Email Marketing & Newsletter
Mailchimp
Rest of world Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 1 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Intuit Inc. · mailchimp.com
Compare with rapidmail → Compare with Brevo → Compare with CleverReach → Compare with Klaviyo → Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Mailchimp, an email marketing platform under Intuit Inc., earns its best marks on the mechanics of the job: campaign and automation scores hold at 7, list data control at 7, and integrations cluster at 7-8, on the strength of a journey builder with conditional and percentage splits, a documented whole-account export as a zip, and 300+ integrations including a stated two-way Salesforce sync. Sovereignty is the outlier at 1-2: the contracting entity is The Rocket Science Group LLC under Intuit Inc. in the US, US hosting is the fixed default with no EU option on the captured pages, we found no public information on a published subprocessor list, and transfers rest on annual Data Privacy Framework certification with standard contractual clauses as fallback. Outside sovereignty, the widest spread is consent and proof, 4 to 6, where double opt-in is one of two offered methods and works only on Mailchimp signup forms; pricing transparency runs 5 to 6, with the captured pages giving different figures for the Essentials and Standard plans and no overage rate stated.
Speaks for it
- Journey builder documented with conditional and percentage splits, wait-for-trigger steps, up to three segmentable triggers and API-triggered entry.
- Account exit is engineered: a whole-account zip export, per-contact activity files, and documented permanent deletion and forget actions.
- Authentication is documented down to the DNS records — two CNAMEs for DKIM and one TXT for DMARC — with dedicated IPs and a roughly 30-day warm-up.
- 300+ integrations include a stated two-way sync with Salesforce plus Shopify, Square, Stripe and Lightspeed, on versioned marketing and transactional APIs.
- The signup form's GDPR wording is recorded in plain text on each contact's profile, and editing a checkbox invalidates prior consent.
Held against it
- Sovereignty scored 1-2: a US contracting entity under Intuit, US hosting as the fixed default, and no subprocessor list published on the vendor's own pages.
- Double opt-in is one of two offered methods, enabled per audience, and only available on Mailchimp signup forms — contacts added via the API cannot get it.
- Exports are metered to one at a time and one per 24-hour period, and contact-level exports must be run per audience.
- We found no public information on overage rates, VAT treatment, the Premium tier's price or the SMS add-on's price, and the captured pages give different figures for Essentials (€11.34 and €11.50 per month) and Standard (€17.45 and €17.68 per month).
- We found no public information on A/B testing, send-time optimisation, complaint-loop handling or inbox-placement testing.
Best for
- You run an online shop and want abandoned-cart and product-retargeting journeys connected to Shopify, Square or Lightspeed.
- You build in-house tooling and want marketing and transactional sending on documented, versioned APIs with batch operations and webhooks in both directions.
- You want a documented way out: a whole-account export with per-contact activity files plus permanent deletion and a forget action.
- You must be able to show what a contact consented to, with the signup form's GDPR wording recorded on their profile.
Avoid if
- Your procurement requires EU data residency or weighs the transfer basis heavily — ask the vendor: the public pages we read do not show it
- Your consent model requires double opt-in for contacts created through the API, where it can only be enabled for Mailchimp signup forms.
- You need to predict your exact monthly invoice from the published pages — ask the vendor: the public pages we read do not show it
The scores
Campaigns & automation
Show reasoningHide reasoning
How this is scored
Building the mail and the journey around it: editor, templates, segmentation, triggered sequences, A/B testing.
0 — One-off broadcasts from a fixed template; no segmentation and no automation of any kind.
3 — A drag-and-drop editor and simple list segmentation, but automation is a single welcome mail and there is no testing.
5 — Reusable templates, attribute and behaviour segmentation, multi-step automations on common triggers, and subject-line A/B testing.
8 — A visual journey builder with branching on behaviour and data, dynamic content per segment, send-time optimisation, and testing that reports significance rather than raw counts.
10 — Journeys treat the whole lifecycle: event-driven entry from other systems, branching on any attribute or event, holdout groups for measurement, and automations a marketer can read months later without a diagram.
The CRM Manager
The flow map with conditional and percentage splits, triggers filterable by segment conditions, event entry through the events endpoint and an API trigger for journeys is a genuine lifecycle tool, with dynamic content documented for the higher plans. But I found no public information on A/B testing of any kind, no significance reporting and no send-time optimisation, so the measurement half of a lifecycle programme has nothing published to stand on. 6 5 2
The Deliverability Engineer
Automation flows are documented as a visual journey map with conditional and percentage splits, wait steps, webhooks and up to three segmentable triggers, plus dynamic content on paid tiers and an API trigger that starts journeys from outside events. We found no public information on send-time optimisation, holdout groups, or A/B testing that reports significance, which keeps a genuinely strong journey builder short of the top band; flow depth is also tier-gated to four steps on the entry paid plan. 6 5 2
The Data Protection Officer
The captured help pages show a visual journey builder with conditional and percentage splits, wait and trigger steps, entry filtered by segmenting conditions, and an API trigger so another system can start a journey; dynamic content and branded templates appear from the Standard tier upward. We found no public information on A/B testing, holdout groups or send-time optimisation, which is what keeps this short of the top band. 5 6 2
The Shop Owner
The journey builder is real: a visual flow map with conditional and percentage splits, wait-for-trigger steps, up to three triggers filterable by segmenting conditions, and abandoned-cart, product-retargeting and follow-up workflows wired straight to e-commerce carts, with e-commerce data in the reports I would bill against. Dynamic content and the bigger flow budgets sit in paid tiers only, and we found no public information on send-time optimisation or testing that reports significance, which holds it a step below the top of the scale. 2 5 6
The Integrator
A visual flow map with conditional and percentage splits, up to three segmentable triggers, a webhook step and flow stats is a genuine journey builder, with dynamic content and custom-coded templates gated by plan and events able to start journeys from the API. We found no public information on send-time optimisation, holdout groups, or campaign-level testing that reports significance, which is what separates this from the top band. 6 5 2 14
The Skeptic
The flow builder is the real thing — conditional and percentage splits, wait-for-trigger, webhooks and API-triggered entry, dynamic content from Standard up — but flow depth itself is metered by plan (200 flow points on Standard versus 4 steps per flow below). We found no public information on A/B testing, send-time optimisation or holdout groups. 6 2 5 14
Deliverability infrastructure
Show reasoningHide reasoning
How this is scored
Whether the mail arrives — authentication, sending reputation, bounce and complaint handling — judged on what the vendor documents rather than the inbox rate it advertises.
0 — No documentation of authentication or bounce handling; deliverability appears only as a marketing number.
3 — SPF and DKIM setup documented, but no DMARC guidance, no stated bounce policy and shared sending only.
5 — SPF, DKIM and DMARC documented with a custom sending domain, automatic hard-bounce suppression, and complaint-loop handling stated.
8 — The above plus dedicated-IP options with a documented warm-up, seed or inbox-placement testing, engagement-based sunsetting, and published guidance on list hygiene.
10 — Deliverability is operated as a service: reputation monitoring surfaced to the customer, per-domain and per-ISP diagnostics, enforced authentication before first send, and postmaster or blocklist handling the vendor documents doing on the customer's behalf.
The CRM Manager
Authentication is documented properly — DKIM as two CNAME records and DMARC as a TXT record, with an automated setup path — and dedicated IPs carry a documented warm-up of roughly 30 days, while soft/hard bounce categorisation from SMTP replies factors engagement into cleaning decisions. Complaint-loop handling, inbox-placement testing and published list-hygiene guidance are unevidenced, and bounce reasons are viewable one address at a time, held only 30 days, with bulk export ruled out. 8 7 13
The Deliverability Engineer
Authentication is documented properly — domain verification first, then two CNAME records for DKIM and one TXT for DMARC, with an automated setup method and guidance on the Gmail and Yahoo DMARC requirements — and bounces are categorised soft or hard from SMTP replies with subscriber engagement factored into cleaning decisions. Dedicated IPs are provisioned with a roughly 30-day warm-up and custom reverse DNS on the transactional side. We found no public information on inbox-placement or seed testing, complaint-loop handling, or sunsetting of inactive subscribers, so the top of this band stays out of reach. 8 7 13
The Data Protection Officer
Authentication is properly documented — domain verification, two CNAME records for DKIM and a TXT record for DMARC, with automated setup and the Gmail and Yahoo requirement spelled out — and bounces are categorised from SMTP replies with subscriber engagement factored into cleaning, plus dedicated IPs with a roughly 30-day warm-up. We found no public information on complaint-loop handling, seed or inbox-placement testing, or published list-hygiene guidance, so it sits between the middle and upper bands. 7 8 13
The Shop Owner
Authentication is documented end to end — two CNAME records for DKIM and a TXT record for DMARC on a domain I own, with an automated setup route and nudges at the right moments — plus dedicated IPs with a roughly thirty-day warm-up and automatic soft/hard bounce categorisation that factors in engagement. We found no public information on complaint-loop handling, inbox-placement testing or reputation monitoring surfaced to the customer, so the top of the scale is not evidenced. 7 8 13
The Integrator
Authentication is documented down to the DNS records — two CNAMEs for DKIM and one TXT for DMARC, with automated setup via Entri — and dedicated IPs come with a documented warm-up of roughly 30 days, custom reverse DNS and sender-domain checks; bounces are auto-categorised soft or hard with engagement factored into cleaning. We found no public information on complaint-loop handling, seed or inbox-placement testing, or reputation monitoring surfaced to the customer, and bounce reasons are kept only 30 days and, per the vendor's own documentation, cannot be exported as a full list. 8 7 13
The Skeptic
Authentication is documented down to the DNS records — two CNAMEs for DKIM, one TXT for DMARC, with an automated setup path — plus dedicated IPs with a roughly 30-day warm-up and automatic soft/hard bounce categorisation that factors engagement into cleaning. We found no public information on complaint-loop handling or seed and inbox-placement testing, and bounce reasons expire after 30 days with no bulk export. 8 13 7
Consent, proof & tracking limits
Show reasoningHide reasoning
How this is scored
How subscribers arrive and what the sender can prove afterwards: double opt-in, logged consent, unsubscribe handling, and whether open and click tracking can be limited or switched off.
0 — Single opt-in with no consent record; tracking is always on and cannot be disabled.
3 — Double opt-in available but not the default, and the consent record is a timestamp without the source, IP or the wording consented to.
5 — Double opt-in as the documented default with a stored consent record including source and timestamp, one-click unsubscribe, and tracking that can be turned off per campaign.
8 — Consent is reproducible as evidence: the confirmation mail and form wording versioned and retrievable per subscriber, unsubscribe honoured across lists, tracking off-by-default available, and retention rules for inactive subscribers.
10 — Built for the burden of proof: a per-subscriber consent history an authority would accept, documented handling of Art. 15 access and Art. 17 erasure requests, pixel-free and link-tracking-free sending as a supported mode, and preference-centre granularity rather than all-or-nothing.
The CRM Manager
The proof side is genuinely strong: a plain-text version of the signup form with its GDPR fields is recorded per contact and viewable on the profile, editing a checkbox invalidates prior consent, and the confirmation mail is customisable. Double opt-in is offered per audience rather than being the documented default and works only on the vendor's own signup forms, and I found no public information on switching open or click tracking off per campaign or otherwise. 10 9 4 5
The Deliverability Engineer
Double opt-in exists per audience with a customisable confirmation mail, the captured pages show a plain-text record of the GDPR form wording stored on each contact profile, and exports carry SMS consent source and revocation times — consent evidence a long way past a bare timestamp, with a forget endpoint and per-audience contact export behind it. But double opt-in is offered as one of two opt-in methods rather than a documented default and can be enabled only on Mailchimp signup forms, and we found no public information on switching open or click tracking off, pixel-free sending, or unsubscribe honoured across audiences. 9 10 11 5
The Data Protection Officer
Double opt-in exists with a customisable confirmation email, and the GDPR fields each contact saw are recorded in plain text and viewable on their profile — genuinely usable proof when a complaint lands. But double opt-in must be enabled per audience rather than being the default, and we found no public information on switching open or click tracking off per campaign, on an unsubscribe honoured across lists, or on retention rules for inactive subscribers. 4 9 10 11
The Shop Owner
Consent is provable, which matters when a regulator writes: a plain-text version of the signup form's GDPR wording is recorded and viewable on each contact's profile, double opt-in runs per audience with a customisable confirmation mail, and formal data-subject-request processes plus a contact export to answer access requests are documented. Double opt-in can only be enabled for their own signup forms, and we found no public information on switching open and click tracking off per campaign, on unsubscribe honoured across lists, or on retention rules for inactive subscribers. 4 9 10 11
The Integrator
Double opt-in exists per audience but is one of two offered methods rather than a default, and it can only be enabled on Mailchimp signup forms — API-created contacts sit outside it. The proof story is stronger than a bare timestamp: GDPR form wording is recorded in plain text and viewable on the contact profile, editing a checkbox invalidates prior consent, and SMS exports include consent source, time and revocation. We found no public information on turning open and click tracking off per campaign, pixel-free sending, unsubscribe honoured across audiences, or retention rules for inactive subscribers. 9 10 11 4
The Skeptic
Double opt-in exists per audience but only for Mailchimp signup forms — contacts added via API cannot get it — and single opt-in is offered equally, so it is a choice rather than a default. The versioned form wording retrievable on each contact's profile is genuinely proof-grade consent evidence; we found no public information on switching open and click tracking off, or on unsubscribe honoured across audiences. 9 10 4
List ownership, import & exit
Show reasoningHide reasoning
How this is scored
Whether the list and its history remain the sender's: import with attributes intact, full export including engagement history, deletion that executes, and no metering that prices leaving out of reach.
0 — Export is addresses only; engagement history, segments and automations cannot leave.
3 — CSV import and export of subscriber fields, but engagement history and unsubscribe state are not exportable.
5 — Full subscriber export including custom attributes, subscription status and unsubscribe state, plus API access sufficient to sync elsewhere.
8 — Everything exportable in open formats — subscribers, engagement history, campaigns and templates — with documented deletion of a subscriber across all records, and no export throttling.
10 — Exit is a documented feature: full-fidelity export of the whole account, contractual data return, deletion that is evidenced rather than asserted, and migration tooling in both directions.
The CRM Manager
Account export is documented as a zip of audiences, campaign content, template content, contact events and reporting data in CSV, with permanent deletion and a forget action per contact — subscribers, engagement history and templates all leave in open formats. The exit is metered though: one export at a time and only one per 24 hours, builds running minutes to days, contact exports running per audience, and activity history capped at the previous 180 days of aggregated stats. 12 11 5
The Deliverability Engineer
Exit is documented as a real feature: a whole-account zip with audiences, campaign content, templates, gallery assets, contact events and reporting data, plus per-contact CSVs that include opens, clicks and campaign interactions, and API actions that delete all personally identifiable information or forget a contact. The captured pages also state only one export can be generated per 24 hours and that contact-level exports must be repeated per audience when a contact sits in several, and the migration services we can see run inbound only, for Premium customers or the first 30 days of an account. 11 12 5 2
The Data Protection Officer
The account export is full-fidelity — audiences, campaign and template content, contact events and reporting data in one zip, with per-contact activity files covering opens and clicks — and permanent deletion and a forget action are both documented. Against that, exports are throttled to one per 24-hour period and can take minutes to days to build, bounce reasons cannot be exported in bulk, and a contact in multiple audiences has to be exported from each audience individually. 5 11 12 13
The Shop Owner
Exit is nearly a feature: a full account export as a zip covering audiences, campaign and template content, contact events and granular reporting, per-contact CSVs including opens, clicks, campaign interactions and consent data, and permanent per-member deletion is documented. The metering is real though — one export at a time and only one per 24-hour period, with contact exports per audience only — so leaving with a large account is slowed rather than priced out, but it stops this short of the top. 5 11 12
The Integrator
Exit is engineered rather than improvised: a whole-account export as a zip covering audiences, campaign and template content, contact events and granular reporting, per-contact CSV bundles with opens, clicks and campaign interactions, and API-driven export jobs, plus permanent-delete and forget actions per contact. The friction is explicit metering — one export at a time and one per 24-hour period, enforced with error responses — and contact-level data access exports must be run per audience; migration services are documented only for arriving Premium customers in their first 30 days, and we found no public information on outbound migration tooling. 12 11 13 2 2
The Skeptic
Exit is materially supported: an account export as a zip with audiences, campaign and template content, contact events and reporting, opens and clicks files per contact, and documented permanent deletion endpoints. What caps it is the metering — one export per 24 hours, per-audience exports for access requests, and files hosted by Google behind signed URLs that skip user verification. 12 11 5
Integrations & API
Show reasoningHide reasoning
How this is scored
The connection surface a newsletter lives on: shop and CRM systems, events in and out, webhooks, and an API somebody can build against without a partner agreement.
0 — No API and no named integrations; the list is maintained by CSV upload.
3 — A handful of native integrations and a read-mostly API, with no webhooks and no documented rate limits.
5 — Named integrations for common shop and CRM systems, a documented REST API with keys, and webhooks for the core subscriber events.
8 — Maintained bidirectional integrations with named systems including at least one major shop platform, event webhooks with retries, documented rate limits, and a sandbox.
10 — The tool is a component rather than a destination: transactional and marketing sending on one API, events flowing both directions, versioned API with a deprecation policy, and integrations the vendor maintains rather than lists.
The CRM Manager
Marketing and transactional sending each have documented APIs, events flow in through the events endpoint and the journey trigger and out through list and account webhooks, batch operations exist, and named integrations include a stated two-way sync with Salesforce plus Shopify, Square and Stripe. Webhook retries and a sandbox are not evidenced, and rate limits are documented only for individual endpoints, which holds this below the top. 14 13 5 1
The Deliverability Engineer
Over 300 integrations included in every plan, named two-way sync with Salesforce and a Shopify connection, and two documented APIs — marketing (version 3.0.91, batch operations, list webhooks) and transactional (raw MIME sending, scheduled mail, SMS, subaccounts, inbound routes, tracking domains). Per-endpoint rate limits are stated and deprecation is practised openly, with the legacy export API given an end date; we found no public information on a sandbox or documented webhook retries. 1 2 5 13 14
The Data Protection Officer
Over 300 integrations include a two-way Salesforce sync plus Shopify, Stripe, Square and Zapier, and there is a documented Marketing API at version 3.0 with batch operations, list webhooks and inbound events, alongside a separate transactional API with its own webhooks and stated per-method rate limits. Marketing and transactional sending sit on two APIs rather than one, and we found no public information on webhook retries or a sandbox. 1 2 5 13 14
The Shop Owner
This is the connection surface I want behind my counter: named connectors for Shopify, Square, Stripe and Lightspeed, a two-way Salesforce sync, an e-commerce store API feeding carts and orders into abandoned-cart journeys, list and batch webhooks with full management endpoints, batch operations, and both marketing and transactional sending on documented, versioned APIs with a stated rate limit on the search endpoint. We found no public information on a sandbox or on documented webhook retries, which is what keeps this just under the next rung. 1 5 13 14
The Integrator
A versioned Marketing API at 3.0.91 with batch operations, list webhooks for core subscriber events, an events endpoint to trigger automations and a health check, next to a transactional API taking raw MIME, scheduling sends, managing subaccounts and documenting a rate limit of 20 calls per minute for message search; Shopify, Salesforce, Stripe and Square are named among 300+ apps with Salesforce described as two-way sync. Deprecation is practised with dates in public documentation — the legacy Export API was given a retirement date and Conversations endpoints were deprecated in favour of Inbox — but we found no public information on a sandbox, webhook retry behaviour, or general rate limits for the marketing API, which is exactly the documentation a builder needs before committing. 5 13 14 2 1
The Skeptic
Named integrations for the shops and CRMs that matter — Shopify, Square, Lightspeed, a two-way Salesforce sync — across 300+ apps, with marketing and transactional APIs, webhooks in both directions and batch operations. We found no public information on a sandbox or webhook retries, and rate limits appear only for a single search method at 20 calls per minute. 1 13 14 5
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where subscriber data and behavioural tracking live, who the contracting entity is, and which subprocessors touch the send. Independently sourced by the sovereignty pipeline; scored here as this buyer weighs it — which in this category is heavily.
0 — US vendor and contracting entity, US hosting, subprocessors unnamed; subscriber behaviour leaves the EU with no stated basis.
3 — EU hosting offered as an option or for storage only, while sending, tracking or support access remains non-EU, or the subprocessor list is absent.
5 — EU hosting as standard and an EU contracting entity, but parts of the chain — sending infrastructure, analytics, support tooling — are non-EU without an explained safeguard.
8 — EU or DACH hosting with a named data-centre provider, EU contracting entity, complete subprocessor list published, and any non-EU processing named with its legal basis.
10 — Sovereign end to end and evidenced: vendor, entity, hosting, sending and every subprocessor in the EU, certification published, and no transfer that needs a Schrems II argument to survive.
The CRM Manager
The contracting entity is The Rocket Science Group LLC under Intuit Inc. in the US, US hosting is the fixed default with no EU option anywhere on the captured pages, and no subprocessor list is published on the vendor's own pages. Standard contractual clauses in the data processing addendum and annual Data Privacy Framework certification state a transfer basis, and under that basis session replay through US providers, export files hosted with Google and named third-party API providers all touch the chain — this survives, if at all, on a transfer argument rather than sovereignty. 4 3 12
The Deliverability Engineer
Sovereign this is not: the contracting entity is The Rocket Science Group LLC under Intuit Inc. in Mountain View, US storage is the fixed default with no EU hosting option on any captured page, and even export files are hosted by Google. Transfers do carry a stated basis — annual EU-US Data Privacy Framework certification with SCCs folded into the data processing addendum as fallback — and some processors are named, but we found no public information confirming a complete subprocessor list, and session replay runs through FullStory and Medallia. 3 4 12
The Data Protection Officer
The contracting entity is US-based (The Rocket Science Group under Intuit), US hosting is the fixed default with no EU option offered anywhere in the captured pages, and the entire transfer story rests on Data Privacy Framework certification with standard contractual clauses as fallback — exactly the argument I would have to make rather than avoid. No subprocessor list is published on the vendor's own pages; the privacy statement names FullStory, Medallia and generative-AI providers touching the data, and export files are themselves hosted by Google. 3 4 12
The Shop Owner
Everything contractual points west: Intuit Inc. and The Rocket Science Group are the entities, storage sits in the US, and we found no public information on an EU hosting option or a published subprocessor list for the platform — the privacy statement instead names US services such as FullStory, Medallia and Google-hosted export files touching my subscribers' behaviour. The Standard Contractual Clauses in the data processing addendum and the Data Privacy Framework certification give a stated legal basis for the transfer, which is the only thing lifting this off the floor for me; as a buyer who weighs this heavily, it is disqualifying for a list I actually own. 3 4 12
The Integrator
Intuit Inc. is the US contracting entity, hosting is US by fixed default with no EU region offered in the captured pages, and a subprocessor list for the service is not published — names appear only incidentally, such as Google hosting export files and FullStory and Medallia for session replay. Transfers do carry a stated basis, with annual EU-US Data Privacy Framework certification and standard contractual clauses integrated into the data processing addendum as a fallback, which is the only reason this rises off the floor. 4 3 12
The Skeptic
US contracting entity under Intuit, US hosting with no EU option anywhere on the captured pages, and no published subprocessor list — names like Twilio, FullStory, Medallia and Google appear only incidentally in the privacy statement. Transfers do carry a stated basis (annual DPF certification with SCCs as contractual fallback), which is more than nothing, but the entire structure rests on the framework this buyer does not trust, and this category weighs it heavily. 4 3 12
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a sender can compute the real invoice for their list size and send volume — including overage, extra domains and automation limits — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — A headline price per contact tier exists, but send limits, overage rates or the tier where automation begins are not stated.
5 — Contact-tier prices public with the billing period stated and send limits given, but at least one commonly needed capability sits in an unpriced tier or add-on.
8 — Every tier priced publicly with contact and volume limits, overage rates, feature boundaries and VAT treatment stated; only genuinely custom volume lacks a number.
10 — Complete price computability: a calculator producing the annual invoice for a given list size and send frequency, including overage, additional domains and dedicated IPs.
The CRM Manager
Monthly from-prices and send limits are public per plan — Standard at up to 6,000 emails a month, Premium at 150,000 — and the comparison table shows flow points, audiences, seats and feature boundaries per tier. The captured pages give different figures for the Essentials and Standard monthly prices (€11.50 against €11.34, and €17.45 against €17.68), the overage is stated only as extra costs with no rate, and I found no public information on the Premium tier's price, SMS add-on pricing, or VAT treatment. 2 2 1 1
The Deliverability Engineer
Monthly prices are public with send limits per plan, automation flow depth per tier, and feature boundaries down to audiences, seats and onboarding sessions — enough to price the shape of a plan before talking to anyone. But overage is only ever stated as extra costs applying when limits are exceeded, we found no public information on VAT treatment or a Premium price figure, and the captured pages give different figures for the same plans — Standard at €17.45/Monat and at €17.68/Monat, Essentials at €11.34/Monat and at €11.50/Monat — which we do not choose between. 2 1 2
The Data Protection Officer
Monthly from-prices are public per tier with send limits stated (Standard up to 6,000 emails, Premium 150,000), feature tables show where flows, audiences and seats begin, and annual plans, pay-as-you-go and a free tier under 250 contacts are documented. Overage is announced but its rate is not stated, SMS credits and high-volume plans above 200,000 contacts are price-on-request, no VAT treatment is given, and the captured pages give different figures for the same tier — Essentials from €11.34 and from €11.50, Standard from €17.45 and from €17.68. 1 2 1 2
The Shop Owner
Headline prices, send limits and a plan comparison are public — free under 250 contacts, Essentials from €11.34 /Monat on one captured page and €11.50 /Monat on another, Standard likewise €17.45 and €17.68, with 5,000 / 6,000 / 150,000 monthly sends across the paid tiers — but the captured pages give different figures for the same plans, overage is announced without a rate, and contact sales is required above 200,000 contacts on one page and 250,000 on another. With SMS sold as an unpriced, approval-gated add-on, automation gated to higher tiers and no VAT treatment or invoice calculator stated, I cannot compute my real monthly invoice from these pages alone. 1 2 1 2 6
The Integrator
Headline prices are public — Essentials from €11.50 per month and Standard with up to 6,000 emails a month in one capture, while earlier captures give €11.34 and €17.45 for the same plans — alongside per-plan send limits, flow points, seats, a free tier under 250 contacts, annual plans above 10,000 contacts, pay-as-you-go credits and a 15% nonprofit discount. A real invoice still cannot be computed from these pages: we found no public information on the overage rate, VAT treatment, a monthly price for the Premium tier, or a price calculator, the SMS add-on requires an application and approval without showing a price, Customer Success appears only in custom plans from USD 299 per month, and the captured pages describe both sending paused at the limit and overage fees applying. 2 2 1 1
The Skeptic
Headline monthly prices and per-tier send limits are public — Standard with 6,000 emails per month, the captured pages giving different figures for Essentials (€11.34 versus €11.50 per month) and Standard (€17.45 versus €17.68 per month) — with feature gating laid out per tier. Overage rates, VAT treatment and the price of the SMS add-on, dedicated IPs and high-volume plans are not stated, and the captured pages describe exceeding the limit both as incurring extra costs and as paused sending. 2 2 1 1
European sovereignty — proven facts
1 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Foreign-controlled ⚠ unverified | 0/2 pts | 4 Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 30 Aug 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Ownership. The page states Mailchimp belongs to Intuit but does not describe the parent's listing or capital structure; foreign-controlled rests on Intuit Inc., the US parent also named in the S1 privacy statement.
- Weak sourcing — Legal entity, Data residency, Subprocessors. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 76 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 73 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 32 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 12 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 11 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (14)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage mailchimp.com Checked 5 Oct 2026 +6 earlier captures: 28 Sep 2026, 16 Sep 2026, 15 Sep 2026, 11 Sep 2026, 30 Aug 2026, 30 Aug 2026 Details →
- 2 Pricing mailchimp.com Checked 5 Oct 2026 +5 earlier captures: 28 Sep 2026, 16 Sep 2026, 15 Sep 2026, 11 Sep 2026, 30 Aug 2026 Details →
- 3 Privacy policy mailchimp.com Checked 5 Oct 2026 +1 earlier capture: 11 Sep 2026 Details →
- 4 Security / trust page mailchimp.com Checked 5 Oct 2026 Details →
- 5 Campaigns & automation — found from sitemap mailchimp.com Checked 5 Oct 2026 Details →
- 6 Campaigns & automation — found from sitemap mailchimp.com Checked 5 Oct 2026 Details →
- 7 Deliverability infrastructure — found from sitemap mailchimp.com Checked 5 Oct 2026 Details →
- 8 Deliverability infrastructure — found from sitemap mailchimp.com Checked 5 Oct 2026 Details →
- 9 Consent, proof & tracking limits — found from sitemap mailchimp.com Checked 5 Oct 2026 Details →
- 10 Consent, proof & tracking limits — found from sitemap mailchimp.com Checked 5 Oct 2026 Details →
- 11 List ownership, import & exit — found from sitemap mailchimp.com Checked 5 Oct 2026 Details →
- 12 List ownership, import & exit — found from sitemap mailchimp.com Checked 5 Oct 2026 Details →
- 13 Integrations & API — found from sitemap mailchimp.com Checked 5 Oct 2026 Details →
- 14 Integrations & API — found from sitemap mailchimp.com Checked 5 Oct 2026 Details →