Transactional Email
Brevo Transactional Email
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Brevo SAS · www.brevo.com
Compare with Mailjet Email API → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Brevo Transactional Email at a glance
- Vendor
- Brevo SAS
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention France and Germany source, captured 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Starting price
- “Starter Best for single users starting with email and multi-channel marketing. €7 -10% €6 .33 per month” (vendor’s words) source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Brevo Transactional Email 3/5, the mean of 6 judges. Brevo's transactional email service earns its best marks for its sending API, scored 7-8: a documented REST endpoint and SMTP relay, seven official SDKs, batch sending up to 1,000 emails per request, a sandbox mode, and idempotency keys with a 30-minute window. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Brevo Transactional Email alternatives, European ones first →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Brevo's transactional email service earns its best marks for its sending API, scored 7-8: a documented REST endpoint and SMTP relay, seven official SDKs, batch sending up to 1,000 emails per request, a sandbox mode, and idempotency keys with a 30-minute window. Deliverability and observability sit at 6-7; data security, reliability and accounts, and pricing transparency at 5-6, pricing transparency drawing four judges at 5 — we found no public information on the pay-as-you-go credit price, the dedicated IP price or any overage rate, so a full annual cost cannot be computed from public pages. The captured pages also give different figures for log retention: indefinite on product pages, deletion at least every 24 months in the terms. Persona-weighted totals range from 5.5 to 6.3.
Speaks for it
- Sending API scores cluster at 7-8, the strongest criterion, on a documented REST endpoint and SMTP relay with seven official SDKs
- Domain authentication for SPF, DKIM and DMARC is documented down to the DNS records and API validation endpoints, with dedicated IPs and automated warming on Professional and Enterprise plans
- Event logs are searchable by message ID, recipient or subject, with webhook payloads carrying the bounce reason, the clicked link and the device, plus failure alerts
- The free plan is 300 emails per day, forever, with no credit card required, and published tiers run from Starter at €7 per month for 5,000 emails to Professional at €499 per month from 150,000 emails
- IP allow-listing supports CIDR ranges and blocks requests from unknown addresses even when the API key is valid
Held against it
- Pricing transparency scores cluster at 5-6, and we found no public information on the pay-as-you-go credit price, the dedicated IP price or any overage rate
- The terms state Brevo may use content and usage data to enrich and train its AI features, while logs store complete message content
- The captured pages give different figures for log retention — indefinite or unlimited on product pages, deletion at least every 24 months in the terms
- The privacy policy records transfers of personal data to the United States and India, and we found no public information on subprocessor locations
- We found no public information on service credits, support response times per plan, or how mail is queued and retried during an outage
Best for
- You are wiring order confirmations, password resets or receipts from a documented API, with seven official SDKs to choose from
- Your platform sends over SMTP — the relay works with any application that supports it, and official plugins cover WordPress, WooCommerce, Shopify, Magento and Zapier
- You want transactional mail split from promotional mail by sender and IP address, with hard bounces suppressed automatically
- You want to start without commitment — the free plan is 300 emails per day, forever, no credit card
Avoid if
- You send health or other GDPR Article 9 sensitive data — the terms state the service was not designed to collect, process or manage sensitive data within the meaning of Articles 9 and 10
- Your transactional mail carries customer names and addresses and you cannot accept a clause under which Brevo may use content and usage data to enrich and train its AI features
- You must price a contract fully on paper before signing — sub-account management sits in the Enterprise plan at a custom price, and we found no public information on the pay-as-you-go credit rate or a dedicated IP price
- You need an end-to-end evidenced European chain — the privacy policy records transfers of personal data to the United States and India, and we found no public information on subprocessor locations
The scores
| Criterion | Panel median |
|---|---|
| Sending API, SMTP & developer experience | 3.5 of 5 |
| Deliverability & sender reputation | 3 of 5 |
| Message logs, events & webhooks | 3 of 5 |
| Message data, retention & security | 3 of 5 |
| Reliability, accounts & support | 3 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 2.5 of 5 |
Sending API, SMTP & developer experience
Show reasoningHide reasoning
How this is scored
How an application sends mail: a REST API and an SMTP relay with their limits stated, official SDKs and drivers for named languages and frameworks (PHP and Laravel, Node, Python, Ruby and Rails, Java, Go, .NET), stored templates with variables and versions, batch sending, attachments, idempotency keys, scheduled sending, a test or sandbox mode that does not deliver, inbound email parsed into a webhook, and the quality of the API reference and guides.
0 — Not a sending service; an application cannot send email through it by API or SMTP.
3 — An API or SMTP credentials to send a message; SDKs, templates, limits and a test mode are basic or not described.
5 — A documented REST API and SMTP relay, official SDKs for several named languages, stored templates with variables, attachments and batch sending, rate limits stated, a sandbox or test mode, and quick-start guides for named frameworks.
8 — An API reference with every endpoint and error code, idempotency keys, scheduled sending, template versions and a template language documented, inbound email parsed to a webhook, an OpenAPI specification or official CLI, framework drivers maintained by the vendor, and a migration guide from named competitors.
10 — An API a team builds its product on: versioning and deprecation policy published, backward compatibility stated, full parity between API and SMTP features, local or staging test tooling that mirrors production, and every limit, timeout and retry behaviour documented.
The SaaS Developer
This is what I'd want to wire up: a documented REST endpoint plus an SMTP relay with ports, key types and limits spelled out, official maintained libraries for PHP among seven languages, stored templates with parameters, batch sending up to 1,000 messages, attachments, scheduled sending, idempotency and a sandbox mode. The developer docs go deep — rate limits per plan, an API playground making live calls, inbound parsing of replies, and specific error codes for domain failures. What keeps it short of the top band for me: we found no public information on a Laravel-specific driver, an OpenAPI specification, or template versioning, so I'd be integrating the PHP library myself rather than dropping in a driver. 1 4 11 12
The Platform Engineer
The REST API and SMTP relay are documented to a level I could build on: seven official SDKs, batch sending up to 1,000 messages per request, scheduled sending, idempotency with a 30-minute TTL, a sandbox mode, inbound parsing, and rate limits of 1,000 requests per second stated by plan. What keeps it off the top of the scale: the SMTP relay is documented as not supporting batch sending, and we found no public information on a versioning or deprecation policy or an OpenAPI specification. 1 4 11 12 14
The Shop Operator
The REST API and SMTP relay are documented well enough for my agency to wire order confirmations into the shop: seven official libraries including PHP, batch sending up to 1,000 emails per request, a 25 MB attachment cap, a sandbox mode, idempotency keys with a 30-minute window, and published rate limits with an API playground. The SMTP relay pages are unusually specific about their edges — SMTP keys rather than API keys, non-standard headers only, batch sending reserved for the API. We found no public information on template versioning or an OpenAPI specification, and the named plugins are WordPress, WooCommerce, Shopify, Magento and Zapier, so my Shopware shop would connect through the relay. 1 4 11 12
The Data Protection Officer
Sending is documented to a level my developers could build on: a REST endpoint and SMTP relay with ports, rate limits and attachment size stated, official libraries for PHP, Python, Node.js, Ruby, Go, Java and C#, idempotency keys, scheduled sending, a sandbox mode, inbound parsing of replies and an API playground for live test calls. The SMTP documentation itself states batch sending is not supported on the relay and scheduling there is in public beta, and we found no public information on an OpenAPI specification, a command-line tool, or template versioning. 1 4 11 12
The Agency Lead
A documented REST API and SMTP relay with official SDKs for all seven named languages, batch sending up to 1,000 messages per request, attachments, templates with variables and API template creation, idempotency keys, scheduled sending, a sandbox mode, inbound parsing, stated rate limits, and domain verification and validation by API — which is exactly how I would onboard thirty client domains. 1 4 11 12 14
The Skeptic
A REST endpoint, an SMTP relay with its ports and key type spelled out, seven official SDKs named, batch sends up to 1,000 recipients, attachments by URL or base64, idempotency keys with a 30-minute window, scheduled sending, inbound parsing, and rate limits per plan — the sending side is documented well beyond basics, with a live API playground to test endpoints. What keeps it out of the top band is what we found no public information on: an OpenAPI specification or official CLI, framework drivers the vendor maintains itself, and template versioning. 1 4 11 12
Deliverability & sender reputation
Show reasoningHide reasoning
How this is scored
What the vendor does so the mail reaches the inbox: guided SPF, DKIM and DMARC set-up with a custom return path and tracking domain, shared IP pools and how senders on them are vetted and policed, dedicated IPs with automatic warm-up, transactional and bulk mail kept on separate streams or IP pools, bounces, complaints and unsubscribes turned into suppressions automatically, feedback loops with mailbox providers, blocklist and DMARC monitoring, compliance with the Gmail and Yahoo bulk-sender rules, and published delivery times or inbox placement with their method.
0 — No sender authentication and no bounce handling; mail goes out from shared addresses with no reputation management at all.
3 — SPF and DKIM can be set up and bounces are recorded; IP policy, stream separation and suppressions are basic or not described.
5 — Guided SPF, DKIM and DMARC set-up with a custom return path, shared IPs with a stated sender vetting policy, dedicated IPs available, automatic suppression of hard bounces and complaints, transactional and marketing mail separated by stream or IP pool, and deliverability guidance in the documentation.
8 — Dedicated IPs with automatic warm-up and pool management, a stated acceptable-use and vetting process for shared pools, feedback loops and blocklist monitoring, DMARC reports, BIMI or custom tracking domains, compliance with the Gmail and Yahoo sender requirements stated, delivery times published, and access to deliverability experts.
10 — Deliverability that can be verified: delivery time and bounce rates per mailbox provider published continuously with their method, inbox placement testing included, pool reputation shown to the customer, and a documented escalation path with mailbox providers.
The SaaS Developer
The sending-side basics are covered: guided SPF, DKIM and DMARC with three verification routes, dedicated IPs with automated warming on higher plans, transactional and marketing mail split by stream and IP, and automatic suppression with hard-bounce pooling. There's a centralized Deliverability Center with a score, recommendations and six months of history, plus a team of deliverability experts and three specialist hours a year on Professional. We found no public information on a custom return path, feedback loops, DMARC reporting, the method behind the 99 percent claims, or a statement on the Gmail and Yahoo bulk-sender rules. 1 3 11 13 14
The Platform Engineer
Domain authentication for SPF, DKIM and DMARC is documented down to the DNS records and endpoints, dedicated IPs with automated warming ship on Professional and Enterprise, transactional and marketing mail are split by sender and IP, and hard bounces are pooled into automatic suppressions, backed by a Deliverability Center with a score and six months of history. Delivery speed is published only in aggregate (99.98% of SMTP mail under 20 seconds), and we found no public information on feedback loops, blocklist monitoring, or delivery figures per mailbox provider — the number I would page on. 1 3 11 13 14
The Shop Operator
This covers most of my wishlist: SPF, DKIM and DMARC set-up with the DNS records spelled out and endpoints to validate the domain, dedicated IPs with automated warming, automatic suppression of hard bounces and complaints, and transactional mail split from promotional mail by sender and IP address — order confirmations stay clear of the newsletter. A Deliverability Center with a score, recommendations and six months of history, plus a stated team of deliverability experts, gives me somewhere to turn when Gmail starts refusing. We found no public information on a custom return path, how senders on shared IPs are vetted, feedback loops, blocklist monitoring, or a statement on the Gmail and Yahoo bulk-sender requirements. 1 3 13 14
The Data Protection Officer
SPF, DKIM and DMARC set-up is documented with three verification routes, dedicated IPs come with automated warming, hard bounces are pooled and suppressed automatically, transactional and promotional mail are split by sender and IP, and delivery times plus a 99% inbox-placement figure are published. We found no public information on how senders on shared pools are vetted, on feedback loops, blocklist or DMARC monitoring, or on a stated position on the Gmail and Yahoo bulk-sender rules. 1 3 11 13 14
The Agency Lead
SPF, DKIM and DMARC are set up through published DNS records with three verification routes, transactional and marketing mail are split by stream and IP, dedicated IPs come with automated warming on Professional and Enterprise, hard bounces and complaints are suppressed automatically, and a Deliverability Center shows a score with six months of history alongside published delivery-speed figures and access to deliverability specialists. We found no public information on feedback loops, blocklist monitoring, DMARC reports, custom return paths, or a stated position on the Gmail and Yahoo bulk-sender requirements. 1 3 11 13 14
The Skeptic
Domain authentication covers SPF, DKIM and DMARC with the DNS records and API endpoints to validate them, transactional and marketing mail can be split into different streams, hard bounces are pooled into automatic suppressions, dedicated IPs come with automated warming, and a Deliverability Center scores performance over six months of history. The "99%" deliverability and inbox-placement figures arrive with no method attached, and we found no public information on feedback loops, blocklist monitoring, DMARC reports, or stated compliance with the Gmail and Yahoo bulk-sender rules. 1 3 13 14
Message logs, events & webhooks
Show reasoningHide reasoning
How this is scored
What the team can see about each message once the application has handed it over: a message log searchable by recipient, subject, tag or message ID, the full event history (processed, delivered, deferred, bounced with the remote server's answer, opened, clicked, complained), how long logs and message content are kept, event webhooks with retries and a signature, an events API, dashboards and statistics per stream, tag or domain, alerts on bounce or complaint spikes, and access for a support team without developer rights.
0 — Nothing can be seen after sending; no logs, no events and no webhooks.
3 — Totals of sent and bounced messages; per-message logs, webhooks and retention are basic or not described.
5 — A searchable message log with per-message event history and the bounce reason, log retention stated, event webhooks for delivery, bounce, open, click and complaint, statistics per tag or domain, and an API to fetch events.
8 — Webhooks signed and retried with their schedule documented, the raw SMTP response and the rendered message viewable per send, log retention configurable or extended by plan, alerts on bounce, complaint or delivery-time thresholds, export or streaming of events to a named log or data tool, and read-only roles for support staff.
10 — Full traceability: every message traceable from API call to the receiving server's final answer, events streamed in real time with ordering and delivery guarantees stated, long retention with search across the whole history, and observability features documented with their limits.
The SaaS Developer
The question I actually ask — did this user get the reset mail — is answerable: event logs searchable by message ID, recipient or subject showing the history from API request to inbox delivery, a bounce reason in the deferred and bounce payloads, and view, filter and export of events from one logs page. Webhooks cover the full event set including soft and hard bounces and spam, are manageable by API, and there are alerts when webhook deliveries fail. The captured pages give different figures for how long logs are kept — indefinite or unlimited on feature pages, deletion at least every 24 months in the terms — and we found no public information on signed webhooks, a retry schedule, or read-only access for support staff. 1 3 5 11 15 16
The Platform Engineer
Every message is searchable by message ID, recipient or subject with the full technical history from API request to inbox, the webhook payloads carry the deferred reason, the clicked link, device and user agent, and events can be exported. For the on-call side we found no public information on webhook signing, retry schedules, or alerts when bounces spike; the captured pages also give different figures for how long logs are kept (indefinite versus deletion within 24 months). 1 3 11 15 16
The Shop Operator
I can trace any order mail afterwards: event logs searchable by message ID, recipient or subject, webhook events for delivered, bounced, opened, clicked and marked spam with the bounce reason, the clicked link and the device, plus an events page with export and webhook failure alerts, and retention rules are configurable. The captured pages give different figures for how long logs are kept — indefinitely on one, unlimited on the pricing page, deletion at least every 24 months in the terms. We found no public information on webhook signatures, retry schedules or read-only access for support staff. 3 5 8 11 15 16
The Data Protection Officer
The event logs search every message by message ID, recipient or subject, webhooks carry the full transactional event set including the bounce reason, the device and the clicked link, events can be filtered and exported from a dedicated logs page, and failed webhook deliveries raise alerts. The captured pages give different figures for log retention — indefinite and unlimited on product pages, deletion at least every 24 months in the terms — which is precisely the question a processor should answer once, and we found no public information on webhook signatures or retry schedules. 3 5 8 11 15 16
The Agency Lead
Every message is searchable by message ID, recipient or subject with the technical history from API request to delivery, and the webhook payloads carry the full event set with bounce reasons, device and link fields plus a mirror link into the dashboard logs; webhooks can be created and updated via the API, with failure alerts and event export. The captured pages give different figures for log retention — the product pages describe indefinite transactional logs while the terms state deletion at least every 24 months — and we found no public information on webhook signatures and retry schedules, raw SMTP responses, read-only roles for support staff, or bounce and complaint spike alerts. 1 3 4 8 11 15 16
The Skeptic
Message logs are searchable by message ID, recipient and subject, an events page supports view, search, filter and export, and the webhook taxonomy is documented down to payload fields like the bounce reason, the clicked link, and a preview link into the UI logs. The captured pages give different figures for how long logs are kept — indefinitely on one product page, deletion at least every 24 months in the terms — and we found no public information on webhook signatures, retry schedules, or alerts on bounce and complaint spikes. 1 3 8 15 16
Message data, retention & security
Show reasoningHide reasoning
How this is scored
What is stored about each message and what the customer controls: whether message bodies are stored or only metadata, retention periods and the setting to shorten them, deletion of a recipient's data on request, open and click tracking that can be switched off per stream or message, TLS for delivery with an option to require it, encryption at rest, API keys with scopes and per-domain restrictions, IP allow-listing, two-factor authentication and SSO for the dashboard, an audit log, a vulnerability disclosure programme, and security certifications or audits with their scope. Where the data is processed and by whom is scored under sovereignty.
0 — Stores every message indefinitely with no controls, and the vendor states it uses message content for its own purposes.
3 — A privacy policy and a statement that data is encrypted; what is stored, retention and access controls are basic or not described.
5 — What is stored per message documented, retention periods stated, open and click tracking switchable, TLS used for delivery, API keys with restricted permissions, two-factor authentication for the dashboard, and a data processing agreement offered.
8 — Message content retention configurable down to none or metadata only, enforced TLS per domain or message, encryption at rest stated, scoped API keys and IP allow-listing, SSO (SAML) and roles, an audit log, deletion of recipient data by API, and ISO 27001 or SOC 2 stated with its scope.
10 — Data minimisation that can be verified: every stored field and its retention listed, content never stored unless the customer opts in, customer-managed encryption keys or equivalent, independent audits published with their scope, and every security control the customer has listed with its effect.
The SaaS Developer
Controls I'd rely on are documented: multi-factor authentication, IP allow-listing with CIDR ranges that blocks requests even with a valid key, ISO 27001:2022, per-message tracking pixel removal and consent, and a published data processing agreement. The terms state content may be used to train Brevo's own AI features, which I'd want to nail down before pointing invoices at it. We found no public information on scoped API keys, an audit log, SOC 2, or deleting a recipient's data by API. 1 4 8 10 17 18
The Platform Engineer
IP allow-listing is genuinely strong — CIDR ranges, blocking unknown addresses even when the key is valid — alongside MFA, ISO 27001:2022, per-message tracking-pixel removal, configurable log retention rules and erasure within 30 days on request. But the terms state Brevo may use content and usage data to enrich and train its AI features, and we found no public information on scoped API keys, an audit log or a vulnerability disclosure programme. 1 4 8 10 17
The Shop Operator
Two-factor authentication, IP allow-listing with CIDR ranges that rejects requests even with a valid key, ISO 27001:2022, a published data processing agreement, per-message tracking-pixel removal and documented deletion and export cover what my customer data needs on paper. The point I would take to our data protection officer: the terms state Brevo may use content and usage data to enrich and train its AI features, and order mails carry customer names and addresses. We found no public information on scoped API keys, an audit log or a vulnerability disclosure programme. 4 7 8 9 10 17
The Data Protection Officer
Open and click tracking can be removed per message, multi-factor authentication, IP allow-listing that rejects requests even with a valid key, SSO with SAML on the Enterprise plan and an ISO 27001:2022 certificate are stated, with a data processing agreement published in the terms. Message content sits in searchable logs with configurable retention, but the captured pages give different retention figures, and we found no public information on an audit log, encryption at rest for message bodies, or recipient deletion by API; the terms also state the service was not designed for GDPR Article 9 sensitive data, which any health sender must weigh before signing. 1 3 4 8 10 11 17
The Agency Lead
ISO 27001:2022, multi-factor authentication and IP allow-listing down to CIDR ranges — with unknown IPs blocked even when the key is valid — sit beside per-message tracking-pixel removal, published and configurable retention periods, GDPR deletion tools and a data processing agreement. We found no public information on scoped API keys, an audit log, or an option to enforce TLS per domain, and the terms state Brevo may use content and usage data to enrich and train its AI features, which I would have to clear with clients before routing their transactional mail here. 1 4 7 8 10 17 18
The Skeptic
Retention periods are published item by item, contact deletion erases personal data with a 30-day completion promise, tracking pixels can be removed per message, IP allow-listing and multi-factor authentication are documented, and ISO 27001:2022 is claimed. Points off: the terms state Brevo may use Content and Usage Data to enrich and train its AI features — against logs that store complete message content — unencrypted ports 587 and 2525 make TLS optional, and we found no public information on scoped API keys, an audit log, or the certification's scope. 1 4 8 9 10 12 17
Reliability, accounts & support
Show reasoningHide reasoning
How this is scored
Whether the platform can be relied on and run by a team: a public status page with incident history, uptime SLA and service credits published, redundancy or failover across data centres described, queueing and retry of mail during outages, sub-accounts or servers per application, client or tenant, team members with roles, separate environments, support channels and response times per plan, named migration help, and integrations with platforms that send mail on the customer's behalf (WordPress, Shopify, Shopware, Supabase, Vercel and similar).
0 — No status page, no support channel and no way to separate users or applications.
3 — A support contact and a single account; status page, SLA, sub-accounts and roles are basic or not described.
5 — A public status page with incident history, an uptime SLA on at least one plan, sub-accounts or separate servers per application, team members with roles, support by email or chat with stated hours, and plugins or guides for several named platforms.
8 — An SLA with service credits published, redundancy across data centres or regions described, mail queued and retried during incidents, sub-accounts with their own keys, domains and limits manageable by API, granular roles, support response times per plan, and migration assistance offered.
10 — Reliability that can be verified: uptime history published for years, post-mortems for incidents, multi-region failover documented, an SLA covering delivery latency as well as API availability, and white-label or reseller tooling for agencies and platforms.
The SaaS Developer
There's a public status page, a service level agreement published as an appendix to the terms alongside 99.9 percent uptime claims, backups across three geographically distinct servers, sub-accounts on Enterprise, ten seats on Professional with phone support there, and email support even on the free plan. The integration list is real — WordPress via WP Mail SMTP, Shopify, Supabase, Zapier, Make, n8n — plus named migration paths from Klaviyo and Mailchimp. We found no public information on service credits, support response times per plan, incident history, or what happens to queued mail during an outage. 1 8 10 11 19
The Platform Engineer
There is a public status page, an SLA published as an appendix to the terms, backups across three geographically distinct servers, seats on paid plans, official plugins for WordPress, WooCommerce, Shopify and Magento, and named migrations from Mailchimp and Klaviyo. But we found no public information on service credits, mail queueing and retry during incidents, per-plan response times or granular roles — exactly the items I need in writing before routing login codes through a provider. 1 8 10 11 19
The Shop Operator
There is a public status page, a service level agreement in the terms of service with 99.9% uptime, backups across three geographically distinct servers, multi-user seats, and email support on every plan with phone support higher up. Sub-account management sits in the Enterprise plan, and we found no public information on support response times per plan or how mail is queued during an outage. The named plugins cover WordPress, WooCommerce, Shopify, Magento and Zapier; my Shopware shop would rely on the SMTP relay, which works with any platform that supports it. 1 8 10 11 19
The Data Protection Officer
A public status page, a service level agreement published as an appendix to the terms at 99.9% uptime, backups across three geographically distinct servers, Enterprise sub-accounts with tailored onboarding, multi-user seats on the Professional plan, and official plugins for WordPress, Shopify, WooCommerce, Magento, Zapier and Supabase are all documented. We found no public information on service credits, support response times per plan, or how mail is queued and retried during an outage. 1 8 10 11 18 19
The Agency Lead
There is a public status page, a service level agreement appendix in the terms with 99.9% uptime, ten seats and phone support on Professional, backups across three geographically separate servers, and plugins for WordPress, Shopify, WooCommerce and Magento plus a Supabase integration. Sub-account management is an Enterprise feature at a custom price, which pushes my per-client separation out of any contract I could price on paper, and we found no public information on incident history, service credits, queueing during outages, granular roles, or per-plan response times. 1 3 8 11 19
The Skeptic
A public status page exists at status.brevo.com, backups run across three geographically distinct servers, an SLA appendix is part of the terms, and plugins or guides cover WordPress, WooCommerce, Shopify, Magento, Zapier and Supabase. Sub-account management sits behind the Enterprise plan, seats rather than roles are what is published, and we found no public information on incident history, service credits, support response times by plan, or mail queueing during outages. 1 8 10 11 19
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where messages, logs and recipient data are processed and stored, whether an EU region can be chosen and what it covers, and who the subprocessors are (cloud hosting, sending infrastructure, logging, support and payment tools). Independently sourced by the sovereignty pipeline; every message carries personal data, so the whole sending chain counts, not only the dashboard.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — An EU region available and an EU contracting entity or EU representative, but parts of the chain (sending infrastructure, logs, support, payment) run through non-EU providers without a stated safeguard, or the EU region does not cover logs and account data.
8 — EU processing of messages, logs and account data on named infrastructure, an EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, sending infrastructure and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The SaaS Developer
For a Hamburg outfit this reads well: a French simplified joint-stock company registered in Paris with an RCS number, EU hosting claimed as France and Germany for all data, a data processing agreement with the subprocessor list inside it, and ISO 27001:2022. The privacy policy acknowledges transfers to the United States and India, and Brevo Inc. is certified under the EU-U.S. Data Privacy Framework, so parts of the chain clearly leave Europe. The captured pages give different figures for hosting — the legal notice names hosts with United States addresses — and the subprocessor list is available without the subprocessors' locations. 1 6 7 8 10 11
The Platform Engineer
The contracting entity is Brevo SAS in Paris with a trade-register number, hosting is described as France and Germany on EU-based servers, a data processing agreement is published with the subprocessors listed in it, and ISO 27001 is stated. The captured pages give a mixed picture beyond that: the privacy policy names transfers to the United States and India, the legal notice lists US hosts (Kinsta and Vercel), and we found no public information on subprocessor locations or exactly what the EU region covers. 1 6 7 8 11
The Shop Operator
Brevo is a French simplified joint-stock company in Paris with an EU VAT number, states hosting in France and Germany on EU-based servers, publishes a data processing agreement with a subprocessor list, and carries ISO 27001:2022 — a workable starting position for my German and Austrian shops. The chain is not proven end to end: the privacy policy discloses transfers to the United States and India, the legal notice names the US hosts Kinsta and Vercel, and named subprocessors such as OpenAI and the payment providers appear without their locations. 1 6 7 8 11
The Data Protection Officer
Brevo is a French simplified joint-stock company registered in Paris, the sending service is described as hosted on EU servers in France and Germany with all data hosted in the EU, and a data processing agreement lists every subprocessor. The privacy policy itself records that personal data may be transferred to the United States and India, and the captured pages name subprocessors such as OpenAI and several payment providers without stating their locations — so the European cover for the mail is stated, but the whole chain is not evidenced end to end. 1 6 7 8 11
The Agency Lead
The contracting entity is Brevo SAS in Paris, data hosting is stated as France and Germany on EU-based servers with backups across three geographically separate servers, the data processing agreement is published as an appendix, subprocessors are listed in it, and ISO 27001:2022 is stated. The privacy policy itself says personal data may be transferred to the United States and India, the legal notice names hosts in California, and subprocessor locations along the sending chain are not shown on the captured pages — for my Cologne clients I would want that list before signing. 1 6 7 8 10 18
The Skeptic
Brevo is a French company registered in Paris and its pages claim EU hosting in France and Germany, with a data processing agreement published as an appendix to the terms and subprocessors listed within it — but the privacy policy itself says personal data may be transferred to the United States of America and India, the controller for some customers is Brevo Inc., and the legal notice names hosts at California addresses. We found no public information on subprocessor locations, so the EU claim cannot be traced end to end through sending, logging, support and payment. 1 6 7 8 10
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly message volume, the price per additional thousand messages, the free tier and its limits, what dedicated IPs, extra log retention, sub-accounts, SSO and support plans cost, minimum term, and whether unused volume carries over.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with volume or which features cost extra is unclear.
5 — Tiers are public with their monthly volume and price, but at least one commonly needed piece (overage rate, dedicated IP, longer log retention, SSO, support plan) is unpriced or "on request".
8 — Every tier priced publicly with its volume and overage rate per thousand messages, dedicated IPs and add-ons priced, log retention per tier stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given monthly volume, number of domains and sub-accounts and feature set, with every add-on, support and overage fee and the cancellation terms published.
The SaaS Developer
The free tier is concrete — 300 emails a day, forever, no credit card — and tiers are published with volumes, from Starter at "€7 -10% €6.33 per month" for 5,000 emails to Professional at "€499 -10% €449.08 per month" from 150,000, with a 10 percent yearly discount, pay-as-you-go credits that never expire, VAT treatment stated, and cancellation terms including a 15-day written notice on Professional. What I can't do is compute my real annual cost at 40,000 users: we found no public information on the price per additional thousand messages or what a dedicated IP costs, and Enterprise is custom price only. 1 3 5 8 11
The Platform Engineer
The tiers are public with their volumes — free at 300 emails a day, Starter at €7 per month for 5,000 emails, Standard at €15, Professional at €499 for 150,000 — with VAT treatment, billing periods, notice periods and cancellation terms stated, and one add-on priced (branding removal at €8.10 per month). But we found no public information on the rate for emails beyond plan volume or the price of a dedicated IP, and Enterprise is a custom price, so I cannot compute a full annual cost from public pages. 1 3 5 8
The Shop Operator
The free plan of 300 emails per day, Starter at €7 per month with 5,000 emails, and Professional at €499 per month with 150,000 emails are public, prices are stated exclusive of VAT, and renewal and cancellation terms are in the terms of service. I still cannot compute my annual cost: the pay-as-you-go credit price, the dedicated IP price and any overage rate are not stated, and my order-mail volume sits above the Starter allowance. The pages describe credit pricing only as "price based on number of emails." 1 3 5 8 11
The Data Protection Officer
Every plan is priced publicly with its volume — free at 300 emails a day, Starter at €7 a month from 5,000 emails, Standard at €15, Professional at €499 from 150,000 — with pay-as-you-go credits that do not expire, VAT treatment, payment methods and cancellation terms stated. Dedicated IP addresses carry no published price, the Enterprise plan is custom-priced, and we found no public information on the per-thousand cost of additional emails, so a full annual cost cannot be computed from the public pages. 1 5 8 11
The Agency Lead
The free tier (300 emails per day, forever, no credit card) and paid tiers from €7 per month for 5,000 emails up to €499 per month for 150,000 are public, with a 10% yearly discount, pay-as-you-go credits that do not expire, and VAT treatment plus notice periods stated in the terms. The pieces I need to compute a per-client cost in a maintenance contract are the gaps: we found no public information on the price per additional thousand emails, a dedicated IP, longer log retention, SSO or sub-accounts, with Enterprise at a custom price. 1 3 5 8 11
The Skeptic
Every tier is published with its volume and price in euros and dollars, VAT treatment, the annual discount and the cancellation and notice periods are in the terms, and the free tier's 300-emails-a-day limit requires no card. But we found no public information on the price of additional emails beyond a tier's volume, on dedicated IP pricing, or on support response times by plan — the numbers that decide a real annual bill. 1 3 5 8 11
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Brevo Transactional Email
Is Brevo Transactional Email European?
Yes. whats-best.ai classifies Brevo Transactional Email as EU-Made.
Where does Brevo Transactional Email store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention France and Germany as hosting locations, per the vendor’s page captured 1 Nov 2026.
Does Brevo Transactional Email have a free plan?
Yes. Brevo Transactional Email has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Brevo Transactional Email?
As of 2 Nov 2026, the panel rates Lettermint (3.5/5), Bird Email API (formerly SparkPost) (3/5) and Postmark (3/5) highest among the other 15 Transactional Email products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Lettermint (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Brevo Transactional Email alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Legal entity, Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 42 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 14 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 10 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (20)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (transactional email) www.brevo.com Checked 1 Nov 2026 Details →
- 2 Features page (transactional email, German) www.brevo.com Checked 1 Nov 2026 Details →
- 3 Features page (SMTP relay) www.brevo.com Checked 1 Nov 2026 Details →
- 4 API documentation (transactional email) developers.brevo.com Checked 1 Nov 2026 Details →
- 5 Pricing page www.brevo.com Checked 1 Nov 2026 Details →
- 6 Legal notice www.brevo.com Checked 1 Nov 2026 Details →
- 7 Privacy policy www.brevo.com Checked 1 Nov 2026 Details →
- 8 Terms of service www.brevo.com Checked 1 Nov 2026 Details →
- 9 Security / trust page (GDPR) www.brevo.com Checked 1 Nov 2026 Details →
- 10 Security / trust page (data security) www.brevo.com Checked 1 Nov 2026 Details →
- 11 Sending API, SMTP & developer experience — found from sitemap www.brevo.com Checked 1 Nov 2026 Details →
- 12 Sending API, SMTP & developer experience — found from sitemap developers.brevo.com Checked 1 Nov 2026 Details →
- 13 Deliverability & sender reputation — found from sitemap www.brevo.com Checked 1 Nov 2026 Details →
- 14 Deliverability & sender reputation — found from sitemap developers.brevo.com Checked 1 Nov 2026 Details →
- 15 Message logs, events & webhooks — found from sitemap www.brevo.com Checked 1 Nov 2026 Details →
- 16 Message logs, events & webhooks — found from sitemap developers.brevo.com Checked 1 Nov 2026 Details →
- 17 Message data, retention & security — found from sitemap developers.brevo.com Checked 1 Nov 2026 Details →
- 18 Message data, retention & security — found from sitemap www.brevo.com Checked 1 Nov 2026 Details →
- 19 Reliability, accounts & support — found from sitemap www.brevo.com Checked 1 Nov 2026 Details →
- 20 Reliability, accounts & support — found from sitemap www.brevo.com Checked 1 Nov 2026 Details →