Your data stays in the United States. So does access to it.

Short answer: every mailbox, message, archive copy, backup and log for PXCMail lives in Amazon Web Services regions in the United States (us-east-1, with us-west-2 for replication and recovery), and the only people who can read message content are PacinfraX employees located in the United States, after a written request or during an incident investigation, with each access logged where you can see it. Our tier-1 support team in Southeast Asia sees configuration and metadata only, never content, and you can restrict that too. This page lists what is stored where, who can reach it, and what happens when you leave.

Storage and processing

Access

• Message content: accessible only to PacinfraX tier-2 personnel located in the United States, on written customer request or during an incident investigation, with time-limited approval and a log entry visible to the customer.
• Configuration and metadata (addresses, timestamps, delivery status, policy settings): accessible to support personnel in the United States and Southeast Asia for support purposes; logged.
• Infrastructure: AWS data-center personnel do not have logical access to customer data; AWS BAA and SOC reports available via AWS Artifact.
• Customers may request a US-only support restriction for metadata as well, at no charge.

An access request, step by step

Lakeside Family Dental’s office manager asks support to find out why a referral sent from frontdesk@ on Tuesday never reached the oral surgeon. Here is who touches what.

1. A tier-1 support agent, who may be in Southeast Asia, opens the ticket and looks at the message’s metadata: sender, recipient, timestamp, policy decision and delivery status. The agent sees that the message was held for supervisor release because the attachment matched the X-ray detection rule. No content is visible at this step.
2. The agent tells the office manager where the message is and how to release it from Console → Quarantine. Most tickets end here.
3. If the office manager asks us to read the message itself, for example to confirm a suspected false positive, she sends a written request from an Owner or Admin account. A US-based tier-2 engineer requests time-limited access, and the access is opened for that message only.
4. The access is logged with the engineer’s name, the time window and the reason. The entry appears in Lakeside’s own audit log under Console → Security, so the Security Officer can see it without asking us.

What leaves the US and why

Two things. First, the web console and locked-delivery reading pages are served through CloudFront edge locations worldwide, so a recipient in another country can open a secure message quickly. The edge serves page code and static assets only; message content is fetched from the origin in us-east-1 for each reading session and is never cached at the edge. Second, our tier-1 support team in Southeast Asia views configuration and metadata through the support console, which is itself hosted in us-east-1; no customer data is copied to a device outside the United States. Customers who need a US-only restriction on metadata access as well can request it under Console → Organization at no charge.

Legal requests

See our law enforcement guidelines. We require valid legal process, notify customers unless prohibited, and publish a transparency report.

Return and destruction

1. Export window. For 30 days after termination, Owners and Admins can export everything: mailboxes and the archive in EML, MBOX or PST with a sha256 manifest and a chain-of-custody statement, plus audit logs and policy configuration. Export jobs run up to 50 GB each; larger organizations run several.
2. Legal holds. Anything under an active legal hold is exported but not deleted until you release the hold in writing.
3. Deletion. After the window, mailboxes, locked-delivery storage, configuration and backups are deleted from both regions. Archive objects under Object Lock are deleted when the lock allows; where a lock runs past the window, the organization key is destroyed first so the remaining objects are unreadable, and they are deleted when the lock expires.
4. Key destruction. Your organization’s encryption key is scheduled for destruction, which makes any residual copy unreadable.
5. Certificate. A certificate of destruction is issued on request, listing the data categories and dates. Keep it with your written program.

FAQ

Contact

Questions about residency or access: [email protected]. To request the US-only metadata restriction, open Console → Organization or ask support.