Transactional Email
Elastic Email API
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Elastic Email Inc. · elasticemail.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Elastic Email API at a glance
- Vendor
- Elastic Email Inc.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention the EU, United States and Canada source, captured 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Elastic Email API 2.5/5, the mean of 6 judges. Elastic Email Inc., a Canadian corporation, sells this transactional email service with a documented REST API v4, an SMTP relay and official libraries for twelve languages; the sending API scores 6 to 7, the top of this bench's range. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Elastic Email Inc., a Canadian corporation, sells this transactional email service with a documented REST API v4, an SMTP relay and official libraries for twelve languages; the sending API scores 6 to 7, the top of this bench's range. Reliability and accounts shows the widest spread, 5 to 7, over the same facts: judges credit unlimited sub-accounts, each with its own IP, domain and credit limit, managed through the API, and mark it down for finding no public information on an uptime SLA, service credits or incident history — only a Status link. Observability sits at a uniform 6, with webhooks signed using HMAC-SHA256, secret rotation and a 24-hour retry, though signing is restricted to Pro plans. Sovereignty is the weak point at 3 to 4: a Canadian entity under British Columbia law, hosting across the EU, the United States and Canada, and subprocessors named only by category. Pricing transparency holds at 5, with public tiers — Starter $19 and Pro $49 per month for up to 50,000 emails/month — but unpriced add-ons.
Speaks for it
- Documented REST API v4 and SMTP relay with official libraries for twelve languages, idempotency keys and a stated limit of 20 concurrent connections.
- Unlimited sub-accounts, each with its own IP, domain and custom credit limit, manageable through the API, with custom branding for reselling.
- Webhooks signed with HMAC-SHA256, with secret rotation, a 24-hour retry window and a five-minute replay tolerance.
- SPF, DKIM and DMARC set-up guided in the help centre, with a DMARC generator and DKIM keys generated by the vendor.
- Public plan tiers from a free plan at $0 per month for up to 3,000 emails/month, also quoted as 100 emails a day, to Starter at $19 and Pro at $49 per month.
Held against it
- We found no public information on an uptime SLA, service credits or an incident history — the developer pages show a Status link.
- The security page claims no certification such as ISO 27001 or SOC 2, and we found no public information on encryption at rest.
- Sovereignty scores fall to 3 to 4: a Canadian contracting entity under British Columbia law, hosting across the EU, the United States and Canada, and subprocessors named only by category.
- Copies of sent emails may be permanently erased after fourteen days at the vendor's sole discretion, with no public information on configurable retention.
- The private-IP and Dedicated Support add-ons are offered unpriced, and we found no public information on an overage rate per additional thousand messages.
Best for
- You run an agency or reseller operation and need unlimited sub-accounts, each with its own IP, domain and sending credit limit, to keep clients apart.
- Your developers integrate over the published REST API v4 or SMTP relay, with official libraries in languages from PHP to Go.
- You need signed webhook event delivery with secret rotation feeding your own systems.
- You want to start at no cost on the free plan, $0 per month for up to 3,000 emails/month, with instant setup and no credit card required.
Avoid if
- You need processing confined to the EU — the contracting entity is Elastic Email Inc. under British Columbia law, and we found no public information on an EU-only hosting region or an EU contracting entity.
- Your procurement requires a certification such as ISO 27001 or SOC 2 — the security page describes safeguards but claims no certification.
- You send one-time codes or password resets that must survive an outage — we found no public information on an uptime SLA or on mail being queued and retried during incidents.
- You must compute an exact annual cost in advance — the private-IP and Dedicated Support add-ons are listed unpriced and the judges could not compute a yearly figure from the public pages.
The scores
| Criterion | Panel median |
|---|---|
| Sending API, SMTP & developer experience | 3.5 of 5 |
| Deliverability & sender reputation | 3 of 5 |
| Message logs, events & webhooks | 3 of 5 |
| Message data, retention & security | 3 of 5 |
| Reliability, accounts & support | 3 of 5 |
| European sovereignty | 1.5 of 5 |
| Pricing transparency | 2.5 of 5 |
Sending API, SMTP & developer experience
Show reasoningHide reasoning
How this is scored
How an application sends mail: a REST API and an SMTP relay with their limits stated, official SDKs and drivers for named languages and frameworks (PHP and Laravel, Node, Python, Ruby and Rails, Java, Go, .NET), stored templates with variables and versions, batch sending, attachments, idempotency keys, scheduled sending, a test or sandbox mode that does not deliver, inbound email parsed into a webhook, and the quality of the API reference and guides.
0 — Not a sending service; an application cannot send email through it by API or SMTP.
3 — An API or SMTP credentials to send a message; SDKs, templates, limits and a test mode are basic or not described.
5 — A documented REST API and SMTP relay, official SDKs for several named languages, stored templates with variables, attachments and batch sending, rate limits stated, a sandbox or test mode, and quick-start guides for named frameworks.
8 — An API reference with every endpoint and error code, idempotency keys, scheduled sending, template versions and a template language documented, inbound email parsed to a webhook, an OpenAPI specification or official CLI, framework drivers maintained by the vendor, and a migration guide from named competitors.
10 — An API a team builds its product on: versioning and deprecation policy published, backward compatibility stated, full parity between API and SMTP features, local or staging test tooling that mirrors production, and every limit, timeout and retry behaviour documented.
The SaaS Developer
The REST API v4 reference, SMTP relay with unlimited credentials, official libraries for a dozen languages including PHP, idempotency keys, attachments, bulk merge sending and inbound routing with parsing are all documented, which is enough to integrate without heroics. What keeps me from going higher: I found no public information on an official framework driver for Laravel, a sandbox or test mode that never delivers, scheduled sending, or template versioning — the things that would stop me hand-rolling a mail transport again. 1 2 3 11 12
The Platform Engineer
A full REST API v4 reference with modules from Emails to InboundRoute, official libraries for a dozen named languages including Go, Ruby and Rust, an idempotency key header on send, attachments, bulk merge, inbound parsing and a plain SMTP relay with per-credential channels — and the connection limit of 20 concurrent with a 600-second timeout is in writing. I found no public information on a sandbox or test mode, scheduled sending, template versioning, or a migration guide, which keeps this below the top band. 3 12 11 1 2
The Shop Operator
A documented REST API v4 and an SMTP relay are both published, with official client libraries for a dozen languages including PHP, batch merge sending, attachments, idempotency keys and a stated limit of 20 concurrent connections — my shop developer could wire the order mails up from the published steps and the Settings → SMTP credential walkthrough. We found no public information on a test or sandbox mode, scheduled sending or a Shopware plugin, so the shop side would be manual SMTP credentials. 1 2 3 12
The Data Protection Officer
The REST API v4 and the SMTP relay are both documented, with official libraries for twelve named languages, idempotency keys, attachments, bulk merge sending, inbound email parsed to webhooks, and concurrency limits stated. We found no public information on a sandbox or test mode, scheduled sending, template versions, or migration guides, so I score this one step above the documented-API level. 1 3 12 2 4
The Agency Lead
The REST API v4 reference covers emails, domains, sub-accounts, templates, events and inbound routing, sits beside an SMTP relay with unlimited credentials, and has official libraries for twelve languages including PHP and Node, with idempotency keys, attachments, bulk merge sending and the 20-connection API limit all stated. Domains and sub-accounts manageable through the same API is precisely the shape we need for thirty clients. We found no public information on a sandbox or test mode, scheduled sending, or template versioning. 1 2 3 11 12
The Skeptic
The API surface is real and broad: a REST API v4 reference spanning emails, templates, events, suppressions and inbound routing, an SMTP relay with unlimited credentials and channel headers, official libraries for a dozen languages, attachments, bulk merge sending, idempotency keys, and stated limits of 20 concurrent connections and a 600-second timeout. We found no public information on a sandbox or test mode, scheduled sending, template versioning, an OpenAPI specification or a migration guide, so sending is documented well but the production workflow stops short of the best in class. 1 2 3 11 12
Deliverability & sender reputation
Show reasoningHide reasoning
How this is scored
What the vendor does so the mail reaches the inbox: guided SPF, DKIM and DMARC set-up with a custom return path and tracking domain, shared IP pools and how senders on them are vetted and policed, dedicated IPs with automatic warm-up, transactional and bulk mail kept on separate streams or IP pools, bounces, complaints and unsubscribes turned into suppressions automatically, feedback loops with mailbox providers, blocklist and DMARC monitoring, compliance with the Gmail and Yahoo bulk-sender rules, and published delivery times or inbox placement with their method.
0 — No sender authentication and no bounce handling; mail goes out from shared addresses with no reputation management at all.
3 — SPF and DKIM can be set up and bounces are recorded; IP policy, stream separation and suppressions are basic or not described.
5 — Guided SPF, DKIM and DMARC set-up with a custom return path, shared IPs with a stated sender vetting policy, dedicated IPs available, automatic suppression of hard bounces and complaints, transactional and marketing mail separated by stream or IP pool, and deliverability guidance in the documentation.
8 — Dedicated IPs with automatic warm-up and pool management, a stated acceptable-use and vetting process for shared pools, feedback loops and blocklist monitoring, DMARC reports, BIMI or custom tracking domains, compliance with the Gmail and Yahoo sender requirements stated, delivery times published, and access to deliverability experts.
10 — Deliverability that can be verified: delivery time and bounce rates per mailbox provider published continuously with their method, inbox placement testing included, pool reputation shown to the customer, and a documented escalation path with mailbox providers.
The SaaS Developer
SPF, DKIM and DMARC set-up are documented with a DMARC generator and vendor-generated DKIM keys, private IPs with pool management and custom rDNS are sold, and suppressions automatically exclude unsubscribes, hard bounces and complaints. I found no public information on shared-pool vetting, dedicated-IP warm-up, feedback loops, blocklist monitoring or Gmail and Yahoo bulk-sender compliance, so I would hesitate before pointing our invoice and reset traffic at it. 1 3 5 13 14
The Platform Engineer
SPF and DKIM set-up is documented with vendor-generated DKIM keys and a DMARC generator, suppressions automatically gather unsubscribes, hard bounces and complaints with the reason visible, private IPs with self-managed pools are an add-on, and delivery experts consult on records and dedicated IPs. I found no public information on IP warm-up, shared-pool vetting, feedback loops, blocklist or DMARC monitoring, Gmail and Yahoo bulk-sender compliance, or published delivery times — and latency per mailbox provider is what I need for one-time codes. 13 14 5 1 3
The Shop Operator
The help article gives the exact SPF record to paste (v=spf1 a mx include:_spf.elasticemail.com ~all), says Elastic Email generates the DKIM keys, and a DMARC generator plus consultants for SPF, DKIM and dedicated IP addresses cover the guided set-up a non-specialist like me needs. Suppressions exclude hard bounces, complaints and unsubscribes from further sending, private IPs with own pool management are an add-on, and channels plus custom IP pools let me tag order confirmations apart from the newsletter. We found no public information on shared-pool vetting, automatic IP warm-up, feedback loops, blocklist monitoring or Gmail and Yahoo bulk-sender compliance. 1 3 5 11 13 14
The Data Protection Officer
SPF, DKIM and DMARC set-up are documented with a DMARC generator and vendor-generated keys, unsubscribes, hard bounces and complaints are gathered into a suppression list excluded from further sending, and private IPs, custom pools, custom reverse DNS and delivery-expert consultations are offered. We found no public information on shared-IP vetting, dedicated-IP warm-up, feedback loops, blocklist or DMARC monitoring, or published delivery times. 13 14 5 1 3
The Agency Lead
Domain verification covers SPF, DKIM, MX and DMARC with a published SPF record and a DMARC generator, private IPs with pool management are offered as an add-on, and hard bounces, complaints and unsubscribes land automatically in suppressions with the reason visible. We found no public information on dedicated-IP warm-up, shared-pool vetting, feedback loops, or stated compliance with the Gmail and Yahoo bulk-sender rules. 1 3 5 13 14
The Skeptic
SPF, DKIM and DMARC set-up are guided in the help centre with the vendor generating the DKIM keys, a DMARC record generator is offered, private IPs with self-managed pools and custom rDNS are sold as add-ons, and suppressions gather hard bounces, complaints and unsubscribes with the reason viewable per address. We found no public information on shared-pool vetting, dedicated-IP warm-up, feedback loops, blocklist monitoring, stated compliance with the Gmail and Yahoo sender rules, or any published delivery or inbox-placement figures with their method. 1 3 5 13 14
Message logs, events & webhooks
Show reasoningHide reasoning
How this is scored
What the team can see about each message once the application has handed it over: a message log searchable by recipient, subject, tag or message ID, the full event history (processed, delivered, deferred, bounced with the remote server's answer, opened, clicked, complained), how long logs and message content are kept, event webhooks with retries and a signature, an events API, dashboards and statistics per stream, tag or domain, alerts on bounce or complaint spikes, and access for a support team without developer rights.
0 — Nothing can be seen after sending; no logs, no events and no webhooks.
3 — Totals of sent and bounced messages; per-message logs, webhooks and retention are basic or not described.
5 — A searchable message log with per-message event history and the bounce reason, log retention stated, event webhooks for delivery, bounce, open, click and complaint, statistics per tag or domain, and an API to fetch events.
8 — Webhooks signed and retried with their schedule documented, the raw SMTP response and the rendered message viewable per send, log retention configurable or extended by plan, alerts on bounce, complaint or delivery-time thresholds, export or streaming of events to a named log or data tool, and read-only roles for support staff.
10 — Full traceability: every message traceable from API call to the receiving server's final answer, events streamed in real time with ordering and delivery guarantees stated, long retention with search across the whole history, and observability features documented with their limits.
The SaaS Developer
The webhook signing story is genuinely good — HMAC-SHA256 on every request, one-time secrets with rotation via API, POST-JSON delivery, a documented replay window and a 24-hour retry during secret rotation — and there is a per-contact log from sent through opened, clicked, bounced and suppressed plus an events API. The documented webhook events are sends, opens, clicks, bounces and unsubscribes with no delivered or complaint event, webhooks sit on Pro plans only, and the terms say email records may be erased after fourteen days, so answering 'did this user get the reset mail?' weeks later looks uncertain. 1 3 7 15 16
The Platform Engineer
There is a per-contact event log from sent through opened, clicked, bounced and suppressed, Events and Statistics API modules, per-channel statistics, and webhooks for send, open, click, bounce and unsubscribe signed with HMAC-SHA256, a five-minute replay window, POST-JSON delivery and a secret-rotation endpoint — though signing is restricted to Pro plans. The terms allow copies of sent mail to be erased after fourteen days, but I found no public information on configurable log retention, bounce-spike alerts, or the receiving server's raw answer per message. 1 3 15 16 7 11
The Shop Operator
Every contact's message history from send through open, click, bounce and suppression sits in the logs, events are pushed by webhook in real time, and the webhook documentation is unusually precise: HMAC-SHA256 signing, secret rotation, a 24-hour retry window and a 5-minute replay tolerance. The terms state email records may be permanently erased after fourteen days, but we found no public information on configurable log retention, alerts on bounce or complaint spikes, or read-only dashboard access for support staff. 1 7 15 16
The Data Protection Officer
Per-message activity is viewable from send through open, click, bounce and suppression, events are fetchable through the API and delivered by webhook for sends, opens, clicks, bounces and unsubscribes, and webhooks can be signed with HMAC-SHA256, rotated, and retried for up to 24 hours with a documented clock rule. The terms let the vendor erase email records after fourteen days at its discretion, and we found no public information on configurable retention, the raw SMTP response per message, or alerts when bounces or complaints spike. 1 3 15 16 7
The Agency Lead
Every action of a contact is logged from send through open, click, bounce and suppression, channels are searchable in the activity view, and webhooks for sends, opens, clicks, bounces and unsubscribes are signed with HMAC-SHA256 with secret rotation, a five-minute replay window and a 24-hour retry — unusually thorough security documentation for webhooks. The terms state email records may be erased after fourteen days at the vendor's discretion. We found no public information on viewing the receiving server's raw answer per message, configurable log retention, or alerts on bounce and complaint spikes. 1 3 7 11 15 16
The Skeptic
Per-contact activity logs cover sent, opened, clicked, bounced and suppressed events, there is an events API and a statistics module, and webhooks for sends, opens, clicks, bounces and unsubscribes are signed with HMAC-SHA256 with secret rotation, a five-minute replay window and a 24-hour retry when a rotated secret is rejected — signing documentation I rarely see this thorough. But copies of sent emails may be erased after fourteen days at the vendor's sole discretion, and we found no public information on the raw SMTP response per message, configurable retention, alerts on bounce or complaint spikes, or export of events to external tools. 1 3 7 15 16
Message data, retention & security
Show reasoningHide reasoning
How this is scored
What is stored about each message and what the customer controls: whether message bodies are stored or only metadata, retention periods and the setting to shorten them, deletion of a recipient's data on request, open and click tracking that can be switched off per stream or message, TLS for delivery with an option to require it, encryption at rest, API keys with scopes and per-domain restrictions, IP allow-listing, two-factor authentication and SSO for the dashboard, an audit log, a vulnerability disclosure programme, and security certifications or audits with their scope. Where the data is processed and by whom is scored under sovereignty.
0 — Stores every message indefinitely with no controls, and the vendor states it uses message content for its own purposes.
3 — A privacy policy and a statement that data is encrypted; what is stored, retention and access controls are basic or not described.
5 — What is stored per message documented, retention periods stated, open and click tracking switchable, TLS used for delivery, API keys with restricted permissions, two-factor authentication for the dashboard, and a data processing agreement offered.
8 — Message content retention configurable down to none or metadata only, enforced TLS per domain or message, encryption at rest stated, scoped API keys and IP allow-listing, SSO (SAML) and roles, an audit log, deletion of recipient data by API, and ISO 27001 or SOC 2 stated with its scope.
10 — Data minimisation that can be verified: every stored field and its retention listed, content never stored unless the customer opts in, customer-managed encryption keys or equivalent, independent audits published with their scope, and every security control the customer has listed with its effect.
The SaaS Developer
Sent-email records retention is stated at fourteen days, open and click tracking can be switched off per send, TLS covers SMTP and the API, API keys carry configurable permissions, granular roles, an audit and login log, 2FA and a downloadable DPA exist, and contacts can be deleted by rule through the API. The pages list SSO only as a bullet, and I found no public information on ISO 27001 or SOC 2 certification, encryption at rest, IP allow-listing or configurable content retention — thin comfort for 40,000 users' data. 1 3 7 9 10 17
The Platform Engineer
Copies of sent mail are kept at most fourteen days per the terms, open and click tracking is switchable per message down to tracking type None, TLS covers SMTP and API traffic, multiple API keys carry settable permissions and are shown once, and there is granular access, two-factor authentication, an event and login audit log, and a downloadable data processing agreement. I found no public information on IP allow-listing, a vulnerability disclosure programme, or a certification such as ISO 27001 or SOC 2 — the security page describes reasonable safeguards rather than an audited standard. 7 3 10 17 12 9 1
The Shop Operator
The pages state what is kept (copies of sent emails may be erased after 14 days), that open and click tracking can be switched off per message, TLS for all SMTP traffic, API keys with settable permissions, two-factor authentication, a login and event log, and a downloadable GDPR data processing addendum. The security page describes safeguards like encryption technology and need-to-know access, but we found no public information on encryption at rest, IP allow-listing, or ISO 27001/SOC 2 certification. 3 7 8 9 10 12 17
The Data Protection Officer
A GDPR data processing addendum is downloadable, open and click tracking can be switched off per message, TLS is used for SMTP and API traffic, API keys carry configurable permissions, two-factor authentication (by SMS or email), single sign-on, granular access and an event log of key account actions are present, and account deletion on request is documented. Copies of emails sent may be kept fourteen days at the vendor's discretion rather than the customer's, we found no public information on encryption at rest or IP allow-listing, and the security pages claim no ISO 27001 or SOC 2 certification. 9 8 3 17 1 10 7
The Agency Lead
Open and click tracking can be switched off per send, multiple API keys carry settable permissions, two-factor authentication, an event log and a login log exist, TLS covers both API and SMTP, and a GDPR data processing agreement is downloadable. The captured pages give a fourteen-day figure for email records but describe encryption only as 'encryption technology' and name no security certification. We found no public information on IP allow-listing or deletion of a recipient's data by API. 1 3 7 8 9 10 12 17
The Skeptic
Copies of sent emails are stored and may be permanently erased after fourteen days at the vendor's discretion; open and click tracking are switchable per message, TLS covers SMTP and API traffic, API keys carry per-key permissions, 2FA exists via SMS or email, account-level event logging is described, and a GDPR data processing addendum is downloadable. We found no public information on encryption at rest, IP allow-listing, or any certification such as ISO 27001 or SOC 2 — the security page itself claims none — and SSO appears only as a name in a feature list. 3 7 8 9 10 12 17
Reliability, accounts & support
Show reasoningHide reasoning
How this is scored
Whether the platform can be relied on and run by a team: a public status page with incident history, uptime SLA and service credits published, redundancy or failover across data centres described, queueing and retry of mail during outages, sub-accounts or servers per application, client or tenant, team members with roles, separate environments, support channels and response times per plan, named migration help, and integrations with platforms that send mail on the customer's behalf (WordPress, Shopify, Shopware, Supabase, Vercel and similar).
0 — No status page, no support channel and no way to separate users or applications.
3 — A support contact and a single account; status page, SLA, sub-accounts and roles are basic or not described.
5 — A public status page with incident history, an uptime SLA on at least one plan, sub-accounts or separate servers per application, team members with roles, support by email or chat with stated hours, and plugins or guides for several named platforms.
8 — An SLA with service credits published, redundancy across data centres or regions described, mail queued and retried during incidents, sub-accounts with their own keys, domains and limits manageable by API, granular roles, support response times per plan, and migration assistance offered.
10 — Reliability that can be verified: uptime history published for years, post-mortems for incidents, multi-region failover documented, an SLA covering delivery latency as well as API availability, and white-label or reseller tooling for agencies and platforms.
The SaaS Developer
Unlimited sub-accounts with their own credit limits, IPs and domains managed through the API, plus reseller and custom-branding features, user management, 24/7 email and chat support and plugins for WordPress, Shopify, Zapier, Mautic and more give a twelve-person team real multi-tenant structure. I found no public information on an uptime SLA or incident history — only a 'Status' link on the API page — and no stated support response times or migration help, so reliability is asserted rather than promised. 1 3 4 5 18 19
The Platform Engineer
Sub-accounts are genuinely strong — unlimited, each with its own IP, domain, custom credit limit and 2FA — support runs 24/7 by email and chat, and there are plugins for WordPress, WP Mail SMTP, Gravity SMTP, Shopify, Zapier and Mautic, with real-time database replication and rotated backups described. I read the status page before the feature list, and here I found no uptime SLA with service credits, no incident history, and no statement that mail is queued and retried during an outage — for an OTP pipeline that last gap is the difference between a blip and an outage. 18 1 4 19 10
The Shop Operator
Sub-accounts are the strongest part: unlimited in number, each with its own IP, domain and custom credit limit, and manageable through the API, so I could give the shop and the newsletter tool their own spaces. Support runs 24/7 by email and chat, with a paid 'Dedicated Support' add-on reaching delivery experts, and plugins exist for WordPress, Shopify, BigCommerce and others — but we found no public information on a Shopware plugin, an uptime SLA with credits, or an incident history, the developer pages showing only a 'Status' link. 1 3 4 5 12 18 19
The Data Protection Officer
Sub-accounts are unlimited with per-sub-account IP, domain, credit limits and two-factor authentication, combined with custom branding for reselling, alongside user management, 24/7 email and chat support, real-time database replication and data centres in the EU, the United States and Canada, and plugins for WordPress, Shopify, Zapier and other platforms. We found no public information on an uptime SLA, service credits, incident history or post-mortems, or on queueing of mail during outages. 18 5 1 10 4
The Agency Lead
For an agency this is close to the ideal account model: unlimited sub-accounts each with its own credit limit, IP and domain, manageable through the API, two-factor authentication per sub-account, custom branding for reselling, vendor plugins for WordPress, Shopify, Mautic and WP Mail SMTP, and 24/7 support by email and chat. We found no public information on an uptime SLA with service credits, mail queueing during incidents, support response times per plan, or an incident history behind the status link in the developer navigation. 1 3 4 5 10 18 19
The Skeptic
Sub-accounts are a genuine strength: unlimited, each with its own sending limits, IP and domain, manageable through the API, with user management, reseller features, 24/7 email and chat support, and vendor-maintained plugins for WordPress, Shopify, Zapier and Cloudways. What worries me is the reliability half of the criterion: we found no public information on an uptime SLA, service credits or incident history — only a bare Status link on the developers page — and nothing on queueing, redundancy or failover during outages. 1 4 5 18 19
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where messages, logs and recipient data are processed and stored, whether an EU region can be chosen and what it covers, and who the subprocessors are (cloud hosting, sending infrastructure, logging, support and payment tools). Independently sourced by the sovereignty pipeline; every message carries personal data, so the whole sending chain counts, not only the dashboard.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — An EU region available and an EU contracting entity or EU representative, but parts of the chain (sending infrastructure, logs, support, payment) run through non-EU providers without a stated safeguard, or the EU region does not cover logs and account data.
8 — EU processing of messages, logs and account data on named infrastructure, an EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, sending infrastructure and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The SaaS Developer
Contracting is with Elastic Email Inc., a Canadian corporation under British Columbia law with arbitration in Victoria, and the privacy policy says personal data may be processed in Canada, the United States and the EU across several data centres, with a downloadable GDPR DPA; subprocessors appear only as categories apart from Stripe and PayPal for payments. There is a Polish office in Szczecin, but I found no public information on an EU-region choice, an EU contracting entity or representative, or a named subprocessor list with locations. 6 7 8 9 10
The Platform Engineer
The contracting entity is a Canadian corporation in Vancouver under British Columbia law with arbitration in Victoria, data may be processed in the United States and the EU, hosting runs across EU, US and Canadian data centres, and a GDPR data processing agreement is downloadable. Subprocessors appear as categories with Stripe and PayPal named for payments, but I found no public information on an EU contracting entity or representative, a customer-selectable EU region, or certifications covering the chain. 6 7 10 8 9
The Shop Operator
Elastic Email Inc. is a Canadian corporation contracting under British Columbia law with arbitration in Victoria, BC, hosting across data centres in the EU, the United States and Canada, and the privacy policy acknowledges transfers between those regions. A GDPR data processing addendum is downloadable and a Polish office is listed, but we found no public information on choosing an EU-only region, an EU contracting entity or representative, or a named subprocessor list — only categories such as web hosts and payment processors, with Stripe and PayPal named for payments. 6 7 8 9 10
The Data Protection Officer
The contracting entity is Elastic Email Inc., a Canadian corporation under British Columbia law with arbitration in Victoria, BC, and data hosted across data centres in the EU, the United States and Canada, with no EU-only region evidenced. A downloadable GDPR data processing addendum and a designated privacy officer exist, but subprocessors appear only as categories — payments via Stripe and PayPal — without locations, and no certification is claimed; as a processor review, this is a non-European processor with a DPA. 7 10 8 9 6
The Agency Lead
The contracting entity is a Canadian corporation under British Columbia law with arbitration in Victoria, and hosting runs across data centers in the EU, the United States and Canada with no evidenced way to confine processing to the EU. A GDPR data processing agreement is downloadable and a Polish office exists in Szczecin, but subprocessors appear only as categories plus Stripe and PayPal, and the captured pages name no security certification. 6 7 8 9 10
The Skeptic
The contracting entity is Elastic Email Inc., a Canadian corporation governed by British Columbia law with arbitration in Victoria, BC; data is hosted at data centers in the EU, the United States and Canada, and the privacy policy acknowledges transfers to the United States. The data processing addendum is downloadable, but subcontractors are named only by category, payments run through Stripe and PayPal, and we found no public information on a customer-selectable EU region or an EU contracting entity. 6 7 8 9 10
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly message volume, the price per additional thousand messages, the free tier and its limits, what dedicated IPs, extra log retention, sub-accounts, SSO and support plans cost, minimum term, and whether unused volume carries over.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with volume or which features cost extra is unclear.
5 — Tiers are public with their monthly volume and price, but at least one commonly needed piece (overage rate, dedicated IP, longer log retention, SSO, support plan) is unpriced or "on request".
8 — Every tier priced publicly with its volume and overage rate per thousand messages, dedicated IPs and add-ons priced, log retention per tier stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given monthly volume, number of domains and sub-accounts and feature set, with every add-on, support and overage fee and the cancellation terms published.
The SaaS Developer
The tiers are public — free at 100 emails a day, Starter at $ 19 / month for up to 50,000 emails/month and Pro at $ 49 / month for up to 50,000 emails/month — with a volume slider reaching 10,000,000 and USD billing stated. But the private-IP and Dedicated Support add-ons carry no prices, and I found no public information on overage rates per thousand messages, per-tier log retention, minimum term or VAT treatment, so I cannot compute our real annual cost from these pages. 5 7
The Platform Engineer
Tiers are public with volume and price — Starter at $19 per month for up to 50,000 emails and Pro at $49 per month for up to 50,000 emails — and the captured pages give different figures for the free tier, showing both "Free $ 0 / month for up to 3,000 emails/month" and "100 emails/day free", so I quote both. I cannot compute a real annual cost from these pages alone: the overage rate per thousand, the price of private IPs and dedicated support, and the prices between the volume slider's 50,000 and 10,000,000 marks are not shown, and above 1,000,000 contacts it is a sales contact. 5 1 7
The Shop Operator
The pricing page publishes the free tier ('Free $ 0 / month for up to 3,000 emails/month', also shown as '100 emails/day free'), Starter at $ 19 / month for up to 50,000 emails/month and Pro at $ 49 / month for the same volume, with USD billing and twelve-month credit expiry in the terms. The overage rate per thousand messages, the prices of Private IPs and Dedicated Support, minimum term and VAT treatment are not stated, so I cannot compute my yearly cost from the public pages alone. 1 5 7
The Data Protection Officer
The tiers are public: a free plan at $0 per month for up to 3,000 emails per month (described on other pages as 100 emails per day free), Starter at $19 per month for up to 50,000 emails per month, and Pro at $49 per month for up to 50,000 emails per month, with a volume slider to 10,000,000 emails per month and custom pricing above 1,000,000 contacts. Private IPs and dedicated support are listed without prices, and we found no public information on overage rates per additional thousand messages, minimum term, VAT treatment, or whether unused volume carries over. 5 1 7
The Agency Lead
Tiers are public — a free plan at $ 0 / month for up to 3,000 emails/month with 100 emails/day free, Starter at $ 19 / month for up to 50,000 emails/month, Pro at $ 49 / month for up to 50,000 emails/month including sub-accounts and webhooks, and a volume slider reaching 10,000,000 emails/month. But we found no public price for the private-IP and dedicated-support add-ons, no overage rate per additional thousand messages, and no VAT treatment, so a per-client line in a maintenance contract cannot be computed from public pages alone. 5 7 18
The Skeptic
The tiers are public: Free at $0 per month for up to 3,000 emails per month (also quoted as 100 emails a day), Starter at $19 per month for up to 50,000 emails/month, Pro at $49 per month for up to 50,000 emails/month, and custom pricing only above 1,000,000 contacts. The commonly needed extras are unpriced — Private IPs and Dedicated Support are offered with no figures — and we found no public information on an overage rate per additional thousand messages, VAT treatment or minimum term; billing is in US dollars and unused credit expires after twelve inactive months. 1 5 7
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Elastic Email API
Is Elastic Email API European?
No. whats-best.ai classifies Elastic Email API as Rest of world.
Where does Elastic Email API store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention the EU, United States and Canada as hosting locations, per the vendor’s page captured 1 Nov 2026.
Does Elastic Email API have a free plan?
Yes. Elastic Email API has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Elastic Email API?
As of 2 Nov 2026, the panel rates Lettermint (3.5/5), Bird Email API (formerly SparkPost) (3/5) and Postmark (3/5) highest among the other 15 Transactional Email products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Lettermint (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Elastic Email API alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Open source, Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (20)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (email API) elasticemail.com Checked 1 Nov 2026 Details →
- 2 Features page (SMTP relay) elasticemail.com Checked 1 Nov 2026 Details →
- 3 API documentation elasticemail.com Checked 1 Nov 2026 Details →
- 4 Integrations page elasticemail.com Checked 1 Nov 2026 Details →
- 5 Pricing page elasticemail.com Checked 1 Nov 2026 Details →
- 6 Legal notice (company locations) elasticemail.com Checked 1 Nov 2026 Details →
- 7 Terms of service elasticemail.com Checked 1 Nov 2026 Details →
- 8 Privacy policy elasticemail.com Checked 1 Nov 2026 Details →
- 9 Data processing agreement (dpa) elasticemail.com Checked 1 Nov 2026 Details →
- 10 Security / trust page elasticemail.com Checked 1 Nov 2026 Details →
- 11 Sending API, SMTP & developer experience — found from sitemap help.elasticemail.com Checked 1 Nov 2026 Details →
- 12 Sending API, SMTP & developer experience — found from sitemap help.elasticemail.com Checked 1 Nov 2026 Details →
- 13 Deliverability & sender reputation — found from sitemap help.elasticemail.com Checked 1 Nov 2026 Details →
- 14 Deliverability & sender reputation — found from sitemap elasticemail.com Checked 1 Nov 2026 Details →
- 15 Message logs, events & webhooks — found from sitemap elasticemail.com Checked 1 Nov 2026 Details →
- 16 Message logs, events & webhooks — found from sitemap help.elasticemail.com Checked 1 Nov 2026 Details →
- 17 Message data, retention & security — found from sitemap help.elasticemail.com Checked 1 Nov 2026 Details →
- 18 Reliability, accounts & support — found from sitemap elasticemail.com Checked 1 Nov 2026 Details →
- 19 Reliability, accounts & support — found from sitemap elasticemail.com Checked 1 Nov 2026 Details →
- 20 Code repository (open-source licence) — found from the homepage github.com Checked 1 Nov 2026 Details →