Where Your Data Lives When You Use Topol and Who Can See It

All of Topol's infrastructure runs in the European Union, specifically in Amazon's Frankfurt region. Your account, your templates, and the images you upload are stored and processed there. That matters if you work under the GDPR: you can tell your compliance team exactly where your data resides. Even our product analytics runs on an EU cloud.

Storage is also separated by customer. Each account and each team gets its own dedicated bucket in cloud storage, rather than a folder inside a single bucket shared by all customers. Because the separation happens at the storage level, there is no filter or permission flag whose misconfiguration could expose your files to another customer.

There are also no long-lived servers to break into. Topol runs on serverless infrastructure, so each request is handled by short-lived compute that exists only for the duration of that request. Production credentials, such as database passwords and payment keys, do not sit in configuration files on a server; they live in AWS's dedicated secrets store and are injected only at deploy time.

Templates, folders, and saved blocks belong to a team, and every request verifies two things: that you are a member of that team and that your role allows the action you are trying to perform. Team roles (admin, editor, viewer) allow an agency to let a client review a campaign without giving them access to it. You can read more about how that works day to day in our post on how Topol supports collaboration and customization.

The checks are layered. The permission check runs first, and then the database queries are filtered by team as a second, independent layer, so even if a permission check were missed, the underlying query would still return only your team's data. And if someone probes for a template that belongs to another team, Topol answers as if it does not exist at all, so an outsider cannot even confirm what is or is not in your account.

Our staff access is locked down as well. The internal admin panel is restricted to a handful of admin accounts, and in production, those admins cannot log in without two-factor authentication. Sensitive records, such as templates, API tokens, and billing addresses, have an activity log, so changes are traceable.

Account security is the layer you can see and configure yourself, so here is what sits behind it:

• Passwords. We keep a one-way bcrypt hash of your password, which means nobody at Topol can read it, and neither could an attacker who somehow obtained the database. Changing your password requires the current one, and it signs out your other active sessions.

• Two-factor authentication. Any user can turn on authenticator-app 2FA, and team owners can require it for the whole team: a member without 2FA gets redirected to set it up before they can reach anything else. If your company policy says "2FA everywhere," Topol can enforce that for you instead of relying on reminders.

• Sign-in defenses. Login, registration, and password-reset endpoints are rate-limited, protected by reCAPTCHA, and designed not to leak whether an email address has an account with us. Password reset requests get the same friendly answer whether the address exists or not, so attackers cannot use our forms to build a list of customers.

• Sessions. Sessions are stored server-side, expire after 12 hours, and are capped in number, so a forgotten login on a shared computer dies on its own. You can see your active browser sessions in your profile and sign them all out with one click, and we email you when that happens.

When you connect Topol to Mailchimp, HubSpot, SendGrid, Klaviyo, or any of the other platforms we integrate with, the API keys and tokens you provide are encrypted with AES-256 before they reach the database. The same applies to two-factor secrets. A raw database dump would not expose them.

Your card number never reaches our servers. Payments go through Stripe, which tokenizes the card on its side. What Topol retains is the card brand and the last four digits, which is enough to show you which card is on file. Our database contains no card number, expiration date, or security code, so a breach of our systems could not expose any of them. Stripe payment notifications are cryptographically signed and verified before we act on them.

API secret keys sit in the middle. The secret key for a Plugin integration is displayed to you only once, and after that only a one-way hash of it is kept. If you lose it, you regenerate it; we cannot read it back to you even if you ask, which is exactly the point.

Images you host for your emails are intentionally public, and it is worth being honest about this because it is true of every email tool: when Gmail or Outlook renders your campaign, it has to fetch your images from a public address. So hosted email images are served publicly through a CDN. The practical advice is simple and applies everywhere, not just to Topol: never put confidential information inside an image destined for an email.

Everything that can be private is. Template PDF exports are served via signed links that expire after an hour. Share links can include an expiry date and a usage limit, and they are rate-limited as well, so a preview you send to a client today does not remain accessible forever.

Deleting your account permanently removes your data: your owned teams, templates, API tokens, and profile photo are deleted in one transaction. Deleting a team goes further: the team's entire storage bucket is deleted, along with every hosted file. We do not keep your templates around "just in case."

A lapsed subscription receives a grace period first. Your hosted files are kept for 90 days so a billing hiccup does not destroy your work, and we warn you by email before anything is removed. After the grace period, the files are deleted. Logs also follow retention limits: activity logs are kept for one year and diagnostic logs for two months, after which they are gone.

Security claims are cheap; specifics are what you should ask for. Everything in this article is how the product is actually built: EU infrastructure, a bucket per customer, team-scoped access checked on every request, encrypted credentials, tokenized payments, and deletion that really deletes. If you are a SaaS team evaluating an embeddable editor, our guide to six questions to ask before picking an email editor SDK includes the security questions worth putting to any vendor, us included. We like being asked.