Where it is processed
The databases that hold every environment’s data, and the email sending, run on Amazon Web Services in us-east-1. The API, the worker and the hosted pages run on Fly.io in its iad region. SMS goes through Twilio. All of them are in the United States.
Stripe processes payment for your Lath account and reaches no end-user data. Cloudflare serves DNS for trylath.com and holds no personal data. Sentry records application errors, built from an allow-list — exception type, message, stack trace, release, environment id, operation name and activity id — so no message content, recipient addresses, request bodies, headers, IP addresses or credentials are sent to it.
That list is the data processing addendum’s, and a new subprocessor is announced by email at least 14 days before it is added.
Message content goes after 30 days
Thirty days after a message is created, its subject, text and HTML are emptied, and so are the bytes of every attachment. The record that it was sent stays, and an attachment keeps its file name, type and size — so you can still tell that an invoice went out, but not read it.
This applies to what you send. Mail you receive is kept until you delete it; see below.
Logs go after 13 months
Message records, webhook deliveries and their attempts are deleted 13 months after they were created. Events go at 13 months too, except one that something still points at — the event that caused a suppression, or that started an automation run, is kept as long as that record is.
The activity log is anonymised rather than deleted: after 13 months who acted and the digest of what they sent are removed, and the operation and its time stay, so the audit trail keeps its shape. developers.events.list reads back as far as the window allows.
Received mail is kept until you delete it
Inbound email is not on the 30-day clock. email.inbound.delete removes a received message’s bodies, headers, attachments and every recipient beyond the one it was addressed to, and keeps the record of who it came from, where it went and when — which is what answers a later question about whether it arrived.
A deleted message no longer appears in email.inbound.list or email.inbound.get.
Removing one person
auth.user.delete revokes the user’s sessions and releases their identities, so the same address or phone number can sign up again as a new person. The row is kept for audit and hidden from every read.
audience.contact.delete releases a contact’s addresses and keeps its consent history readable through the ledger, because a later question about whether someone agreed to be messaged needs the answer to still exist.
An opt-out outlives both. A suppression is keyed by channel and address rather than by user or contact, so somebody who said stop stays stopped after their records are gone.
Closing an account
account.close takes a reason and stops the account sending. It emits account.closed, and account.reopen undoes it while the 30 days below have not passed.
Thirty days after closing, the worker erases the account’s data in one transaction: users, sessions, organizations, contacts, consents, templates, messages and received mail, sending domains, webhooks, keys and members.
Some records are kept, each for a stated reason: suppressions, so an opt-out is still honoured; the SMS carrier registration, which the carrier requires; invoices and the billing records behind them, for the seven years tax law requires; the activity and event logs, on their own 13-month window; and the account record itself, which carries when and why it was closed. After the erasure, reopening the account does not bring the data back.
Last modified on September 13, 2026
