--- title: "Cloud Platform Email Product Privacy Notice" date: "2026-05-15T19:58:38+00:00" summary: "Understand how Acquia Cloud Platform Email handles your data—privacy practices, retention, security measures, and data subject rights explained." image: type: "page" url: "/service-offerings/cloud-platform-email-product-privacy-notice" id: "a1a3c1d4-ced5-4c21-83e5-bac1e091e5b0" --- Acquia Cloud Platform Email   ------------------------------- Last revision of this Product Notice  \[June 9, 2026 - added AI-related processing operations details\] Prior version(s) of this Product Notice: \[September 17, 2021\] This Product Notices describes the privacy-relevant aspects of the above-mentioned Acquia product/services.   ### About the Product Acquia Cloud Platform Email is a robust transactional email sending solution built leveraging AWS SES infrastructure to support Drupal deployment workflow processes. Acquia Cloud Platform Email requires an Acquia Cloud Platform subscription. This service provides credibility to emails, prevents email spoofing, and enhances the deliverability of emails by implementing DMARC on the SPF and DKIM sender authentication frameworks. For details about this Product, please refer to the Product Description available online at [https://docs.acquia.com/guide](https://docs.acquia.com/guide).   ### 1\. Processing Operation(s) The objective of Processing of Personal Data by data importer is the performance of the Services pursuant to the Agreement. * Processing of Personal Data to deliver its core functionalities required: ☒ yes  ☐ no * Optional features processing Personal Data:  ☒ yes  ☐ no * The optional features are deactivated by default:  ☐ yes  ☒ no ☐ n/a\* * Processing of sensitive Personal Data: ☐ yes \*\*   ☐no ☒ n/a\* * Profiling of individuals based on personal characteristics: ☒ yes \*\* ☐ no ☐ n/a\* * Automated decision making that produces legal or other significant impacts on individuals:  ☐ yes  ☒ no ☐ n/a\* * Processing via an AI tool available with the Product ☐ yes ☒ no * The AI feature is deactivated by default: ☐ yes ☒ no * The AI feature processes Personal Data: ☐ yes ☒ no * The AI feature processes sensitive Personal Data ☐ yes ☒ no * The Customer can control what data the AI tool processes: ☐ yes ☒ no \* (n/a = not applicable) \*\*(optional; depends on the Customer’s configuration of the system, the connection to other systems, and the categories chosen by the Customer to be collected from Third Party Users)   ### 2\. Details of Personal Data being processed Categories of Personal Data Categories of Data Subjects Purpose of Processing Categories of Data Recipients Needed for Core Features Processing Location Acquia Inc. acts as Processor Email Addresses Through the configuration, design, and administration of their own Drupal application, Customer in its sole discretion determines and controls the categories of data subjects collected by their Drupal Application and is used for purposes of sending emails through Acquia Cloud Platform Email. Primarily, these would be Customer’s end-users including visitors to Customer’s website. Provision of the Services by Acquia to Customer   Yes Emails are routed and logs are stored in the us-east-1 region Yes ### 3\. Privacy Enhancements Objective Technology / Measure Data at Rest Data in Transit Anonymization and Pseudonymization To and From email addresses are logged for troubleshooting/support purpose which are in pseudonymization format pseudonymization format pseudonymization format Data confidentiality Data confidentiality is managed through least privilege including ACLs, encryption, two-factor authentication, strict password protocols, configuration management, and security monitoring and alerting software Encrypted format TLS Data integrity TLS is used for data in transit. TLS uses encryption to ensure privacy, so that other parties can’t eavesdrop or tamper with the messages being sent Encrypted format TLS Data availability including restoring availability, restoring access to personal data, and data resilience Data backup and restore process is used with the Point-in-Time Recovery method for database. Application is deployed considering high availability with multi AZ for business continuity.   N/A Regular testing, assessing and evaluating of TOMs Qualys compliance scanner & ClamsAV are used for security; processes are reviewed periodically as per Fedramp compliance regulation.   N/A ### 4\. Certifications   n/a   ### 5\. Data Subject Rights   Data subject rights requests (information, erasure, etc.) can be managed by the Customer themselves through the administrative console.   ### 6\. (Personal) Data Retention Cycles   Deliverability logs are retained for 1 year after being stored. We store customer’s aggregated sending stats and suppression lists (bounces, spams) which includes “To” & “From” email addresses for 1 year.   ### 7\. Sub-Processing   The specific list of sub-processors is available from: [www.acquia.com/about-us/legal/subprocessors](https://www.acquia.com/about-us/legal/subprocessors). Any current Acquia customer with a data processing agreement in place with Acquia may subscribe to receive notifications of new or changed sub-processors through the above website.   ### 8\. Description of the technical and organizational security measures implemented by the data importer   Data importer has implemented and will maintain appropriate administrative, physical, and technical safeguards for the protection of the security, confidentiality and integrity of Personal Data uploaded to the Services, as described in the Acquia Security Annex (available from [https://www.acquia.com/about-us/legal/gdpr)](https://www.acquia.com/about-us/legal/gdpr\)) applicable to the specific Services purchased by data exporter, as updated from time to time, and made available by data importer upon request. The data exporter is wholly responsible for implementing and maintaining security and data administration within any data exporter applications, configuration settings, or log settings used by the data exporter in conjunction with the Services.