Data Handling & Security

This page describes how FormaMail handles your data throughout its lifecycle - from collection to deletion.

Security Measures

Data in Transit

All connections to FormaMail are secured via TLS through CloudFlare:

Additional protections:

• HSTS (HTTP Strict Transport Security) enforced via CloudFlare
• DDoS protection via CloudFlare
• Certificate transparency logging enabled

Credential Security

All sensitive credentials are hashed before storage:

Infrastructure Security

FormaMail uses a multi-cloud infrastructure with managed security:

API Key Security

API keys are handled securely:

• Keys are generated using cryptographically secure random number generators
• Only the first and last 4 characters are displayed in the dashboard
• Keys are hashed before storage (you cannot retrieve the full key after creation)
• Keys can be scoped to specific permissions

Data Retention

FormaMail implements a three-tier data retention system designed to balance functionality with data minimization and GDPR compliance:

Retention Tiers

Full Log Retention (30 Days)

During the first 30 days, full data is available including:

• Complete email metadata
• Recipient email addresses (for unsubscribes and tracking)
• Detailed engagement data (opens, clicks with timestamps)
• Full attachment job details

Archived Data (5 Years)

After 30 days, data is archived with the following changes:

• Recipient emails are removed - GDPR compliance, no PII stored
• Basic metrics preserved (sent count, status, error category)
• Engagement summary (was opened, was clicked, counts)
• Template and batch references maintained

Daily Summaries (Indefinite)

Aggregated analytics are kept indefinitely:

• Volume metrics (sent, delivered, bounced, etc.)
• Engagement rates (open rate, click rate)
• Error category breakdowns
• Template performance comparisons

Retention Periods by Data Type

Archive Process

The archiving process runs daily at 2:30 AM UTC:

1. Summary Update: Daily summaries are updated from live data
2. Data Archive: Records older than 30 days are moved to archive tables
3. PII Removal: Recipient emails and detailed tracking data are removed
4. Cleanup: Original full records are deleted

What Happens at Expiration

When data reaches its retention limit:

1. Archive First: Data is archived with PII removed (email/attachment logs)
2. Soft Delete: Data is marked as deleted but retained for 30 days
3. Hard Delete: Data is permanently removed from primary storage
4. Backup Purge: Backups containing the data expire per backup schedule

Data Deletion

GDPR Data Removal Request

If you received emails from a FormaMail customer and want your data removed, you can submit a data removal request:

1. Visit app.formamail.com/data-removal
2. Enter the email address you want removed
3. Choose your removal type:
   • Delete All: Permanently delete all associated data
   • Anonymize: Replace PII with anonymous data
   • Export & Delete: Get a copy before deletion
4. Verify your email by clicking the link we send
5. Our team processes requests within 30 days

What Gets Removed

When a data removal request is processed:

Status Tracking

You can check your request status at app.formamail.com/data-removal/status

Automatic Deletion

FormaMail automatically deletes:

• Generated attachments after 7 days
• Soft-deleted records after 30 days
• Email logs (archived after 30 days, deleted after 5 years)
• Expired OAuth tokens and authorization codes

Manual Deletion

You can manually delete data via:

API:

# Delete a specific email log
DELETE /api/emails/:id
 
# Bulk delete email logs
DELETE /api/emails/bulk

Dashboard:

• Go to Email Logs → Select emails → Delete
• Go to Templates → Select template → Delete

Account Deletion

To delete your entire account and all associated data:

1. Go to Settings → Account → Delete Account
2. Confirm your identity
3. Enter “DELETE” to confirm
4. All data is scheduled for deletion within 30 days

Access Controls

Role-Based Access Control (RBAC)

FormaMail implements RBAC at the team level:

API Key Permissions

API keys can be scoped to specific permissions:

• emails:send - Send emails
• emails:read - Read email logs
• templates:read - Read templates
• templates:write - Create/edit templates
• analytics:read - Access analytics
• webhooks:manage - Manage webhook subscriptions

OAuth Scopes

Third-party applications access your data through OAuth with explicit scopes:

Audit Logging

FormaMail maintains audit logs for security-sensitive operations:

Logged Events

Accessing Audit Logs

Audit logs are available to team Owners and Admins:

• Dashboard: Settings → Activity Log
• API: GET /api/teams/:teamId/activity

Log Retention

Audit logs are retained for 2 years and cannot be deleted manually. This ensures accountability and supports incident investigation.

Data Processing

Where Data is Processed

Data Flow

1. API Request: Your request arrives via HTTPS at our API servers
2. Validation: Input is validated and sanitized
3. Processing: Email is queued, attachments generated
4. Delivery: Email sent via AWS SES
5. Logging: Delivery status logged for tracking
6. Cleanup: Temporary files deleted after delivery

Backups & Recovery

Backup Schedule

Disaster Recovery

• RTO (Recovery Time Objective): < 4 hours
• RPO (Recovery Point Objective): < 1 hour
• Infrastructure: Railway managed PostgreSQL with automated backups

Data Recovery Requests

If you accidentally delete data, contact support@formamail.com within the retention period. Recovery may be possible from backups depending on timing.

Third-Party Data Sharing

We Do Not Sell Data

FormaMail does not sell, rent, or trade your data to third parties.

Service Providers

We share data with service providers only as necessary to operate the service:

Legal Requirements

We may disclose data if required by law, court order, or to protect our rights. We will notify you unless legally prohibited.

Security Best Practices for Users

Recommended Practices

1. Rotate API keys regularly (at least every 90 days)
2. Use scoped API keys with minimum required permissions
3. Enable 2FA for dashboard access
4. Review connected OAuth apps periodically
5. Monitor your email logs for unusual activity
6. Use strong passwords (16+ characters, unique)

What to Do If Compromised

If you suspect your account or API key is compromised:

1. Immediately revoke the compromised API key
2. Change your password
3. Revoke all OAuth authorizations
4. Review recent activity in audit logs
5. Contact support at security@formamail.com