Data processing agreement (dpa) — Mailtrap Email API/SMTP

Cited by

Facts read from this source

• Entity Report an error

  “Railsware Products Studio LLC (t/a Mailtrap) incorporated and registered in the State of Delaware, United States of America, with the company registration number 4461258, whose company business address is at 117 E Colorado Blvd, Suite 600, Office 650, Pasadena, CA 91105.”

• Effective date Report an error

  “Railsware Products Studio LLC Data Processing Addendum Effective: 24 September, 2026”

• Roles Report an error

  “the Customer is the Controller and Mailtrap is the Processor of the Customer Personal Data;”

• Dpf Report an error

  “Mailtrap complies with the DPF as set forth by the U.S. Department of Commerce. The guaranties provided under DPF shall apply to international transfers of Customer Personal Data between Mailtrap and the Customer as such transfers are from the UK or EEA to the United States of America.”

• Scc EU Report an error

  “Mailtrap and the Customer agree that the execution of this DPA constitutes the incorporation by reference and execution of the EU Standard Contractual Clauses and/or the UK Standard Contractual Clauses only if so required by the Data Protection Legislation.”

• List Report an error

  “Sub-Processor List: the list of Mailtrap’s Sub-Processors online linked to here – https://mailtrap.io/sub-processors/ as may be amended from time to time.”

• Objection period Report an error

  “the Sub-Processor is listed in the Sub-Processor List or the Customer is provided with an opportunity to object to the appointment of any new Sub-Processor within 72 hours after Mailtrap provides the Customer with details in writing regarding such new Sub-Processor;”

• Liability Report an error

  “Where a Sub-Processor fails to fulfil its obligations under the written agreement with Mailtrap which contains terms substantially the same as those set out in this DPA, Mailtrap remains fully liable to the Customer for the Sub-Processor’s performance of its agreement obligations.”

• Breach notification Report an error

  “Mailtrap will promptly notify the Customer if it becomes aware of: 6.1.1. the loss, unintended destruction or damage, corruption, or unusability of part or all of the Customer Personal Data. Mailtrap will restore such Customer Personal Data at its own expense (to the extent that such restoration is technically feasible) promptly;”

• Breach expenses Report an error

  “Mailtrap will also reimburse the Customer for actual reasonable documented expenses that the Customer incurs when responding to an incident of accidental, unauthorised or unlawful processing and/or a Personal Data Breach to the extent that Mailtrap caused such, including all costs of notice and any remedy as set out in clause 6.5.”

• Return deletion Report an error

  “securely delete or destroy or, if directed in writing by the Customer, return and not retain, all or any of the Customer Personal Data related to this DPA in its possession or control within 30 days upon receipt of Customer’s written direction or termination of the Terms of Service.”

• Deletion certificate Report an error

  “Mailtrap will certify in writing to the Customer that it has destroyed, destroyed or returned the Customer Personal Data, as the case may be, promptly upon written request by the Customer.”

• Audit Report an error

  “Mailtrap will permit the Customer and/or its third party representatives to conduct reasonable audits of Mailtrap’s compliance with its obligations under this DPA, on reasonable written notice at a frequency of not more than once per year at the Customer’s expense.”

• Records Report an error

  “Mailtrap will keep detailed, accurate and up-to-date written records regarding any processing of the Customer Personal Data, including but not limited to, the access, control and security of the Customer Personal Data, approved Sub-Processors, the processing purposes, categories of processing, any transfers of Personal Data to a third country and related safeguards, and a general description of the technical and organisational security measures referred to in 5.1 (Records).”

• CCPA Report an error

  “Mailtrap acknowledges that it is acting as a Service Provider (as defined by the CCPA/CPRA) with respect to the Customer’s Personal Information processed under this DPA.”

• CCPA no sale Report an error

  “Mailtrap shall not Sell or Share the Customer’s Personal Information.”

• Abuse detection AI Report an error

  “That processing may include automated and AI-assisted analysis of the content of emails sent through the Service that has been flagged by Mailtrap’s abuse-detection systems, or that is sent from an Account showing indicators of abuse.”

• Personnel confidentiality Report an error

  “Mailtrap will ensure that all Mailtrap Personnel: 4.1.1. are informed of the confidential nature of the Customer Personal Data and are bound by confidentiality obligations and use restrictions in respect of the Customer Personal Data; and”

• Assistance dpo Report an error

  “Mailtrap will reasonably assist the Customer, at the Customer’s cost, with meeting the Customer’s compliance obligations under the Data Protection Legislation, taking into account the nature of Mailtrap’s processing and the information available to Mailtrap, including in relation to Data Subject rights, data protection impact assessments and reporting to and consulting with the Commissioner or other relevant regulator under the Data Protection Legislation.”

• Encryption Report an error

  “Encryption of user emails using the AES256 algorithm.”

• Hosting aws certifications Report an error

  “Use of AWS hosting that is in compliance with: SOC 1/ISAE 3402, SOC 2, SOC 3 FISMA, DIACAP, and FedRAMP PCI DSS Level 1 ISO 9001, ISO 27001, ISO 27017, ISO 27018”

• Hosting google certifications Report an error

  “Use of Google hosting that is in compliance with: FedRAMP HIPAA SOC 1, SOC 2, SOC 3”

• Pci billing Report an error

  “Store billing data of customers in an external PCI compliant provider.”

• Tls Report an error

  “SSL and TLS to transfer all data securely over a computer network.”

• Key management Report an error

  “Secret management using AWS KMS, Google KMS, AWS parameter store, Chef vault with encryption of all data.”

• Access control Report an error

  “Implementation of policy on access- and user-roles using AWS IAM.”

• Signed copy Report an error

  “Click here to get a signed copy”

Scores citing this record

• The Agency Lead Message data, retention & security
• The Agency Lead European sovereignty
• The Data Protection Officer Message data, retention & security
• The Data Protection Officer European sovereignty
• The Shop Operator Message data, retention & security
• The Shop Operator European sovereignty
• The Platform Engineer Message data, retention & security
• The Platform Engineer European sovereignty
• The SaaS Developer Message data, retention & security
• The SaaS Developer European sovereignty
• The Skeptic Message data, retention & security
• The Skeptic European sovereignty