta to monitor all GDPR controls and organize evidence for compliance.”

• DPA automatic Report an error

  “A GDPR Article 28 Data Processing Addendum is in force for every Resend account. It is pre-signed by Resend and fully executed once you sign up, so there is no separate counter-signature step.”

• DPA signed copy download Report an error

  “You can download the signed copy from the Documents page (login required). The unsigned reference version is our public DPA.”

• Countryspecific DPA not offered Report an error

  “No. We don't sign third-party or country-specific data processing agreements or standard contracts, including Brazil LGPD / ANPD standard contractual clauses and the Türkiye KVKK Standard Contract, and we can't attach them as annexes to our DPA.”

• DPA includes EU sccs Report an error

  “Our standard DPA applies to every account on any plan. It's pre-signed and executed when you sign up, includes the EU Standard Contractual Clauses for cross-border transfers, and can be downloaded from the Documents page (login required).”

• Data storage location Report an error

  “Resend stores customer data in the United States, including message content, delivery logs, webhook payloads, and account records.”

• Sending region scope Report an error

  “The region you select when adding a sending domain (for example, eu-west-1) controls where email is routed and sent from. It does not control where data is stored, and there is no setting today that moves stored data to the EU.”

• Transfer mechanisms Report an error

  “Transfers to the United States are covered by the Standard Contractual Clauses in our DPA and by our participation in the EU-U.S. Data Privacy Framework (including the UK Extension).”

• UK swiss transfers Report an error

  “UK transfers use the UK Addendum. Swiss transfers use the EU SCCs with the modifications described in the DPA.”

• Retention saas plans Report an error

  “While your account is active, email and log data is retained for 30 days on Free, Pro, and Scale plans. Enterprise plans include flexible data retention.”

• Deletion after termination Report an error

  “When you terminate your use of the Services, remaining customer data is deleted within 90 days of account termination, as described in Exhibit A of the DPA.”

• Backup retention Report an error

  “Backups persist for 7 days. See Security for backup and encryption details.”

• Change notice Report an error

  “We give at least 14 days' written notice before adding or replacing a sub-processor, so you can object before the change takes effect.”

• Resend liability Report an error

  “Resend remains liable for sub-processor performance. See Section 4 of the DPA.”

• Anthropic usage Report an error

  “Anthropic receives content only when you use the AI Editor, or content you choose to share with the in-app AI Support Agent. Normal sending through the Emails API is not sent to Anthropic.”

• Runpod usage Report an error

  “RunPod processes a small sample of emails for trust and safety, on dedicated infrastructure that Resend operates.”

• No training on customer content Report an error

  “Neither Resend nor these subprocessors use customer content to train or fine-tune models. Both are listed on our subprocessors page.”

• Breach notification Report an error

  “If a personal data breach occurs, Resend will inform you without undue delay and cooperate so you can meet any obligation to notify a supervisory authority or affected data subjects.”

• Data subject requests Report an error

  “For Customer Data processed through the Service, you are responsible for responding to data subject requests. If Resend receives a request about your data, we will direct the person to you and, where you cannot respond without our help, assist you in accordance with Section 7 of the DPA.”

• Encryption Report an error

  “Resend encrypts data at rest (AES-256) and in transit (TLS 1.3 or higher).”

• Pentest annual Report an error

  “We run annual third-party penetration tests; the Letter of Attestation is on the Documents page.”

• SOC 2 type2 Report an error

  “Resend is also SOC 2 Type II compliant.”

• Controller roles Report an error

  “With regard to Customer Data, Resend is a processor and you may act as a controller or a processor. Resend is an independent controller only for account, billing, and usage data, as described in the Privacy Policy.”

• CCPA service provider Report an error

  “For California Consumer Privacy Act (CCPA) purposes, Resend is a service provider and does not sell personal information provided by customers.”

• HIPAA not available Report an error

  “No. Resend is not HIPAA compliant and cannot sign a Business Associate Agreement.”

• ISO 27001 not certified Report an error

  “Resend holds SOC 2 Type II, not an ISO 27001 certificate.”

• DPA changes require enterprise Report an error

  “Please note that requesting changes to our DPA or other legal documents requires an Enterprise Plan.”

• Address Report an error

  “2261 Market Street #5039 San Francisco, CA 94114”

Scores citing this record

• The Agency Lead Message data, retention & security
• The Agency Lead European sovereignty
• The Data Protection Officer Message logs, events & webhooks
• The Data Protection Officer Message data, retention & security
• The Data Protection Officer European sovereignty
• The Shop Operator Message logs, events & webhooks
• The Shop Operator Message data, retention & security
• The Shop Operator European sovereignty
• The Platform Engineer Message data, retention & security
• The Platform Engineer European sovereignty
• The SaaS Developer Message logs, events & webhooks
• The SaaS Developer Message data, retention & security
• The SaaS Developer European sovereignty
• The Skeptic Message data, retention & security
• The Skeptic European sovereignty