> ## Documentation Index > Fetch the complete documentation index at: https://docs.trylath.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Every Lath operation is POST https://platform.trylath.com/, with a JSON body and `Authorization: Bearer `. `email.send` is POST /email/send. > Branch on `error.code`, never on `error.message`. Every refusal also carries `error.fix`, which names the next step. > Send an `Idempotency-Key` header on any operation that is not retry-safe, so a retry cannot run it twice. > A `lath_test_` key emails only the account's own members and sends no SMS; a `lath_live_` key reaches real recipients and is billed. > The OpenAPI document, generated from the same registry as the routes, is at https://platform.trylath.com/openapi.json. # Data and retention > Where your data is processed, when each kind is removed, and what closing an account erases. Every window here is a job the worker runs, not only a sentence in a policy. ## Where it is processed The databases that hold every environment's data, and the email sending, run on Amazon Web Services in us-east-1. The API, the worker and the hosted pages run on Fly.io in its iad region. SMS goes through Twilio. All of them are in the United States. Stripe processes payment for your Lath account and reaches no end-user data. Cloudflare serves DNS for trylath.com and holds no personal data. Sentry records application errors, built from an allow-list — exception type, message, stack trace, release, environment id, operation name and activity id — so no message content, recipient addresses, request bodies, headers, IP addresses or credentials are sent to it. That list is the data processing addendum's, and a new subprocessor is announced by email at least 14 days before it is added. ## Message content goes after 30 days Thirty days after a message is created, its subject, text and HTML are emptied, and so are the bytes of every attachment. The record that it was sent stays, and an attachment keeps its file name, type and size — so you can still tell that an invoice went out, but not read it. This applies to what you send. Mail you receive is kept until you delete it; see below. ## Logs go after 13 months Message records, webhook deliveries and their attempts are deleted 13 months after they were created. Events go at 13 months too, except one that something still points at — the event that caused a suppression, or that started an automation run, is kept as long as that record is. The activity log is anonymised rather than deleted: after 13 months who acted and the digest of what they sent are removed, and the operation and its time stay, so the audit trail keeps its shape. `developers.events.list` reads back as far as the window allows. ## Received mail is kept until you delete it Inbound email is not on the 30-day clock. `email.inbound.delete` removes a received message's bodies, headers, attachments and every recipient beyond the one it was addressed to, and keeps the record of who it came from, where it went and when — which is what answers a later question about whether it arrived. A deleted message no longer appears in `email.inbound.list` or `email.inbound.get`. ## Removing one person `auth.user.delete` revokes the user's sessions and releases their identities, so the same address or phone number can sign up again as a new person. The row is kept for audit and hidden from every read. `audience.contact.delete` releases a contact's addresses and keeps its consent history readable through the ledger, because a later question about whether someone agreed to be messaged needs the answer to still exist. An opt-out outlives both. A suppression is keyed by channel and address rather than by user or contact, so somebody who said stop stays stopped after their records are gone. ## Closing an account `account.close` takes a reason and stops the account sending. It emits `account.closed`, and `account.reopen` undoes it while the 30 days below have not passed. Thirty days after closing, the worker erases the account's data in one transaction: users, sessions, organizations, contacts, consents, templates, messages and received mail, sending domains, webhooks, keys and members. Some records are kept, each for a stated reason: suppressions, so an opt-out is still honoured; the SMS carrier registration, which the carrier requires; invoices and the billing records behind them, for the seven years tax law requires; the activity and event logs, on their own 13-month window; and the account record itself, which carries when and why it was closed. After the erasure, reopening the account does not bring the data back. ```bash theme={null} lath account close --reason "Moving to a different provider" ```