# MailUp — Email Marketing & Newsletter

MailUp by MailUp S.p.A. holds a panel rating of 2.5/5 from 6 AI judges (category median 2.5/5), as of 2026-10-21. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: MailUp S.p.A. (https://www.mailup.com)
- Category: [Email Marketing & Newsletter](https://whats-best.ai/software/email-marketing.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/email-marketing/mailup
- Alternatives: https://whats-best.ai/software/email-marketing/mailup/alternatives ([markdown](https://whats-best.ai/software/email-marketing/mailup/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-21 · oldest source captured 2026-10-20

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: MailUp S.p.A.
- Headquarters: Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 20 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 20 Oct 2026

## The panel's verdict

MailUp is an email and SMS marketing platform contracted through TeamSystem S.p.A. of Pesaro, Italy, hosted on Azure and AWS located in the European Union. Strongest are consent and proof, at 6 from five of six judges, and list data control at 5-6, resting on confirmed (re)registration, individually toggleable privacy features and CSV-over-SFTP export of subscribed and unsubscribed contacts. Campaign and automation holds at 5-6; A/B reports show per-variant counts, not significance. Among product criteria, weakest is integrations, at 4 from four of six judges: REST and SOAP APIs and shop connectors exist, but CRM appears only generically, with no public information on webhooks, rate limits or a sandbox. The genuine split is sovereignty, spanning 4 to 7 — the skeptic holds at 4, weighing US cloud parents and unconfirmed subprocessor exposure; the other judges sit at 6 to 7 on the named Italian entity, EU hosting, an appointed Data Protection Officer and the Article 28 agreement. Deliverability spans 4 to 6 on the same facts, weighed differently. Pricing transparency sits at 2; the model is public, figures are not.

**Speaks for it:**
- Bounce and complaint handling is documented concretely — automatic unsubscribes on hard bounces, feedback loops with Yahoo!, AOL and Hotmail, and shared plus dedicated whitelisted IPs monitored by a named deliverability team
- Subscriber and unsubscribe data leaves as automated CSV over SFTP — incremental or full reports, across one, some or all lists — so unsubscribe state stays portable
- Rights handling is itemised — (re)registration with confirmation, individually toggleable privacy features, opt-out from tracking and profiling, and complete deletion of a recipient
- A/B testing is well specified — variants across subject, CTA, images and header, samples of 5 to 30 percent of subscribers, open- or click-rate success criteria, automatic or manual winner dispatch
- The captured pages name a European contracting entity — TeamSystem S.p.A. of Pesaro — with the platform on Azure and AWS located in the European Union, an appointed Data Protection Officer and an Article 28 data processing agreement in section 2.3 of the license

**Held against it:**
- Authentication is documented only as customising email authentication with your own domain; we found no public information naming SPF, DKIM or DMARC setup, IP warm-up, inbox-placement testing or list-hygiene guidance
- We found no public information on what a stored consent record contains — source, IP or the wording consented to — or on whether confirmed opt-in is the default
- Export covers contacts and unsubscribe state; we found no public information on exporting engagement history, campaigns or templates
- We found no public information on webhooks, documented rate limits or a sandbox, and CRM, CMS, ERP and business-intelligence integrations are named only generically
- We found no published subprocessor list, and transfer safeguards are named only as adequacy decisions and Standard Contractual Clauses without saying which processing they cover

**Best for:**
- You run GDPR-heavy lists and need documented double opt-in capability, a preference centre where privacy features toggle individually, and complete recipient deletion
- You send large or growing lists against a fixed annual cost — the model charges by edition and sending speed, with unlimited recipients at no additional cost and no email volume limits
- Your shop is Magento 2, Drupal Commerce or 4-Tell, or you integrate through REST or SOAP APIs
- You need unsubscribe state mirrored into your CRM or shop system automatically — dedicated services deliver CSV reports to your own SFTP, and a free trial of up to 1,000 total sends requires no payment details

**Avoid if:**
- You need minute-scale reactions to shopper behaviour such as abandoned carts — the documented outbound path between shop and platform is batch CSV over SFTP rather than webhooks
- You must compare vendors on published prices before shortlisting — the captured pages explain the pay-per-speed model but show no figure for any edition or sending speed
- You need significance-tested A/B reporting — the documented reports show total and per-variant counts against best open or click rate, not significance
- Your data policy rules out US-owned cloud — the platform runs on Azure and AWS, US-parent companies as the dissenting sovereignty judge notes, with transfer safeguards stated only as adequacy decisions and Standard Contractual Clauses

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CRM Manager | The Deliverability Engineer | The Data Protection Officer | The Shop Owner | The Integrator | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Campaigns & automation | 2.5/5 | 3/5 | 3/5 | 2.5/5 | 3/5 | 2.5/5 |
| Deliverability infrastructure | 2.5/5 | 3/5 | 3/5 | 2/5 | 3/5 | 2/5 |
| Consent, proof & tracking limits | 3/5 | 3/5 | 3/5 | 2/5 | 3/5 | 3/5 |
| List ownership, import & exit | 2.5/5 | 3/5 | 2.5/5 | 2.5/5 | 3/5 | 3/5 |
| Integrations & API | 2/5 | 3/5 | 3/5 | 2/5 | 2/5 | 2/5 |
| European sovereignty | 3/5 | 3/5 | 3/5 | 3.5/5 | 3/5 | 2/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2.5/5** | **3/5** | **3/5** | **2.5/5** | **2.5/5** | **2.5/5** |

### The judges

- **The CRM Manager** (v1.0): Owns the lifecycle programme and measures it. Wants segmentation on real behaviour, journeys that branch, and testing that reports significance rather than a bigger number. Treats a tool that can only broadcast as a mailing list with invoicing.
- **The Deliverability Engineer** (v1.0): Cares about one number nobody publishes honestly: what reaches the inbox. Reads for authentication, IP and domain reputation, bounce discipline and sunsetting. Ignores every advertised delivery rate on principle — the infrastructure either is documented or it is not.
- **The Data Protection Officer** (v1.0): Signs off the tool that holds named people and records what each of them opened. Wants double opt-in with a proof that survives a complaint, tracking that can be switched off, and an answer to where the behavioural data lives that does not require a Schrems II argument.
- **The Shop Owner** (v1.0): Runs a shop where the newsletter is a revenue channel. Wants the shop connected properly — orders, carts, products flowing in, abandoned-cart and post-purchase flows out — and revenue attributed per campaign. Judges price against contribution, not against a competitor's tier.
- **The Integrator** (v1.0): Has to wire this into a stack that already exists. Wants a documented API with rate limits, webhooks that retry, a sandbox and a deprecation policy. Treats a partner-form integration page as a missing API, and reads "Zapier supported" as an outsourced one.
- **The Skeptic** (v1.0): Has seen every vendor claim 99% deliverability and GDPR compliance on the same page. Reads for the contact-tier staircase, the overage rate, the feature that begins two tiers up, and whether "EU hosting" covers the sending infrastructure or only the database.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Aes256: AES-256 [S8]
- Customer pentest: yes · yes [S8]
- Data controller role: Data Controller · own employees, advisors, suppliers, website form/newsletter users [S2]
- Data processor role: message contents · e-mail addresses · phone numbers · IP addresses · platform usage data · Data Processor · customer message sending [S2]
- DPA art 2 3: yes · art. 2.3 del contratto di licenza d'uso [S7]
- DPA article 28: art.28 GDPR · Section 2.3 of license agreement [S2]
- DPA GDPR alignment: art. 2.3 of license agreement · yes [S2]
- Dpia: Data Protection Impact Analysis · yes · yes [S8]
- Encryption at rest: yes [S8]
- Encryption protocols: TLS 1.2+ · sFTP · TLS 1.2+ [S8]
- EU datacenter: Data Loss Prevention (DLP) · Threat Protection · Test di Vulnerabilità periodici · yes [S7]
- GDPR: yes [S1]
- GDPR fully compliant: yes [S2]
- Infrastructure measures: yes · yes · periodic · Europe [S2]
- Page dates: 2026-05-28 · 2022-05-31 [S7]
- Pentest: WAPT · annual · yes [S8]
- Preferences center scope: Le funzionalità privacy della sezione possono essere abilitate singolarmente nel Centro Preferenze [S7]
- Provider certifications: ISO 27001 · SOC 1 · SOC 2 · SOC 3 [S8]
- Roles: contenuti dei messaggi, indirizzi email, numeri di telefono, indirizzi IP e dati generati dall'utilizzo della piattaforma · dati di dipendenti, consulenti, fornitori, users del sito [S7]
- Security assessments: yes [S1]
- Smtp starttls: yes · yes [S8]
- Transfer safeguards: adequacy decisions · Standard Contractual Clauses [S2]

**Data**
- Backups: yes · daily · 7 · yes [S8]

**Hosting**
- Data center: Microsoft Azure · AWS · European Union [S8]
- Physical security: yes · yes · yes [S8]

**Integrations**
- API scope: API REST e SOAP per iscrizioni, aggiornamenti e creazione campagne [S11]
- Ecommerce: Magento 2 · Drupal Commerce · 4-Tell [S11]
- Systems: Integrations with CRM, external databases, e-commerce, CMS, ERP, Business Intelligence systems [S1]
- Wordpress plugin: plugin WordPress per moduli di iscrizione sincronizzati con la piattaforma [S11]

**Legal**
- Company: 01035310414 · TeamSystem S.p.A. · Via Sandro Pertini 88, 61122 Pesaro (PU), Italia [S4]
- Company details: 01035310414 · Via Sandro Pertini 88, 61122 Pesaro (PU) – Italia · TeamSystem S.p.A. [S3]
- Company entity: Pesaro · TeamSystem S.p.A. · Italia [S5]
- Company entity: 01035310414 · TeamSystem S.p.A. · Via Sandro Pertini 88, 61122 Pesaro (PU), Italy [S6]
- Company entity: 01035310414 · TeamSystem S.p.A. · Via Sandro Pertini 88, 61122 Pesaro (PU) – Italia [S7]
- Document dates: 2026-05-28 · 2022-05-31 [S2]
- Effective date: 2024-03-11 [S10]
- Entity: IT01035310414 · Via Sandro Pertini 88, 61122 Pesaro (PU), Italy · TeamSystem S.p.A. [S1]
- Entity: 01035310414 · TeamSystem S.p.A. · Via Sandro Pertini 88, 61122 Pesaro (PU), Italia [S8]
- Entity: Via Sandro Pertini 88, 61122 Pesaro (PU) – Italia · TeamSystem S.p.A. [S10]
- Entity: 01035310414 · TeamSystem S.p.A. · Via Sandro Pertini 88, 61122 Pesaro (PU) – Italia [S11]
- Italian version precedence: Italian original prevails · https://mailup.it/gdpr-mailup/ [S2]
- License agreement URL: https://mailup.it/contratto-di-licenza-uso/ [S7]
- Owning entity: IT01035310414 · TeamSystem S.p.A. · Via Sandro Pertini 88, 61122 Pesaro (PU), Italy [S2]
- Owning entity: TeamSystem S.p.A. · Via Sandro Pertini 88, 61122 Pesaro (PU), Italia [S9]
- Page dates: 2024-12-16 · 2026-05-28 [S8]
- Platform license agreement URL: https://mailup.com/platform-license-agreement/ [S2]
- Trademark: yes [S6]
- VAT number: 01035310414 [S5]

**Pricing**
- Annual fee calculation: edition · send_speed [S3]
- Free trial: yes [S1]
- No list sales: no [S3]
- Pay per speed model: pay per speed · no · yes [S3]
- Sms credits purchase: yes · no [S3]
- Sms pricing model: pay per message · no [S3]
- Trial contents: 1000 · Plus [S3]
- Trial no credit card: no [S3]
- Unlimited recipients: no · unlimited [S3]
- Uptime SLA: annual · 99 [S8]

**Product**
- Ab test duration: Test duration set in hours, winning email sent to remaining recipients [S4]
- Ab test reporting: Reports show total sends and detail per variant A and B [S4]
- Ab test sample percentage: 30 · 5 [S4]
- Ab test send mode: yes · yes [S4]
- Ab test success criteria: Success criteria can be best open rate or click rate [S4]
- Ab test variants: Create multiple message variants modifying subject, CTA, images or header [S4]
- Access control: yes · yes · yes · yes [S8]
- Account management area: change edition · view invoices · buy administrators and SMS credits · check expiry · edit personal and billing data [S3]
- Ad group policies: yes [S8]
- AI assistant: ChatGPT-based AI assistant in drag-and-drop editor for creating and revising email content [S1]
- Auto bounce management: yes [S5]
- Automatic bounce management: soft bounce · hard bounce · failed deliveries · feedback loops · yes [S6]
- Automation channels: Messenger · Telegram · yes [S1]
- Background check: yes [S8]
- Custom activations: yes · yes [S3]
- Custom authentication: yes · yes [S6]
- Data classification: yes [S8]
- Data sync delivery options: MailUp-dedicated SFTP · customer-provided FTP or SFTP [S9]
- Data sync effective date: 2024-03-11 [S9]
- Data sync ftp export: Data Sync FTP – Export iscritti canale email automates export of subscriber data to align external systems (CRM, e-commerce, CMS) [S9]
- Data sync ftp service: Data Sync FTP – Export disiscritti canale email automatizza l'esportazione di dati da una o più liste MailUp verso sistemi esterni (CRM, e-commerce, ecc.) [S10]
- Data sync input format: CSV · SFTP [S9]
- Data sync report types: incremental · full [S9]
- Data sync scope: email-channel subscribed contacts from one, some, or all MailUp lists [S9]
- Data sync self config: yes [S9]
- Ddos mitigation: yes [S8]
- Dedicated teams: deliverability · compliance · manual analysis · refined algorithms [S6]
- Deliverability: deliverability guaranteed via algorithms, certifications, IP and consignment monitoring [S1]
- Deliverability infrastructure: Infrastructure configured for optimal deliverability via certifications and constant monitoring of sends [S6]
- Deliverability investment: 2014 · proprietary Machine Learning algorithms and predictive models for Deliverability & Compliance · 1000000 [S6]
- Delivery options: MailUp-provided SFTP space · customer-provided FTP or SFTP space [S10]
- Developer platform: piattaforma sviluppatori per pubblicare o vendere integrazioni alla community [S11]
- Dlp: Data Loss Prevention (DLP) · yes [S8]
- Environment concept: independent isolated work environments; an account can have one or more [S3]
- Export format: CSV · SFTP [S10]
- Feedback loop auto unsubscribe: Yahoo! · AOL · Hotmail · yes [S5]
- Feedback loop list exportable: yes · yes [S5]
- Feedback loops: yes · immediate [S6]
- Firewall ips: yes · yes · yes [S8]
- GDPR features list: (Re)Iscrizione con conferma · Campagne di autoprofilazione · Centro Gestione Profilo · Cancellazione definitiva dei dati [S7]
- GDPR tools list: (Re)Registration with confirmation · Self-profiling campaigns · Profile Management Centre · Definitive deletion of personal data [S2]
- Hard bounce auto unsubscribe: yes [S5]
- Hardware disposal: yes [S8]
- Ids: yes · yes [S8]
- Incident management: EDR · SIEM · SOC · yes [S8]
- List scope: one, some or all MailUp lists, per customer specification [S10]
- Log management: platforms · API · yes [S8]
- MFA: yes [S8]
- Platform id format: platform ID is the number after the letter m in the username, e.g. m1234 [S3]
- Preferences center rights management: yes [S2]
- Right of access: Esportazione dei dati degli iscritti tramite Destinatari > Esportazione; visualizzazione dati di un singolo destinatario in piattaforma [S7]
- Right to access: Recipients > Export function or single recipient view · yes [S2]
- Right to be forgotten: total deletion · unsubscribe · yes [S2]
- Right to be forgotten: Cancellazione completa del destinatario o modalità di disiscrizione compatibile con il diritto all'oblio [S7]
- Right to object: Preferences Center opt-out of tracking and profiling · yes [S2]
- Right to object: Opt-out dal tracciamento e dalla profilazione tramite il Centro Preferenze [S7]
- Right to portability: export from platform or via Preferences Center · yes [S2]
- Right to portability: Esportazione dei dati dalla piattaforma o dal Centro Preferenze, totale o parziale [S7]
- Right to rectification: edit individual profiles · self-service via Preferences Center · yes [S2]
- Right to rectification: Modifica dati nel profilo del destinatario o auto-aggiornamento tramite il Centro Preferenze [S7]
- Risk assessment: yes [S8]
- Secure development: yes · yes · yes · yes [S8]
- Segmentation: yes [S1]
- Self service activation: yes [S10]
- Service scope: CSV reports of email-channel unsubscribes only [S10]
- SOC: yes [S8]
- Threat protection: yes · yes · yes · yes [S8]
- Training: yes [S8]
- Vendor management: yes · yes [S8]
- Whitelisted ips: yes · yes · yes · yes [S6]

**Support**
- Consulting integrations: consulenza su misura per integrazioni dati, incluse credenziali API e configurazione Data Sync [S11]
- Documentation: yes [S3]
- GDPR technical email: support@mailup.com · segnalazione dalla piattaforma [S7]
- Technical contact: support@mailup.com · from MailUp platform [S2]
- Training sessions: yes [S3]

## Questions

### Is MailUp European?

Not determined: the vendor’s pages as captured do not say where MailUp is based.

### Where does MailUp store data?

Not stated on the vendor’s pages as of 20 Oct 2026.

### Does MailUp have a free plan?

Not stated on the vendor’s pages as of 20 Oct 2026.

### What are the best alternatives to MailUp?

As of 21 Oct 2026, the panel rates [Brevo (3/5)](https://whats-best.ai/software/email-marketing/brevo), [CleverReach (3/5)](https://whats-best.ai/software/email-marketing/cleverreach) and [Mailchimp (3/5)](https://whats-best.ai/software/email-marketing/mailchimp) highest among the other 27 Email Marketing & Newsletter products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Brevo](https://whats-best.ai/software/email-marketing/brevo) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [MailUp alternatives](https://whats-best.ai/software/email-marketing/mailup/alternatives).

## What this page leaves out

- 6 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.

## Sources

- [S1] Vendor page: https://www.mailup.com (checked 2026-10-20)
- [S2] Privacy policy — found from the homepage: https://mailup.com/gdpr-mailup/ (checked 2026-10-20)
- [S3] Campaigns & automation — found from sitemap: https://mailup.it/faq/la-piattaforma-mailup-include-funzionalita-di-marketing-automation/ (checked 2026-10-20)
- [S4] Campaigns & automation — found from sitemap: https://mailup.it/funzionalita/email/a-b-test/ (checked 2026-10-20)
- [S5] Deliverability infrastructure — found from sitemap: https://mailup.it/funzionalita/email/email-bounce/ (checked 2026-10-20)
- [S6] Deliverability infrastructure — found from sitemap: https://mailup.it/funzionalita/email/deliverability/ (checked 2026-10-20)
- [S7] Consent, proof & tracking limits — found from sitemap: https://mailup.it/gdpr-mailup/ (checked 2026-10-20)
- [S8] Consent, proof & tracking limits — found from sitemap: https://mailup.it/gdpr-infrastruttura/ (checked 2026-10-20)
- [S9] List ownership, import & exit — found from sitemap: https://mailup.it/termini-e-condizioni/data-sync-ftp-export-iscritti-canale-email/ (checked 2026-10-20)
- [S10] List ownership, import & exit — found from sitemap: https://mailup.it/termini-e-condizioni/data-sync-ftp-export-disiscritti-canale-email/ (checked 2026-10-20)
- [S11] Integrations & API — found from sitemap: https://mailup.it/funzionalita/integrazioni-e-api/ (checked 2026-10-20)

---

Cite as: whats-best.ai, "MailUp — Email Marketing & Newsletter", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/email-marketing/mailup

Corrections: https://whats-best.ai/correct/904?target=page