Transactional Email
Lettermint
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Lettermint B.V. · lettermint.co
Compare with Postmark → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Lettermint at a glance
- Vendor
- Lettermint B.V.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Lettermint 3.5/5, the mean of 6 judges. Lettermint is a transactional email API and SMTP relay from Lettermint B.V., a founder-owned Dutch company in Zwolle. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Lettermint is a transactional email API and SMTP relay from Lettermint B.V., a founder-owned Dutch company in Zwolle. Its strongest dimension is sovereignty, scored 8-9: EU-only hosting, storage and processing on the vendor's own infrastructure and network, a subprocessor list naming only UpCloud and Postmastery in the Netherlands and OVH Cloud in Germany as handling email, an automatically applicable Article 28 GDPR data processing agreement, and independently audited ISO/IEC 27001:2022 certification. Data and security follows at 7-8, observability at 7, sending API and deliverability at 6-7. The weakest is pricing transparency at 3-4: the captured pricing page shows the free tier's 300 monthly emails but no euro prices for paid plans, an overage described only as "a small fee", and an unpriced dedicated IP add-on, so annual cost cannot be computed from public pages. Reliability and accounts sits at 5-6: no public status page or incident history was found, and a written SLA appears only for enterprise customers on Pro. flagged splits registered none; score spreads run at most a single point.
Speaks for it
- EU-only hosting, storage and processing on the vendor's own infrastructure and network, with every subprocessor listed by role, location and email access
- An Article 28 GDPR data processing agreement applies automatically, is countersigned on request, and gives thirty days' notice with objection rights before subprocessor changes
- Retention is stated with hard numbers — 28 days for message content and events, no more than 14 for logs, 90 for analytics events
- Sending is documented across a REST API with downloadable OpenAPI schema, an SMTP relay with every port and authentication mechanism, official SDKs, batch sending up to 500 emails per request and sandbox projects
- Webhooks are HMAC-SHA256 signed with a published retry schedule of twelve attempts over roughly fourteen hours and manual retry from the dashboard
Held against it
- No euro price for any paid plan appears on the captured pricing pages, and the overage is described only as a small fee
- We found no public information on a status page with incident history or on service credits
- A written service level agreement with uptime and response-time guarantees exists only for enterprise customers on the Pro plan
- We found no public information on two-factor authentication or SAML single sign-on for the dashboard
- Message history is fixed at 28 days on every plan, and we found no public information on configuring or extending that retention
Best for
- You need transactional email with EU-only hosting, storage and processing on the vendor's own infrastructure, documented for a data-protection review
- You must hand your data protection officer a countersigned Article 28 GDPR data processing agreement and a published subprocessor list
- You need to answer did-it-arrive questions yourself — a searchable message log, per-message event timelines, message content and HMAC-signed webhooks with a documented retry schedule
- You send from PHP, Laravel or Symfony and want SMTP and a REST API documented down to ports and authentication mechanisms
Avoid if
- You must compute a real annual cost from published prices before committing — the captured pricing pages give no euro amounts for paid tiers and describe the overage only as a small fee
- You need a written uptime and response-time SLA outside an enterprise contract — the written SLA exists only for enterprise customers on the Pro plan
- You need more than 28 days of message history — retention is fixed at 28 days on every plan
- You need to invite colleagues on the free Developer plan, which seats one user until you upgrade
The scores
| Criterion | Panel median |
|---|---|
| Sending API, SMTP & developer experience | 3.5 of 5 |
| Deliverability & sender reputation | 3.5 of 5 |
| Message logs, events & webhooks | 3.5 of 5 |
| Message data, retention & security | 3.5 of 5 |
| Reliability, accounts & support | 3 of 5 |
| European sovereignty | 4.5 of 5 |
| Pricing transparency | 2 of 5 |
Sending API, SMTP & developer experience
Show reasoningHide reasoning
How this is scored
How an application sends mail: a REST API and an SMTP relay with their limits stated, official SDKs and drivers for named languages and frameworks (PHP and Laravel, Node, Python, Ruby and Rails, Java, Go, .NET), stored templates with variables and versions, batch sending, attachments, idempotency keys, scheduled sending, a test or sandbox mode that does not deliver, inbound email parsed into a webhook, and the quality of the API reference and guides.
0 — Not a sending service; an application cannot send email through it by API or SMTP.
3 — An API or SMTP credentials to send a message; SDKs, templates, limits and a test mode are basic or not described.
5 — A documented REST API and SMTP relay, official SDKs for several named languages, stored templates with variables, attachments and batch sending, rate limits stated, a sandbox or test mode, and quick-start guides for named frameworks.
8 — An API reference with every endpoint and error code, idempotency keys, scheduled sending, template versions and a template language documented, inbound email parsed to a webhook, an OpenAPI specification or official CLI, framework drivers maintained by the vendor, and a migration guide from named competitors.
10 — An API a team builds its product on: versioning and deprecation policy published, backward compatibility stated, full parity between API and SMTP features, local or staging test tooling that mirrors production, and every limit, timeout and retry behaviour documented.
The SaaS Developer
Official SDKs cover exactly what my stack needs — Laravel, PHP and Symfony next to Node, Python, Go, Java,.NET, Rust and Elixir — and the SMTP relay documents every port, auth mechanism and even bare-LF rejection, with batch sending up to 500 emails per request, attachments, tags, scheduled sending via header, Sandbox projects with simulated results, a downloadable OpenAPI schema, a CLI and an MCP server. Rate limits are stated as no fixed per-minute throttle with plan quota and abuse controls. I found no public information on stored templates with variables, sending idempotency keys, or a migration guide from named competitors, which keeps it below the top anchors. 2 4 6 7 13 14
The Platform Engineer
Sending is documented across a REST API with a downloadable OpenAPI schema and an SMTP relay whose host, six ports, auth mechanisms and required TLS are all spelled out, with official SDKs for Node.js, PHP, Python, Go, Java,.NET, Rust and Elixir plus Laravel, Symfony and a WordPress plugin, batch sending up to 500 emails per request, attachments, tags, scheduled sending, and sandbox projects with simulated results. We found no public information on stored templates, sending idempotency keys, or an API versioning and deprecation policy. 2 4 5 6 13 14
The Shop Operator
The SMTP relay is documented down to host, ports and authentication, and there are official SDKs for PHP, Laravel, Symfony, Python, Node, Go, Java,.NET, Rust and Elixir, plus batch sending up to 500 emails per request, a sandbox mode, scheduled sending and an OpenAPI schema to download. We found no public information on stored templates with variables and versions, on idempotency keys for sending, or on a migration guide from named competitors. 2 6 7 13 14
The Data Protection Officer
The sending surfaces are thoroughly documented: a REST API with a downloadable OpenAPI schema and playground, an SMTP relay with host, ports and authentication mechanisms specified, official SDKs for named languages including Laravel and Symfony, a CLI and an MCP server, batch sending up to 500 emails per request, scheduled sending and a sandbox mode with simulated results. We found no public information on stored templates with versions, API idempotency keys or a migration guide, which is what keeps this below the highest level. 13 14 2 6
The Agency Lead
Official SDKs for ten named languages including Laravel, Symfony and.NET, a REST API with a downloadable OpenAPI schema, a CLI and MCP server, sandbox projects with simulated results, scheduled sending on Growth and Pro, and a batch endpoint taking five hundred emails per request cover nearly everything my team touches. We found no public information on stored templates with versions, sending idempotency keys, or a migration guide from the providers I would be moving thirty clients off, which is what keeps this short of the top band. 2 13 14 5 7
The Skeptic
A documented REST API with a downloadable OpenAPI schema and playground, official SDKs for eight named languages plus a CLI, MCP server, Terraform provider and WordPress plugin, batch sending up to 500 emails with no fixed rate limit, sandbox projects, and an SMTP guide that details ports, authentication and control headers including scheduled sending. We found no public information on stored templates with variables and versions or on idempotency keys for sending, and no migration guide from named competitors is described. 2 4 6 7 13 14
Deliverability & sender reputation
Show reasoningHide reasoning
How this is scored
What the vendor does so the mail reaches the inbox: guided SPF, DKIM and DMARC set-up with a custom return path and tracking domain, shared IP pools and how senders on them are vetted and policed, dedicated IPs with automatic warm-up, transactional and bulk mail kept on separate streams or IP pools, bounces, complaints and unsubscribes turned into suppressions automatically, feedback loops with mailbox providers, blocklist and DMARC monitoring, compliance with the Gmail and Yahoo bulk-sender rules, and published delivery times or inbox placement with their method.
0 — No sender authentication and no bounce handling; mail goes out from shared addresses with no reputation management at all.
3 — SPF and DKIM can be set up and bounces are recorded; IP policy, stream separation and suppressions are basic or not described.
5 — Guided SPF, DKIM and DMARC set-up with a custom return path, shared IPs with a stated sender vetting policy, dedicated IPs available, automatic suppression of hard bounces and complaints, transactional and marketing mail separated by stream or IP pool, and deliverability guidance in the documentation.
8 — Dedicated IPs with automatic warm-up and pool management, a stated acceptable-use and vetting process for shared pools, feedback loops and blocklist monitoring, DMARC reports, BIMI or custom tracking domains, compliance with the Gmail and Yahoo sender requirements stated, delivery times published, and access to deliverability experts.
10 — Deliverability that can be verified: delivery time and bounce rates per mailbox provider published continuously with their method, inbox placement testing included, pool reputation shown to the customer, and a documented escalation path with mailbox providers.
The SaaS Developer
Domain set-up is guided and specific: SPF, DKIM and DMARC required before sending, hosted DKIM with automatic rotation, a CNAME-based return path, and a knowledge base covering bounces, blacklists and greylisting; transactional and broadcast mail leave on separate, pre-warmed IP pools on their own network, hard bounces are suppressed automatically, and a live Time to Inbox page shows delivery speed per mailbox provider. Spam Insights with a documented score scale and custom tracking domains exist but are plan-gated. I found no public information on dedicated-IP warm-up automation, feedback loops with mailbox providers, DMARC reports, or a statement on the Gmail and Yahoo bulk-sender requirements. 1 2 7 11 15 16 17
The Platform Engineer
Authentication is handled properly — SPF, DKIM and DMARC required before sending, hosted DKIM with automatic rotation, a CNAME-based custom return path — and transactional and broadcast mail go out on separate, already-warmed IP pools with automatic suppression of hard bounces, spam scoring, and a live Time to Inbox page showing delivery speed per mailbox provider. We found no public information on a vetting policy for shared pools, feedback loops with mailbox providers, DMARC reports, or a stated position on the Gmail and Yahoo bulk-sender requirements. 1 2 7 15 16 11
The Shop Operator
SPF, DKIM and DMARC are required before you can send, the DKIM key is hosted and rotated for you, a CNAME-based return path needs no manual SPF record, and transactional mail and newsletters go out on separate, already-warmed IP pools — exactly the separation I need between order confirmations and campaigns. Hard bounces are suppressed automatically, spam scores and a live Time to Inbox page per mailbox provider are published, and dedicated IPs exist as an add-on from 300,000 emails a month. We found no public information on vetting of senders on shared pools, feedback loops, DMARC reports or an explicit statement on the Gmail and Yahoo bulk-sender rules. 1 2 7 15 16 17
The Data Protection Officer
SPF, DKIM and DMARC are required before sending, with a hosted and rotated DKIM key and a CNAME return path whose SPF record the vendor maintains; transactional and broadcast mail leave on separate, already-warmed IP pools on the vendor's own network, hard bounces are suppressed automatically, and delivery speed per mailbox provider is published live. We found no public information on a vetting policy for shared pools, feedback loops, or a statement on the Gmail and Yahoo bulk-sender requirements. 2 16 1 7 15 11
The Agency Lead
SPF handled by a CNAME approach, hosted and rotated DKIM, DMARC required before sending, pre-warmed IP pools with transactional and broadcast kept apart, automatic hard-bounce suppression, spam-score insights and a live Time to Inbox page per mailbox provider are all documented. We found no public information on a vetting policy for senders on the shared pools, feedback loops, DMARC reports, or a statement on the Gmail and Yahoo bulk-sender rules, so I stop below the higher marks. 2 16 1 7 17
The Skeptic
SPF, DKIM and DMARC are required before sending with hosted, rotating DKIM keys and a CNAME-based return path, transactional and broadcast mail go out on separate pre-warmed pools, hard bounces are suppressed automatically, and a live per-provider Time to Inbox page plus third-party reputation monitoring are published. We found no public information on how senders on the shared pools are vetted and policed, on feedback loops, DMARC reporting or a statement on the Gmail and Yahoo bulk-sender rules, and only hard bounces are described as automatically suppressed. 1 2 7 11 15 16 17
Message logs, events & webhooks
Show reasoningHide reasoning
How this is scored
What the team can see about each message once the application has handed it over: a message log searchable by recipient, subject, tag or message ID, the full event history (processed, delivered, deferred, bounced with the remote server's answer, opened, clicked, complained), how long logs and message content are kept, event webhooks with retries and a signature, an events API, dashboards and statistics per stream, tag or domain, alerts on bounce or complaint spikes, and access for a support team without developer rights.
0 — Nothing can be seen after sending; no logs, no events and no webhooks.
3 — Totals of sent and bounced messages; per-message logs, webhooks and retention are basic or not described.
5 — A searchable message log with per-message event history and the bounce reason, log retention stated, event webhooks for delivery, bounce, open, click and complaint, statistics per tag or domain, and an API to fetch events.
8 — Webhooks signed and retried with their schedule documented, the raw SMTP response and the rendered message viewable per send, log retention configurable or extended by plan, alerts on bounce, complaint or delivery-time thresholds, export or streaming of events to a named log or data tool, and read-only roles for support staff.
10 — Full traceability: every message traceable from API call to the receiving server's final answer, events streamed in real time with ordering and delivery guarantees stated, long retention with search across the whole history, and observability features documented with their limits.
The SaaS Developer
Email Activity searches messages by sender, recipient, subject, status, project, route, tag or date range and shows a per-message event timeline with bounce, complaint and failure metadata plus the source, HTML and plain text — that answers my did-the-reset-mail-arrive question without a ticket. Webhooks are signed with HMAC-SHA256 on rotatable secrets and retried on a fully documented schedule of twelve attempts over roughly fourteen hours, with per-delivery status, next-retry times, manual retry and a test button, and a read-only messages API behind a read scope. Retention is stated but fixed at twenty-eight days of message history on every plan, and I found no public information on bounce or complaint spike alerts or on streaming events to an external log tool. 5 7 10 11 17 18 21
The Platform Engineer
The message log searches by sender, recipient, subject, status, project, route, tag and date range and shows per-recipient event timelines with bounce, complaint and failure metadata plus the source, HTML and plain text of each message, also fetchable by API; webhooks are HMAC-signed with a documented twelve-attempt retry schedule over roughly fourteen hours, idempotent event identifiers, and a deliveries API with manual retry. We found no public information on alerts for bounce or complaint spikes or on export to external log tooling, and retention is fixed at 28 days for messages and up to 14 for logs rather than configurable. 5 7 10 17 18
The Shop Operator
Email Activity lets me search messages by recipient, subject, status, project, route, tag and date range, open the event timeline plus the source, HTML and plain text of each send, and the Team API serves messages, per-recipient events and content over HTTP. Webhooks cover 22 event types including delivered, hard bounce, soft bounce and spam complaint, are signed with HMAC-SHA256, and retry on a documented schedule of twelve attempts over roughly fourteen hours with manual retry from the dashboard. Retention is a stated 28 days for message history, and we found no public information on alerts for bounce or complaint spikes, on extending or configuring that retention, or on streaming events to a log tool. 5 7 10 17 18
The Data Protection Officer
The Email Activity view is searchable by sender, recipient, subject, status, project, route and tag, with per-message event timelines and the source, HTML and plain-text content of each send; retention is stated in the data processing agreement at twenty-eight days for messages and no more than fourteen for application, delivery and security logs, and webhooks are HMAC-signed with a documented schedule of twelve attempts over roughly fourteen hours plus a deliveries API and test deliveries. We found no public information on alerts for bounce or complaint spikes or on streaming export to external tools, and message retention is fixed at twenty-eight days rather than configurable or extendable by plan. 17 5 18 7 10
The Agency Lead
Email Activity searches by recipient, subject, tag, project and date range, shows per-recipient events plus the source, HTML and plain text, and the webhook machinery is first class: HMAC-SHA256 signed, twelve attempts across roughly fourteen hours with the schedule published, deliveries listable and retryable, sandbox or live selectable per webhook. Retention is stated at twenty-eight days for messages and fourteen for logs, but we found no public information on configurable or extended retention, bounce or complaint spike alerts, or export to a log tool. 17 5 18 10 7
The Skeptic
The activity view searches by sender, recipient, subject, status, project, route and tag, shows the full event timeline with viewable source, HTML and plain text, and an events API exposes per-recipient results; webhooks are HMAC-signed with a documented twelve-attempt retry schedule, pause and disable behaviour, idempotency guidance and a test endpoint. Retention is stated plainly but fixed — twenty-eight days for message content and events, fourteen for delivery logs, identical on every plan — and we found no public information on alerts for bounce or complaint spikes or on export of events to external tools. 5 7 10 11 17 18
Message data, retention & security
Show reasoningHide reasoning
How this is scored
What is stored about each message and what the customer controls: whether message bodies are stored or only metadata, retention periods and the setting to shorten them, deletion of a recipient's data on request, open and click tracking that can be switched off per stream or message, TLS for delivery with an option to require it, encryption at rest, API keys with scopes and per-domain restrictions, IP allow-listing, two-factor authentication and SSO for the dashboard, an audit log, a vulnerability disclosure programme, and security certifications or audits with their scope. Where the data is processed and by whom is scored under sovereignty.
0 — Stores every message indefinitely with no controls, and the vendor states it uses message content for its own purposes.
3 — A privacy policy and a statement that data is encrypted; what is stored, retention and access controls are basic or not described.
5 — What is stored per message documented, retention periods stated, open and click tracking switchable, TLS used for delivery, API keys with restricted permissions, two-factor authentication for the dashboard, and a data processing agreement offered.
8 — Message content retention configurable down to none or metadata only, enforced TLS per domain or message, encryption at rest stated, scoped API keys and IP allow-listing, SSO (SAML) and roles, an audit log, deletion of recipient data by API, and ISO 27001 or SOC 2 stated with its scope.
10 — Data minimisation that can be verified: every stored field and its retention listed, content never stored unless the customer opts in, customer-managed encryption keys or equivalent, independent audits published with their scope, and every security control the customer has listed with its effect.
The SaaS Developer
What is stored per message comes with hard numbers — content, attachments and events for twenty-eight days, logs for up to fourteen, analytics events for ninety — alongside encryption at rest, daily encrypted backups, TLS 1.2 or higher, and enforced TLS per route with a per-email override that never falls back and reports a 550 with a reason code. Project and team tokens use separate permission systems, IP allow-listing applies to SMTP as well, activity logs and granular roles exist, SCIM provisioning is documented, and ISO 27001:2022 certification is stated with a Trust Center; content can also be hidden per project or route. I found no public information on two-factor authentication, SAML single sign-on, or shortening content retention further. 1 2 7 10 11 14 19 22
The Platform Engineer
Every stored category has a stated retention — message content, attachments, recipient addresses, metadata and events for 28 days, logs no more than 14, analytics events 90 — and the controls I would ask for are documented: enforced TLS per route and per email with no unencrypted fallback, encryption at rest, project API tokens with IP allow-listing that also governs SMTP, dashboard roles separate from API token abilities, activity logs, and an independently audited ISO 27001:2022 certificate in a public Trust Center. We found no public information on two-factor authentication, SAML single sign-on, a vulnerability disclosure programme, or shortening content retention below the stated periods. 1 2 7 10 14 19 21
The Shop Operator
The data processing agreement states exactly what is kept per message — content, attachments, recipient addresses, metadata and events for 28 days, analytics events for 90 days, logs for no more than 14 days — and email content can be hidden per project or route in the dashboard. Delivery uses TLS 1.2 or higher with an enforced-TLS option per route or for a single email, data is encrypted at rest, project API tokens carry IP allowlists, and an ISO 27001:2022 certificate sits in a public Trust Center. We found no public information on two-factor authentication or single sign-on for the dashboard, on deletion of a recipient's data via the API, or on a vulnerability disclosure programme. 1 2 10 11 14 19
The Data Protection Officer
The data processing agreement documents exactly what is stored per message and for how long, forbids sale or advertising use, and gives a twenty-four-hour breach-notification window; enforced TLS can be set per route or overridden for a single email without fallback, mail is encrypted at rest and in transit at TLS 1.2 or higher, tokens are scoped with IP allow-listing, custom roles and activity logs exist, and ISO/IEC 27001:2022 is independently audited. We found no public information on two-factor authentication, SSO for the dashboard, switching open and click tracking off per stream or message, shortening the twenty-eight-day content retention, or the scope of the ISO certificate. 10 11 19 2 21 1 7 14
The Agency Lead
The data processing agreement documents exactly what is held per message for twenty-eight days, encryption at rest and in transit over TLS 1.2 or higher, daily encrypted backups, enforced TLS per route and per email with no fallback, project and team tokens on separate permission systems, IP allow-lists, activity logs, SCIM and an independently audited ISO 27001:2022 certificate in a public trust center. We found no public information on two-factor authentication for the dashboard, SAML single sign-on, or a setting to shorten retention, so I hold it just below the top. 10 19 14 7 11
The Skeptic
What is kept per message — content, attachments, recipient addresses, metadata and events — is written down with its twenty-eight-day retention, TLS can be enforced per route or per single email with no plaintext fallback, API tokens carry IP allow-lists and scoped abilities, and ISO 27001:2022 with a trust centre is public. Content retention is fixed with no shorter or metadata-only option that we could find, and we found no public information on two-factor authentication, SAML single sign-on, or deletion of a recipient's data by API. 1 7 10 14 19 21
Reliability, accounts & support
Show reasoningHide reasoning
How this is scored
Whether the platform can be relied on and run by a team: a public status page with incident history, uptime SLA and service credits published, redundancy or failover across data centres described, queueing and retry of mail during outages, sub-accounts or servers per application, client or tenant, team members with roles, separate environments, support channels and response times per plan, named migration help, and integrations with platforms that send mail on the customer's behalf (WordPress, Shopify, Shopware, Supabase, Vercel and similar).
0 — No status page, no support channel and no way to separate users or applications.
3 — A support contact and a single account; status page, SLA, sub-accounts and roles are basic or not described.
5 — A public status page with incident history, an uptime SLA on at least one plan, sub-accounts or separate servers per application, team members with roles, support by email or chat with stated hours, and plugins or guides for several named platforms.
8 — An SLA with service credits published, redundancy across data centres or regions described, mail queued and retried during incidents, sub-accounts with their own keys, domains and limits manageable by API, granular roles, support response times per plan, and migration assistance offered.
10 — Reliability that can be verified: uptime history published for years, post-mortems for incidents, multi-region failover documented, an SLA covering delivery latency as well as API availability, and white-label or reseller tooling for agencies and platforms.
The SaaS Developer
Projects separate applications with unlimited projects on paid plans and a documented Sandbox-versus-Live environment split, and the account side is unusually strong: Owner, Admin and Member system roles plus custom roles with delegation limits, SCIM provisioning, and enterprise customers on Pro get a written service level agreement with guaranteed uptime and response times. Support runs by ticket, email, social media and Discord from an EU-based team, with a WordPress plugin and no-code integrations. I found no public information on a public status page with incident history, service credits, multi-data-centre failover, or queueing behaviour during outages, and the written SLA sits only at the enterprise level. 2 3 6 7 14 21 22
The Platform Engineer
I read the status page before the feature list, and here we found no public information on a status page, uptime history or incident handling — the written SLA with guaranteed uptime and response times exists only for enterprise customers on Pro, and we found no public information on service credits attached to it. The account side is genuinely good: projects with their own API tokens, Owner/Admin/Member plus custom roles with sane delegation limits, redundancy across availability zones with encrypted backups in Germany, ticket, email and Discord support from an EU-based team, and integrations including WordPress, Zapier, Make and a Terraform provider; we found no public information on response times per plan or named migration help. 2 3 6 7 21 22
The Shop Operator
Projects with their own API tokens separate my shop's order mail from other applications, and the role system is genuinely granular: Owner, Admin and Member plus custom roles, with project access assignable per member. Support runs by ticket, email and Discord from an EU-based team, and enterprise customers on Pro get a written service level agreement with uptime and response-time guarantees. We found no public information on a status page with incident history, on mail queueing during outages, or on a Shopware plugin — WordPress and Symfony Mailer are the named platforms. 3 7 14 21 22
The Data Protection Officer
Teams get granular custom roles with project-level access and self-escalation blocked, sandbox projects provide a separate environment, support runs from Europe across tickets, email and Discord with a written service level agreement for enterprise customers on the Pro plan, and the infrastructure spans multiple availability zones with encrypted backups at a separate German provider. We found no public information on a public status page with incident history, on service credits, or on queueing and retry of mail during incidents, and migration assistance is not described. 7 21 22 2 3 6 14
The Agency Lead
Projects work as the per-client unit I need, each with its own API token, domains, routes, webhooks and an SMTP toggle, and the role model is the best-documented part: custom roles, project-scoped access and delegation limited to your own permissions, so a client can see their own logs and nothing else. We found no public information on a public status page with incident history, service credits, or named migration help, response times appear only as an enterprise SLA, and there is a WordPress plugin plus Zapier and Make but no named support for platforms like Shopify or Shopware. 21 22 7 3 6
The Skeptic
Projects separate applications with their own tokens and SMTP enablement, live and sandbox environments exist, and roles are granular — system roles, custom roles, delegation limits, SCIM — with support by ticket, email and Discord from an EU-based team. An uptime SLA appears only as a written enterprise agreement with no published service credits, and we found no public information on a status page with incident history or on migration assistance. 1 2 3 6 7 21 22
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where messages, logs and recipient data are processed and stored, whether an EU region can be chosen and what it covers, and who the subprocessors are (cloud hosting, sending infrastructure, logging, support and payment tools). Independently sourced by the sovereignty pipeline; every message carries personal data, so the whole sending chain counts, not only the dashboard.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — An EU region available and an EU contracting entity or EU representative, but parts of the chain (sending infrastructure, logs, support, payment) run through non-EU providers without a stated safeguard, or the EU region does not cover logs and account data.
8 — EU processing of messages, logs and account data on named infrastructure, an EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, sending infrastructure and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The SaaS Developer
Lettermint B.V. is a Dutch company in Zwolle, founder-owned with no investors, and states that on every plan it processes and stores email data only in the EU, on its own infrastructure and its own network, with no US cloud, CDN or proxy in between and encrypted backups at a separate provider in Germany. The subprocessor list names UpCloud, OVH Cloud, Postmastery, Aikido and Mistral with their locations and whether they touch email, backed by thirty-day change notice with objection rights, a data processing agreement that applies automatically under Dutch law with countersigning on request, and ISO 27001:2022 certification. Only the certification's published scope and end-of-contract deletion detail are thinner than the rest of this well-evidenced chain. 1 2 3 7 8 10 11
The Platform Engineer
This is the strongest dimension: a Dutch company in Zwolle as the contracting entity, founder-owned with no investors, sending from its own network and infrastructure, and a subprocessor page naming every provider with its location — UpCloud in the Netherlands hosting, OVH Cloud in Germany for encrypted backups, Postmastery in the Netherlands for deliverability monitoring, with no other provider touching email — all under an automatically applicable, countersigned DPA governed by Dutch law, plus a published ISO 27001:2022 certification. What keeps it from the very top is that we found no public information on the certification's scope or a documented deletion procedure beyond the thirty-day retrieval window. 1 2 3 8 10 11
The Shop Operator
A Dutch company in Zwolle, founder-owned with no investors, sends from its own EU network under its own IP addresses with mail processed and stored only in the EU and encrypted backups at a separate provider in Germany. Every subprocessor is listed with its location and whether it touches email — UpCloud in the Netherlands, OVH Cloud in Germany, Postmastery in the Netherlands, with Aikido and Mistral in Europe having no email access — and the Article 28 data processing agreement applies automatically and is countersigned on request. Data export in a machine-readable format is documented, but we found no public information on documented deletion beyond a 30-day retrieval window after termination, which keeps it from the very top. 1 3 7 8 10 11
The Data Protection Officer
The contracting entity is Lettermint B.V. of Zwolle, registered in the Dutch trade register and governed by Netherlands law; all hosting, storage and processing sit in the EU on the vendor's own infrastructure and network, with no US cloud, CDN or proxy in the chain, and the subprocessor list names every provider with its role, location and whether it touches email — UpCloud and Postmastery in the Netherlands, OVH Cloud in Germany, all European, with backups at the German provider. An Article 28 GDPR data processing agreement applies automatically and is countersigned on request; what is not published in the captured pages is the scope of the ISO 27001 certificate and an explicit statement that the founders are European, which keeps this just short of fully evidenced end-to-end sovereignty. 8 11 3 2 10 1 7
The Agency Lead
Everything I would put in front of a German client's data protection officer is on the record: a Dutch contracting entity in Zwolle, EU-only processing and storage on their own network and infrastructure with encrypted backups in Germany, a published subprocessor list in which only UpCloud, OVH Cloud and Postmastery, all in the EU, handle email, an automatic and countersignable DPA under Dutch law, ISO 27001:2022 and founder ownership with no investors. Deletion of a recipient's data on request and the exact scope of the certification are not shown in that detail, which keeps it off the top mark. 11 3 8 10 1
The Skeptic
A Dutch contracting entity, EU-only processing on named infrastructure — UpCloud in the Netherlands, OVH in Germany for encrypted backups, Postmastery in the Netherlands for reputation — its own network AS213427 with the statement that no US cloud, CDN or proxy sits in the chain, a published DPA under Dutch law with thirty-day subprocessor notice, and ISO 27001 all appear on the vendor's own pages. The certification's scope is not detailed and independent confirmation of the entity and residency attributes was not captured, so I score what the vendor states rather than what a third party verifies. 1 3 7 8 10 11
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly message volume, the price per additional thousand messages, the free tier and its limits, what dedicated IPs, extra log retention, sub-accounts, SSO and support plans cost, minimum term, and whether unused volume carries over.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with volume or which features cost extra is unclear.
5 — Tiers are public with their monthly volume and price, but at least one commonly needed piece (overage rate, dedicated IP, longer log retention, SSO, support plan) is unpriced or "on request".
8 — Every tier priced publicly with its volume and overage rate per thousand messages, dedicated IPs and add-ons priced, log retention per tier stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given monthly volume, number of domains and sub-accounts and feature set, with every add-on, support and overage fee and the cancellation terms published.
The SaaS Developer
The free tier's 300-email monthly limit, euro pricing exclusive of VAT, SEPA transfer on every plan, upgrade, downgrade or cancel anytime terms, a one-time credit of 60 euros for students and startups, and a dedicated IP add-on for Pro above 300,000 emails a month are all public. But the captured pages show no euro price for any paid tier and describe exceeding the monthly limit only as additional emails for a small fee, so a buyer cannot compute a real annual cost from what was captured. 1 2 7 8
The Platform Engineer
The pricing page publishes the monthly volume limit per plan (300 emails on the free Developer plan), which features sit on which plan, billing in euros exclusive of VAT, a one-time sixty-euro credit for students and startups, SEPA transfer on every plan, and upgrade or cancel anytime. But we found no public information on the euro price of each paid tier, the fee charged for additional emails, or the price of a dedicated IP — so a buyer cannot compute a real annual cost from the public pages alone. 1 7 8
The Shop Operator
The free tier's 300 emails a month, the per-plan feature gates, the 28-day message history on every plan and billing in euros excluding VAT are public, with no credit card and cancellation at any time. But the captured pricing page gives no euro amounts for the paid tiers, describes the overage only as a small fee, and names the dedicated IP and bring-your-own IP as add-ons with no figures, so I cannot compute my annual cost for roughly 4,000 transactional mails a month from the public pages. 7 8
The Data Protection Officer
The free tier's three-hundred-email monthly limit, euro billing exclusive of VAT, upgrade-downgrade-cancel-anytime terms, SEPA transfer on every plan and a one-time sixty-euro credit for students and startups are public, and paid plans are shown with no monthly limit and one shared volume across email types. We found no public information on the per-tier prices or on the amounts of the overage fee and the dedicated-IP add-on, so a real annual cost cannot be computed from the captured pages. 7 8 1 2
The Agency Lead
The pricing page shows a free tier of three hundred emails a month, unlimited paid volume, euro billing exclusive of VAT, upgrade, downgrade or cancel anytime, SEPA transfer on every plan and a dedicated IP add-on above three hundred thousand emails a month on Pro. We found no public information on the per-tier euro prices themselves, the overage is described only as a small fee and the dedicated IP is unpriced, so I cannot compute a per-client annual cost for a maintenance contract from these pages. 7 8
The Skeptic
The free plan's monthly limit of 300 emails, euro billing exclusive of VAT, upgrade, downgrade or cancel anytime, SEPA transfer on every plan and a one-time 60-euro credit for students and startups are public. No price for any paid plan appears on the captured pages, the overage is described only as sending additional emails for "a small fee", and the dedicated IP add-on carries no figure, so a real annual cost cannot be computed from public pages alone. 1 7 8
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Lettermint
Is Lettermint European?
Yes. whats-best.ai classifies Lettermint as EU-Made.
Where does Lettermint store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Lettermint have a free plan?
Yes. Lettermint has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Lettermint?
As of 2 Nov 2026, the panel rates Bird Email API (formerly SparkPost) (3/5), Postmark (3/5) and Mailjet Email API (3/5) highest among the other 15 Transactional Email products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Bird Email API (formerly SparkPost) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Lettermint alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Hosting location, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 36 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 14 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 13 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (22)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage lettermint.co Checked 1 Nov 2026 Details →
- 2 Features page (transactional email) lettermint.co Checked 1 Nov 2026 Details →
- 3 Features page (European email infrastructure) lettermint.co Checked 1 Nov 2026 Details →
- 4 API documentation lettermint.co Checked 1 Nov 2026 Details →
- 5 Documentation (webhooks) lettermint.co Checked 1 Nov 2026 Details →
- 6 Integrations page lettermint.co Checked 1 Nov 2026 Details →
- 7 Pricing page lettermint.co Checked 1 Nov 2026 Details →
- 8 Terms of service (company details) lettermint.co Checked 1 Nov 2026 Details →
- 9 Privacy policy lettermint.co Checked 1 Nov 2026 Details →
- 10 Data processing agreement (dpa) lettermint.co Checked 1 Nov 2026 Details →
- 11 Subprocessor list lettermint.co Checked 1 Nov 2026 Details →
- 12 Security / trust page trust.lettermint.co Checked 1 Nov 2026 Details →
- 13 Sending API, SMTP & developer experience — found from sitemap lettermint.co Checked 1 Nov 2026 Details →
- 14 Sending API, SMTP & developer experience — found from sitemap lettermint.co Checked 1 Nov 2026 Details →
- 15 Deliverability & sender reputation — found from sitemap lettermint.co Checked 1 Nov 2026 Details →
- 16 Deliverability & sender reputation — found from sitemap lettermint.co Checked 1 Nov 2026 Details →
- 17 Message logs, events & webhooks — found from sitemap lettermint.co Checked 1 Nov 2026 Details →
- 18 Message logs, events & webhooks — found from sitemap lettermint.co Checked 1 Nov 2026 Details →
- 19 Message data, retention & security — found from sitemap lettermint.co Checked 1 Nov 2026 Details →
- 20 Message data, retention & security — found from sitemap lettermint.co Checked 1 Nov 2026 Details →
- 21 Reliability, accounts & support — found from sitemap lettermint.co Checked 1 Nov 2026 Details →
- 22 Reliability, accounts & support — found from sitemap lettermint.co Checked 1 Nov 2026 Details →