Know where your email data goes.

Start with one actual workflow

Choose a specific workflow such as newsletter signup, campaign delivery or reply handling. Follow a designated test record through its stages. Record the source, the information collected, the services involved and the intended purpose. Add evidence links or configuration references so someone else can check the map later.

Use Singapore's PDPC resources as a starting point when reviewing the obligations relevant to your organisation and any cross-border arrangements. This page supplies an operational worksheet; it does not determine whether a transfer is permitted or certify a platform's compliance. A data map is useful input to that review, rather than a substitute for it.

Separate the copies and purposes

Use one row per meaningful processing activity or copy. The table shows questions to answer, not a claim that every listed feature or service is enabled in your account.

Ask what the chosen region actually covers

SendMailOS's deployment information identifies Hetzner infrastructure in Germany and a primary Supabase project in Frankfurt. Treat these as deployment details, then review the wider service chain. Do not infer that every support, billing, telemetry, email-delivery or customer-configured activity occurs in the same region.

Supabase's residency FAQ says database, authentication data, storage objects and backups reside in the selected project region. It also explains that this does not guarantee all data remains there: account and billing information, global support, operational metadata and certain enabled services can involve other locations. Check the actual configuration, relevant contracts and scope rather than treating the database-region label as the whole answer.

For each provider, separate storage location from processing and access locations. Record what is confirmed, the evidence date and any unanswered question. A provider's own certification or contractual commitment should not be presented as a certification of the entire SendMailOS workflow.

Map the delivery route separately from application storage

1. Locate the application records

   Identify where contacts, campaign content, account data and reports are stored. Connecting a VPS is not an instruction that moves all these application records to that server.

2. Trace the actual email route

   Record whether the message leaves through hosted delivery or your connected server and its IP. Include operational queues and logs where relevant to your configuration.

3. Include recipient and connected destinations

   The recipient's mailbox provider receives the delivered message. If you enable a webhook, export, analytics destination or reply workflow, add that destination to the map rather than ending at the sending server.

4. Review access and removal

   Record who administers each system and how access ends. Test a designated record's deletion or exclusion workflow, including what backups and connected copies do; do not promise instant removal from every historical copy.

Turn unknowns into assigned questions

Keep the worksheet at the workflow level. Use category names and configuration references rather than names, email addresses, credentials or confidential records. The tool stays in the browser and produces a brief you can take into a vendor or internal review; it does not scan your infrastructure.

• Ask which contractual documents cover the actual service and which subprocessors or optional services are relevant to your configuration.
• Ask what a region setting covers, what it excludes, and whether support or remote administration can involve other locations.
• Ask which retention settings you control and what happens to queues, logs, backups, exports and restore operations.
• Ask how a data request or incident reaches the responsible team and how connected destinations are included in the response.
• Assign an owner and review date to every unknown. Revisit the map after a new integration, sending route, tracking setting or provider change.