EU data residency vs an AWS region: transactional email for GDPR teams

European product teams keep asking the same question: “If the provider has an EU region, are we GDPR-safe?” For transactional email the honest answer is no, not automatically. Sending location and data residency are different layers. Confusing them is how a security review fails after the integration already shipped.

What is the difference between an EU region and EU data residency?

An EU region on Amazon SES or Resend means the SMTP packets can leave a datacenter in Ireland or Frankfurt. That helps latency. It does not, by itself, move the jurisdiction of the customer account, the message metadata, the template bodies or the support logs. Those records are personal data when they contain email addresses and often message content. GDPR cares where the processor stores them and which public authority can compel them.

MailingCore is a developer email platform that stores and processes that data in the European Union. The Free plan is 100 emails per month and 5 templates. We publish this distinction because competitors already rank for “Resend EU alternative” without mentioning us — and because DPOs ask for it in writing.

Why Resend’s EU region is not EU residency

Resend is an excellent developer experience. Public documentation has stated that choosing the EU sending region does not relocate account data, logs and analytics to the Union; those remain in the United States. Treat vendor pages as the source of truth and re-check them: products change. If your transfer impact assessment assumes “EU region = no Chapter V transfer”, you may be documenting the wrong fact.

Amazon SES can run in eu-central-1. You still operate an AWS account, IAM, configuration sets and CloudWatch. The processor is Amazon. That can be the right choice when you already live in AWS and you have SCCs and a DPA you accept. It is the wrong choice when the team wanted a panel, versioned templates and a newsletter without building them.

What GDPR actually wants from an email API

Article 28 wants a processor contract, instructions, security and subprocessors you can name. Schrems II wants a lawful transfer tool if personal data leaves the EEA. “We send from Dublin” is not that tool. Prefer vendors that state storage location for:

• Recipient addresses and message bodies
• Event logs (delivered, bounced, opened)
• Template HTML
• Support tickets that paste those fields

MailingCore’s public docs cover EU processing and a real erasure path. Read data residency and the privacy policy before you put it in a DPIA.

When to stay on SES or Resend

Stay on SES if volume, price per million and AWS networking dominate, and your counsel already signed off on Amazon as processor. Stay on Resend if React Email and US DX are the buying criteria and SCCs are accepted. Switch when the shortlist is “one API, EU storage, newsletter included, agent-readable MCP”. That is the job MailingCore is built for — not planetary SendGrid scale.

Next step

Compare the 1:1 pages MailingCore vs Resend and MailingCore vs Amazon SES, or the intent pages under Resend alternatives. Then send a test from the quickstart.