Email Marketing & Newsletter
MailUp
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by MailUp S.p.A. · www.mailup.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
MailUp at a glance
- Vendor
- MailUp S.p.A.
- Headquarters
- Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 20 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 20 Oct 2026
- Panel verdict
- The AI panel rates MailUp 2.5/5, the mean of 6 judges. MailUp is an email and SMS marketing platform contracted through TeamSystem S.p.A. how scores are made
- As of
- Vendor pages captured 20 Oct 2026; evaluated by the panel 21 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
MailUp is an email and SMS marketing platform contracted through TeamSystem S.p.A. of Pesaro, Italy, hosted on Azure and AWS located in the European Union. Strongest are consent and proof, at 6 from five of six judges, and list data control at 5-6, resting on confirmed (re)registration, individually toggleable privacy features and CSV-over-SFTP export of subscribed and unsubscribed contacts. Campaign and automation holds at 5-6; A/B reports show per-variant counts, not significance. Among product criteria, weakest is integrations, at 4 from four of six judges: REST and SOAP APIs and shop connectors exist, but CRM appears only generically, with no public information on webhooks, rate limits or a sandbox. The genuine split is sovereignty, spanning 4 to 7 — the skeptic holds at 4, weighing US cloud parents and unconfirmed subprocessor exposure; the other judges sit at 6 to 7 on the named Italian entity, EU hosting, an appointed Data Protection Officer and the Article 28 agreement. Deliverability spans 4 to 6 on the same facts, weighed differently. Pricing transparency sits at 2; the model is public, figures are not.
Speaks for it
- Bounce and complaint handling is documented concretely — automatic unsubscribes on hard bounces, feedback loops with Yahoo!, AOL and Hotmail, and shared plus dedicated whitelisted IPs monitored by a named deliverability team
- Subscriber and unsubscribe data leaves as automated CSV over SFTP — incremental or full reports, across one, some or all lists — so unsubscribe state stays portable
- Rights handling is itemised — (re)registration with confirmation, individually toggleable privacy features, opt-out from tracking and profiling, and complete deletion of a recipient
- A/B testing is well specified — variants across subject, CTA, images and header, samples of 5 to 30 percent of subscribers, open- or click-rate success criteria, automatic or manual winner dispatch
- The captured pages name a European contracting entity — TeamSystem S.p.A. of Pesaro — with the platform on Azure and AWS located in the European Union, an appointed Data Protection Officer and an Article 28 data processing agreement in section 2.3 of the license
Held against it
- Authentication is documented only as customising email authentication with your own domain; we found no public information naming SPF, DKIM or DMARC setup, IP warm-up, inbox-placement testing or list-hygiene guidance
- We found no public information on what a stored consent record contains — source, IP or the wording consented to — or on whether confirmed opt-in is the default
- Export covers contacts and unsubscribe state; we found no public information on exporting engagement history, campaigns or templates
- We found no public information on webhooks, documented rate limits or a sandbox, and CRM, CMS, ERP and business-intelligence integrations are named only generically
- We found no published subprocessor list, and transfer safeguards are named only as adequacy decisions and Standard Contractual Clauses without saying which processing they cover
Best for
- You run GDPR-heavy lists and need documented double opt-in capability, a preference centre where privacy features toggle individually, and complete recipient deletion
- You send large or growing lists against a fixed annual cost — the model charges by edition and sending speed, with unlimited recipients at no additional cost and no email volume limits
- Your shop is Magento 2, Drupal Commerce or 4-Tell, or you integrate through REST or SOAP APIs
- You need unsubscribe state mirrored into your CRM or shop system automatically — dedicated services deliver CSV reports to your own SFTP, and a free trial of up to 1,000 total sends requires no payment details
Avoid if
- You need minute-scale reactions to shopper behaviour such as abandoned carts — the documented outbound path between shop and platform is batch CSV over SFTP rather than webhooks
- You must compare vendors on published prices before shortlisting — the captured pages explain the pay-per-speed model but show no figure for any edition or sending speed
- You need significance-tested A/B reporting — the documented reports show total and per-variant counts against best open or click rate, not significance
- Your data policy rules out US-owned cloud — the platform runs on Azure and AWS, US-parent companies as the dissenting sovereignty judge notes, with transfer safeguards stated only as adequacy decisions and Standard Contractual Clauses
The scores
| Criterion | Panel median |
|---|---|
| Campaigns & automation | 3 of 5 |
| Deliverability infrastructure | 3 of 5 |
| Consent, proof & tracking limits | 3 of 5 |
| List ownership, import & exit | 3 of 5 |
| Integrations & API | 2 of 5 |
| European sovereignty | 3 of 5 |
Campaigns & automation
Show reasoningHide reasoning
How this is scored
Building the mail and the journey around it: editor, templates, segmentation, triggered sequences, A/B testing.
0 — One-off broadcasts from a fixed template; no segmentation and no automation of any kind.
3 — A drag-and-drop editor and simple list segmentation, but automation is a single welcome mail and there is no testing.
5 — Reusable templates, attribute and behaviour segmentation, multi-step automations on common triggers, and subject-line A/B testing.
8 — A visual journey builder with branching on behaviour and data, dynamic content per segment, send-time optimisation, and testing that reports significance rather than raw counts.
10 — Journeys treat the whole lifecycle: event-driven entry from other systems, branching on any attribute or event, holdout groups for measurement, and automations a marketer can read months later without a diagram.
The CRM Manager
There is a drag-and-drop editor with a ChatGPT-based writing assistant, combinable advanced segmentation filters, and automatic cross-channel workflows built in a drag-and-drop interface covering Messenger and Telegram. The A/B testing is genuinely there — variants on subject, CTA, images and header, sample shares from 5 to 30 percent, timed winner dispatch automatic or manual — but the reported outcome is total and per-variant counts against best open or click rate, not significance. We found no public information on branching journeys on behaviour or data, dynamic content per segment, or send-time optimisation. 1 3 4
The Deliverability Engineer
The drag-and-drop editor with an AI assistant, advanced segmentation filters and cross-channel workflows spanning Messenger and Telegram are documented, and A/B testing is real: variants across subject, CTA, images and header, samples of 5 to 30% of subscribers, open- or click-rate success criteria, and automatic winner sending after a set interval. It stops short of the top: the reports give total and per-variant send counts rather than significance, and we found no public information on branching journeys, dynamic content per segment or send-time optimisation. 1 3 4
The Data Protection Officer
A drag-and-drop editor with an AI assistant, advanced segmentation filters, and automatic cross-channel workflows covering Messenger and Telegram meet the journey basics, and A/B testing extends beyond subject lines to CTAs, images and headers with automatic winner dispatch on open or click rate. We found no public information on branching on behaviour or data, dynamic content per segment, send-time optimisation or significance-tested reporting; the documented test reporting shows totals and per-variant detail. 1 4
The Shop Owner
A drag-and-drop editor with a ChatGPT-based assistant, combinable segmentation filters, cross-channel automated workflows and an A/B test with variant design, 5-30% samples and automatic winner sending are all documented. The A/B reporting shows totals per variant rather than significance, and we found no public information on behavioural triggers such as abandoned carts, branching on order data, or dynamic content per segment. 1 3 4
The Integrator
A drag-and-drop workflow builder runs scheduled and cross-channel automations including Messenger and Telegram, segmentation filters are documented as advanced, and A/B testing is unusually well specified — variant scope across subject, CTA and images, sample percentages, duration, automatic or manual winner selection — though the reporting shown is per-variant counts rather than significance. We found no public information on branching on recipient behaviour, dynamic content per segment, or send-time optimisation. 1 4
The Skeptic
A drag-and-drop editor with an AI assistant, advanced segmentation filters, scheduled cross-channel workflows and a properly parameterised A/B test (5–30% samples, open or click success criteria, timed winner send) sit squarely at the middle of this scale. I found no public information on journeys branching on behaviour or data, dynamic content per segment, or send-time optimisation, and the A/B reporting shows per-variant counts rather than significance. 1 4
Deliverability infrastructure
Show reasoningHide reasoning
How this is scored
Whether the mail arrives — authentication, sending reputation, bounce and complaint handling — judged on what the vendor documents rather than the inbox rate it advertises.
0 — No documentation of authentication or bounce handling; deliverability appears only as a marketing number.
3 — SPF and DKIM setup documented, but no DMARC guidance, no stated bounce policy and shared sending only.
5 — SPF, DKIM and DMARC documented with a custom sending domain, automatic hard-bounce suppression, and complaint-loop handling stated.
8 — The above plus dedicated-IP options with a documented warm-up, seed or inbox-placement testing, engagement-based sunsetting, and published guidance on list hygiene.
10 — Deliverability is operated as a service: reputation monitoring surfaced to the customer, per-domain and per-ISP diagnostics, enforced authentication before first send, and postmaster or blocklist handling the vendor documents doing on the customer's behalf.
The CRM Manager
Bounce and complaint handling are documented rather than advertised: soft and hard bounces, failed deliveries and feedback loops managed automatically with hard-bounce auto-unsubscribes, spam-button complaints triggering immediate unsubscribe with Yahoo!, AOL and Hotmail, and both shared and dedicated whitelisted IPs monitored by a named deliverability team. The documented authentication is customising email authentication with your own domain; we found no public information naming SPF, DKIM or DMARC setup, nor on IP warm-up, inbox-placement testing or engagement-based sunsetting. 5 6
The Deliverability Engineer
Bounce discipline is documented properly — soft and hard bounces and failed deliveries handled automatically, hard bounces auto-unsubscribed, and feedback-loop agreements with Yahoo!, AOL and Hotmail that unsubscribe on a spam-button click, with the complaint list editable and exportable. Shared and dedicated IPs are whitelisted and constantly monitored by a dedicated deliverability team, and custom-domain authentication is offered, but the captured pages never name SPF, DKIM or DMARC, and we found no public information on IP warm-up, inbox-placement testing, engagement-based sunsetting or list-hygiene guidance. I discard the advertised best-on-market delivery rates on principle; the documented infrastructure is what earns six. 5 6
The Data Protection Officer
Soft and hard bounce handling, failed-delivery management, feedback loops with Yahoo!, AOL and Hotmail that unsubscribe complainers automatically, and shared plus dedicated whitelisted IPs monitored by a dedicated deliverability team are all documented, alongside a stated refusal to send to rented or purchased lists. Authentication is documented only as custom-domain authentication: we found no public information naming SPF, DKIM or DMARC setup, IP warm-up, seed or inbox-placement testing, or engagement-based sunsetting. 3 5 6
The Shop Owner
Bounce and complaint handling are documented and strong — automatic unsubscribes on hard bounces and feedback-loop agreements with major webmail providers — plus shared and dedicated IPs monitored by an in-house deliverability team. The authentication documentation stops at custom-domain authentication without naming SPF, DKIM or DMARC, and we found no public information on IP warm-up, inbox-placement testing or list-hygiene guidance. 5 6
The Integrator
Bounce and complaint handling is concrete: soft and hard bounces are managed automatically with auto-unsubscribe, feedback loops with major mailbox providers trigger automatic unsubscription, and email authentication can be customised to the sender's own domain, with shared and dedicated IPs monitored by a named deliverability team. We found no public information naming SPF, DKIM or DMARC setup, IP warm-up, inbox-placement testing, or published list-hygiene guidance. 5 6
The Skeptic
Bounce and complaint handling are documented properly: automatic hard-bounce suppression, feedback-loop agreements that auto-unsubscribe complainers at Yahoo!, AOL and Hotmail, and shared plus dedicated whitelisted IPs monitored by a named deliverability team. But the only authentication statement is that you can customise email authentication with your own domain — I found no public information naming SPF, DKIM or DMARC setup, and nothing on warm-up, seed testing or list hygiene. The homepage's 'delivery rates that are among the best on the market' is exactly the marketing number I refuse to score. 1 5 6
Consent, proof & tracking limits
Show reasoningHide reasoning
How this is scored
How subscribers arrive and what the sender can prove afterwards: double opt-in, logged consent, unsubscribe handling, and whether open and click tracking can be limited or switched off.
0 — Single opt-in with no consent record; tracking is always on and cannot be disabled.
3 — Double opt-in available but not the default, and the consent record is a timestamp without the source, IP or the wording consented to.
5 — Double opt-in as the documented default with a stored consent record including source and timestamp, one-click unsubscribe, and tracking that can be turned off per campaign.
8 — Consent is reproducible as evidence: the confirmation mail and form wording versioned and retrievable per subscriber, unsubscribe honoured across lists, tracking off-by-default available, and retention rules for inactive subscribers.
10 — Built for the burden of proof: a per-subscriber consent history an authority would accept, documented handling of Art. 15 access and Art. 17 erasure requests, pixel-free and link-tracking-free sending as a supported mode, and preference-centre granularity rather than all-or-nothing.
The CRM Manager
Double opt-in appears as registration with confirmation, recipients can opt out of every form of tracking and profiling through a preference centre where each privacy feature is enabled individually, and access, portability, rectification and complete deletion of a recipient are all documented. The proof layer is what I cannot see: we found no public information on what the consent record stores or whether form and confirmation wording is versioned and retrievable per subscriber, nor on unsubscribe being honoured across lists. 2 7
The Deliverability Engineer
Double opt-in appears as (Re)Registration with confirmation among the documented GDPR tools, alongside a Profile Management Centre, definitive deletion of personal data, export for access requests, and a Preferences Centre where privacy functions are enabled individually and recipients can opt out of tracking and profiling. What a sender needs as proof is missing: we found no public information on what the consent record stores — source, IP or versioned form wording — nor on one-click unsubscribe or tracking switched off per campaign or by default. 2 7
The Data Protection Officer
Registration with confirmation, a preference centre where privacy features can be enabled individually, an opt-out from every form of tracking and profiling, definitive deletion of personal data, and documented handling of access, portability, rectification and erasure requests are all evidenced. What is missing is the proof a complaint demands: we found no public information on what the stored consent record contains, on versioned confirmation or form wording retrievable per subscriber, on whether double opt-in is the default, or on retention rules for inactive subscribers. 2 7
The Shop Owner
Confirmed registration, definitive deletion of personal data and a preferences centre where each recipient can opt out of tracking and profiling are documented, with access, erasure, portability and rectification handling spelled out. We found no public information on what the consent record stores — source, timestamp or the wording consented to — or that confirmed opt-in is the default rather than a feature enabled individually. 2 7
The Integrator
Double opt-in is offered as registration with confirmation, access, erasure, portability and rectification are each documented with the platform feature that serves them, and recipients can opt out of tracking and profiling through a preference centre whose privacy features are enabled individually. We found no public information on what the stored consent record contains, whether double opt-in is the default, or on pixel-free sending. 2 7
The Skeptic
The rights toolkit is documented: confirmed (re)registration, a Profile Management Centre with individually toggleable privacy features, and stated handling of access, erasure, portability, rectification and objection to tracking and profiling. What I did not find is what a consent record actually stores — source, IP, the wording consented to — nor whether confirmed opt-in is the default, sender-side per-campaign tracking limits, or retention rules for inactive subscribers; the burden-of-proof layer is asserted rather than shown. 2 7
List ownership, import & exit
Show reasoningHide reasoning
How this is scored
Whether the list and its history remain the sender's: import with attributes intact, full export including engagement history, deletion that executes, and no metering that prices leaving out of reach.
0 — Export is addresses only; engagement history, segments and automations cannot leave.
3 — CSV import and export of subscriber fields, but engagement history and unsubscribe state are not exportable.
5 — Full subscriber export including custom attributes, subscription status and unsubscribe state, plus API access sufficient to sync elsewhere.
8 — Everything exportable in open formats — subscribers, engagement history, campaigns and templates — with documented deletion of a subscriber across all records, and no export throttling.
10 — Exit is a documented feature: full-fidelity export of the whole account, contractual data return, deletion that is evidenced rather than asserted, and migration tooling in both directions.
The CRM Manager
Subscriber and unsubscribe exports exist as dedicated services delivering CSV over SFTP covering one, some or all lists with incremental or full runs, alongside an in-platform Recipients export and documented complete deletion of a recipient. We found no public information on exporting engagement history, segments, campaigns or templates, so I cannot confirm the list's history leaves with the addresses. 7 9 10
The Deliverability Engineer
Subscriber export is available at any time from the recipients area, and dedicated automated services deliver CSV reports of both subscribed and unsubscribed contacts to SFTP for CRM and e-commerce alignment, incremental or full, across one, some or all lists — so unsubscribe state leaves with the list. Deletion is documented as complete recipient removal or an oblivion-compatible unsubscribe mode. We found no public information on exporting engagement history, campaigns or templates, and the export services run under their own terms with no stated price, so leaving is possible but not demonstrably frictionless. 7 9 10 11
The Data Protection Officer
Subscriber data can be exported at any time from the platform, and dedicated SFTP sync services export both subscribed and unsubscribed contacts — incremental or full, across one, some or all lists, self-configured — which together with the REST and SOAP APIs keeps the list and its unsubscribe state portable. We found no public information on exporting engagement history, campaigns or templates, nor on export throttling or a documented full-account exit; deletion of a recipient is offered as a capability but nothing evidences its execution across all records. 7 9 10 11
The Shop Owner
Export is treated as a real service: automated CSV export of subscribed and unsubscribed contacts with incremental or full reports delivered to my own SFTP, so unsubscribe state leaves with the list, and definitive data deletion is documented as a feature. We found no public information on exporting engagement history, campaigns or templates, so on the evidence shown the commercial memory of my list stays inside the platform. 7 9 10
The Integrator
Subscriber and unsubscribe exports are automated services delivering CSV to SFTP with incremental or full reports, selectable list scope and self-service configuration, and complete deletion of a recipient is documented alongside the export rights. We found no public information on exporting engagement history, campaigns or templates, or on export throttling. 9 10 2
The Skeptic
Exit tooling exists: automated CSV-over-SFTP export services for subscribed and unsubscribed contacts with incremental or full modes, an in-platform export function, and documented complete deletion of a recipient as a right-to-be-forgotten option. I found no public information on exporting engagement history, campaigns or templates, or on export throttling, so what leaves the platform is contacts and unsubscribe state, not the account's working history. 2 7 9 10
Integrations & API
Show reasoningHide reasoning
How this is scored
The connection surface a newsletter lives on: shop and CRM systems, events in and out, webhooks, and an API somebody can build against without a partner agreement.
0 — No API and no named integrations; the list is maintained by CSV upload.
3 — A handful of native integrations and a read-mostly API, with no webhooks and no documented rate limits.
5 — Named integrations for common shop and CRM systems, a documented REST API with keys, and webhooks for the core subscriber events.
8 — Maintained bidirectional integrations with named systems including at least one major shop platform, event webhooks with retries, documented rate limits, and a sandbox.
10 — The tool is a component rather than a destination: transactional and marketing sending on one API, events flowing both directions, versioned API with a deprecation policy, and integrations the vendor maintains rather than lists.
The CRM Manager
Named shop connectors for Magento 2, Drupal Commerce and 4-Tell, a WordPress subscription-form plugin, and REST plus SOAP APIs covering subscriptions, updates and campaign creation make the surface usable, with a developer platform for publishing or selling integrations. We found no public information on webhooks, documented rate limits or a sandbox, and CRM systems are named only generically. 1 11
The Deliverability Engineer
Magento 2, Drupal Commerce and 4-Tell connectors, a WordPress subscription plugin, REST and SOAP APIs covering subscriptions, updates and campaign creation, bidirectional SFTP data sync, and a developer platform for publishing integrations give a genuine connection surface. We found no public information on webhooks, documented rate limits or a sandbox, which caps this below the top band. 1 9 11
The Data Protection Officer
Named e-commerce connections to Magento 2, Drupal Commerce and 4-Tell, integration categories spanning CRM, CMS, ERP and business-intelligence, write-capable REST and SOAP APIs covering subscriptions, updates and campaign creation, plus a WordPress plugin and a developer platform for publishing or selling integrations, make this a workable connection surface. We found no public information on webhooks, documented rate limits, or a sandbox. 1 11
The Shop Owner
Magento 2, Drupal Commerce and 4-Tell are named shop connections, REST and SOAP APIs cover subscriptions, updates and campaign creation, and a developer platform lets integrations be published or sold. The event path between shop and platform is batch CSV over SFTP rather than real-time events, and we found no public information on webhooks, documented rate limits or a sandbox — which an abandoned-cart flow needs to react in minutes, not overnight. 1 9 11
The Integrator
There is a REST and SOAP API covering subscriptions, updates and campaign creation, named e-commerce connections for Magento 2 and Drupal Commerce, and a developer platform where the community publishes integrations — but the outbound event surface is batch CSV over SFTP rather than webhooks, and CRM systems appear only as unnamed categories. We found no public information on rate limits, webhook retries, a sandbox, or a deprecation policy. 11 1
The Skeptic
The REST and SOAP APIs handle subscriptions, updates and campaign creation — real writes, not a read-only surface — alongside named shop connectors (Magento 2, Drupal Commerce, 4-Tell), a WordPress plugin, and a marketplace where developers publish or sell integrations. But CRM, CMS, ERP and BI integrations are named only generically, and I found no public information on webhooks, documented rate limits or a sandbox, which holds this below the middle of the scale. 1 11
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Where subscriber data and behavioural tracking live, who the contracting entity is, and which subprocessors touch the send. Independently sourced by the sovereignty pipeline; scored here as this buyer weighs it — which in this category is heavily.
0 — US vendor and contracting entity, US hosting, subprocessors unnamed; subscriber behaviour leaves the EU with no stated basis.
3 — EU hosting offered as an option or for storage only, while sending, tracking or support access remains non-EU, or the subprocessor list is absent.
5 — EU hosting as standard and an EU contracting entity, but parts of the chain — sending infrastructure, analytics, support tooling — are non-EU without an explained safeguard.
8 — EU or DACH hosting with a named data-centre provider, EU contracting entity, complete subprocessor list published, and any non-EU processing named with its legal basis.
10 — Sovereign end to end and evidenced: vendor, entity, hosting, sending and every subprocessor in the EU, certification published, and no transfer that needs a Schrems II argument to survive.
The CRM Manager
The contracting entity is TeamSystem S.p.A. of Pesaro, Italy, and the platform runs on Azure and AWS located in the European Union, with encryption at rest by default and data-centre providers I can name. We found no published subprocessor list, and the only transfer protection described is generic adequacy decisions and standard contractual clauses, leaving any processing outside the EU unnamed — a real gap for a buyer who weighs this heavily. 2 3 8
The Deliverability Engineer
The contracting entity is TeamSystem S.p.A. of Pesaro with an Italian VAT number, the platform runs on Azure and AWS located in the European Union, a Data Protection Officer is appointed, and the Article 28 agreement sits inside the license terms — vendor, entity, hosting and named data-centre providers are European. What stops it higher: no complete subprocessor list is published and transfers are covered only generically by adequacy decisions and Standard Contractual Clauses, so I cannot enumerate who else touches the send. 2 3 8
The Data Protection Officer
TeamSystem S.p.A. of Pesaro is the named entity, the platform runs on Azure and AWS located in the European Union with encryption at rest by default, a Data Protection Officer is appointed and an Article 28 agreement sits in the licence — as described, the send stays inside the EU. The privacy pages cite adequacy decisions and Standard Contractual Clauses as safeguards without naming which processing they apply to, and we found no public information on a complete published subprocessor list or on the group's ownership. 2 3 8
The Shop Owner
The captured pages state an Italian contracting entity, TeamSystem S.p.A. of Pesaro, and EU data centres on named providers Azure and AWS, with a Data Protection Officer and an article 28 processing agreement in the license. We found no public information on a published subprocessor list, and the transfer safeguards named — adequacy decisions and standard contractual clauses — are stated without naming which processing sits outside the EU. 2 3 7 8
The Integrator
The contracting entity is TeamSystem S.p.A. in Pesaro, Italy, and the platform runs on Azure and AWS located in the European Union, with adequacy decisions and Standard Contractual Clauses named as transfer safeguards. We found no published subprocessor list and no public information on certifications held by MailUp itself; the certifications shown belong to the cloud providers. 3 8 2
The Skeptic
The captured pages name an Italian contracting entity, TeamSystem S.p.A. of Pesaro, and place the platform on Azure and AWS 'localizzate nell'Unione Europea', with an art. 28 DPA, an appointed DPO and SCC or adequacy safeguards. But both cloud parents are US companies, the location of the sending infrastructure is never addressed separately from the platform, I found no published subprocessor list, and the independently sourced sovereignty attributes — jurisdiction, ownership, residency, subprocessor exposure — are all listed as unknown. For a buyer who weighs this heavily, that is not enough to go past the middle of the scale. 2 3 7 8
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a sender can compute the real invoice for their list size and send volume — including overage, extra domains and automation limits — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — A headline price per contact tier exists, but send limits, overage rates or the tier where automation begins are not stated.
5 — Contact-tier prices public with the billing period stated and send limits given, but at least one commonly needed capability sits in an unpriced tier or add-on.
8 — Every tier priced publicly with contact and volume limits, overage rates, feature boundaries and VAT treatment stated; only genuinely custom volume lacks a number.
10 — Complete price computability: a calculator producing the annual invoice for a given list size and send frequency, including overage, additional domains and dedicated IPs.
The CRM Manager
The model is stated plainly — pay per speed, unlimited recipients at no extra cost, no cap on the number of emails sent, SMS charged only per message, and a 1,000-send trial requiring no payment details. But the captured pages give no figure for any edition or send speed, so I can describe the invoice's shape, not compute it; VAT treatment is also unstated. 1 3
The Deliverability Engineer
The model is public and unusual — pay per speed with no per-send limits, so sending more or larger messages never changes the cost, unlimited recipients at no additional charge, SMS strictly per message, and a trial capped at 1,000 sends with no payment card. But no captured page shows a single figure: the annual fee varies by edition and send speed with no published amounts, speed-price table or VAT treatment, so a sender cannot compute any invoice; custom developments and dedicated training are quote-only. 1 3
The Data Protection Officer
The charging model is stated clearly — an annual fee determined by edition and sending speed, no limit on email volume since more or larger messages do not change the cost, unlimited recipients at no additional cost, SMS paid per message, and a free trial capped at 1,000 total sends without payment details. We found no public information on what any edition or sending speed actually costs, so a buyer can see how they will be charged but cannot compute an invoice from the public pages. 1 3
The Shop Owner
The pricing model is explained publicly — pay per speed, unlimited recipients, unchanged cost when sending more or larger messages, SMS paid per message, and a free trial of up to 1,000 total sends without payment details — but the annual fee is said only to vary by edition and sending speed, and no figure for any edition appears on the captured pages. I cannot compute the invoice for my list size from this, and I price a tool against the revenue it attributes, which needs a number to divide by. 1 3
The Integrator
The model is explained publicly — pay per send speed, unlimited recipients at no additional cost, no email volume limits, SMS paid per message, and the annual fee varying by edition and send speed — but the captured pages show no price amounts, so no invoice can be computed for any list size. We found no public information on tier prices, edition costs, or VAT treatment. 3
The Skeptic
The model is documented — an annual fee varying with edition and send speed, unlimited recipients at no additional cost, no limit on the number of emails sent, and SMS at pay-per-message — but I found no public price figures at all: no edition prices, no speed-tier ladder, no per-message SMS rate, and custom developments quoted case by case. A buyer can describe the shape of the invoice but cannot compute a single number on it. 3
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Questions about MailUp
Is MailUp European?
Not determined: the vendor’s pages as captured do not say where MailUp is based.
Where does MailUp store data?
Not stated on the vendor’s pages as of 20 Oct 2026.
Does MailUp have a free plan?
Not stated on the vendor’s pages as of 20 Oct 2026.
What are the best alternatives to MailUp?
As of 21 Oct 2026, the panel rates Brevo (3/5), CleverReach (3/5) and Mailchimp (3/5) highest among the other 27 Email Marketing & Newsletter products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Brevo (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: MailUp alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 20 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 6 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (11)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.mailup.com Checked 20 Oct 2026 Details →
- 2 Privacy policy — found from the homepage mailup.com Checked 20 Oct 2026 Details →
- 3 Campaigns & automation — found from sitemap mailup.it Checked 20 Oct 2026 Details →
- 4 Campaigns & automation — found from sitemap mailup.it Checked 20 Oct 2026 Details →
- 5 Deliverability infrastructure — found from sitemap mailup.it Checked 20 Oct 2026 Details →
- 6 Deliverability infrastructure — found from sitemap mailup.it Checked 20 Oct 2026 Details →
- 7 Consent, proof & tracking limits — found from sitemap mailup.it Checked 20 Oct 2026 Details →
- 8 Consent, proof & tracking limits — found from sitemap mailup.it Checked 20 Oct 2026 Details →
- 9 List ownership, import & exit — found from sitemap mailup.it Checked 20 Oct 2026 Details →
- 10 List ownership, import & exit — found from sitemap mailup.it Checked 20 Oct 2026 Details →
- 11 Integrations & API — found from sitemap mailup.it Checked 20 Oct 2026 Details →