Transactional Email
Mailtrap Email API/SMTP
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Railsware Products Studio LLC · mailtrap.io
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Mailtrap Email API/SMTP at a glance
- Vendor
- Railsware Products Studio LLC
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Mailtrap Email API/SMTP 3/5, the mean of 6 judges. Mailtrap Email API/SMTP, from Railsware Products Studio LLC, a Delaware-incorporated company with a business address in Pasadena, California, is strongest at transactional-sending fundamentals: deliverability, observability, and data and security each scored 7. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Mailtrap Email API/SMTP, from Railsware Products Studio LLC, a Delaware-incorporated company with a business address in Pasadena, California, is strongest at transactional-sending fundamentals: deliverability, observability, and data and security each scored 7. Judges pointed to separated transactional and bulk streams with their own SMTP hosts and suppression lists, a mandatory three-week dedicated-IP warm-up published day by day, message logs showing the receiving server's full response, HMAC-SHA256-signed webhooks retried on a published schedule, and stated retention, encryption, two-factor authentication and a SOC 2 Type II report. The weakest areas are reliability and accounts, scored 4, where we found no public information on a status page, an uptime SLA or support response times, and sovereignty, scored 3 to 4, where no captured page names a hosting region or an EU hosting option and transfers rest on standard contractual clauses, the UK addendum and Data Privacy Framework compliance. The sending API scored 6 to 7; all other scores held single values. Pricing transparency scored 3, with a free plan for one user named but no tier prices on the captured pages.
Speaks for it
- Transactional and bulk mail run on separate streams with their own SMTP hosts, IP pools and per-stream suppression lists
- New dedicated IPs go through a mandatory three-week warm-up with a published day-by-day schedule and overflow to shared IPs
- Message logs are searchable by recipient, subject, status and category, showing the receiving server's full response and per-message event history
- Webhooks are signed with HMAC-SHA256, retried 40 times every five minutes and sent from fixed published IP ranges
- Email content and logs are kept no more than 30 days, with AES256 encryption at rest, enforced two-factor authentication and a published ISO 27001:2022 certification and SOC 2 Type II report
Held against it
- Reliability and accounts scored 4, with no public information found on a status page, an uptime SLA or support response times per plan
- Sovereignty scored 3 to 4, with the contracting entity a Delaware-incorporated LLC and no captured page naming a hosting region or an EU hosting option
- The privacy policy states emails flagged by abuse detection may undergo automated, AI-assisted content analysis
- We found no public information on the sending API's rate limits or idempotency keys
- The terms of service state you agree not to resell any portion of the service
Best for
- You send transactional mail such as password resets and order confirmations from an application, using a documented REST API or SMTP relay with official SDKs
- Your developers and QA team need a real test mode — the Email Sandbox captures staging traffic instead of delivering it
- You send marketing volume alongside transactional mail and want Gmail's 5,000-a-day bulk-sender rules handled automatically on a separate stream
- You investigate delivery problems hands-on and need per-message logs with the receiving server's full response, HTML source and spam analysis
Avoid if
- You need messages processed or stored in the EU — the contracting entity is a Delaware-incorporated LLC and we found no public information on a hosting region or an EU hosting option
- You plan to resell email sending within client contracts — the terms of service state you agree not to resell any portion of the service
- You require that message content never be machine-analyzed — the privacy policy states AI-assisted analysis may apply to emails flagged by abuse detection
- You are subject to HIPAA — the terms of service state Mailtrap will not be liable if the service does not meet those requirements
The scores
| Criterion | Panel median |
|---|---|
| Sending API, SMTP & developer experience | 3.5 of 5 |
| Deliverability & sender reputation | 3.5 of 5 |
| Message logs, events & webhooks | 3.5 of 5 |
| Message data, retention & security | 3.5 of 5 |
| Reliability, accounts & support | 2 of 5 |
| European sovereignty | 2 of 5 |
Sending API, SMTP & developer experience
Show reasoningHide reasoning
How this is scored
How an application sends mail: a REST API and an SMTP relay with their limits stated, official SDKs and drivers for named languages and frameworks (PHP and Laravel, Node, Python, Ruby and Rails, Java, Go, .NET), stored templates with variables and versions, batch sending, attachments, idempotency keys, scheduled sending, a test or sandbox mode that does not deliver, inbound email parsed into a webhook, and the quality of the API reference and guides.
0 — Not a sending service; an application cannot send email through it by API or SMTP.
3 — An API or SMTP credentials to send a message; SDKs, templates, limits and a test mode are basic or not described.
5 — A documented REST API and SMTP relay, official SDKs for several named languages, stored templates with variables, attachments and batch sending, rate limits stated, a sandbox or test mode, and quick-start guides for named frameworks.
8 — An API reference with every endpoint and error code, idempotency keys, scheduled sending, template versions and a template language documented, inbound email parsed to a webhook, an OpenAPI specification or official CLI, framework drivers maintained by the vendor, and a migration guide from named competitors.
10 — An API a team builds its product on: versioning and deprecation policy published, backward compatibility stated, full parity between API and SMTP features, local or staging test tooling that mirrors production, and every limit, timeout and retry behaviour documented.
The SaaS Developer
Official SDKs for Node.js, PHP, Python, Ruby,.NET and Java, a RESTful sending API with SMTP on four ports, published OpenAPI specs, a batch endpoint and templates with custom variables cover most of what my Laravel app needs, and the Email Sandbox for capturing staging traffic is exactly the test mode that never reaches a real inbox. We found no public information on idempotency keys, template versioning or a Laravel-specific driver, which keeps it a notch below the top level. 2 4 6 12 13
The Platform Engineer
Sending is documented properly: a REST API and an SMTP relay with separate hosts for transactional and bulk, official SDKs for six named languages, stored templates with custom variables, a batch send endpoint, published OpenAPI specs, and a sandbox product that captures staging mail instead of delivering it. Native Supabase and Vercel integrations round it out. We found no public information on idempotency keys, template versioning, or the sending API's rate limits, and those gaps are what hold this below the top of the range for a transactional pipeline. 2 4 6 12 13
The Shop Operator
The documented REST API and SMTP relay come with official SDKs for PHP, Node, Python, Ruby,.NET and Java, batch sending, templates with custom variables, OpenAPI specs, and a sandbox that captures staging mail without delivering it — the sandbox with its own testing API is genuinely strong for a shop like mine. I found no public information on idempotency keys, stated rate limits, scheduled transactional sending or migration guides, and we found no public information on a Shopware integration, though Supabase and Vercel guides exist. 2 4 6 12 13
The Data Protection Officer
A REST API and SMTP relay are documented with separate transactional and bulk endpoints and ports, official SDKs for six named languages, a batch endpoint, templates with custom variables, an OpenAPI specification, native Vercel and Supabase integrations, and the Email Sandbox as a true test mode. We found no public information on idempotency keys, stated API rate limits, template versioning or documented error codes. 2 4 6 12 13
The Agency Lead
The sending side is what my developers would want: a RESTful API and SMTP relay with hosts and ports published, official SDKs for Node.js, PHP, Python, Ruby,.NET and Java, templates, a batch endpoint, OpenAPI specs, and an Email Sandbox that captures staging traffic so test mail is never delivered, plus native Supabase and Vercel integrations. We found no public information on idempotency keys, template versioning, a documented error-code list or per-endpoint rate limits, which is what keeps it below the top level. 2 4 6 13 20
The Skeptic
The REST API and SMTP relay are properly documented — separate hosts and ports for transactional and bulk, official SDKs for six named languages, a batch-send endpoint, a templates endpoint with custom variables, OpenAPI specifications, and a sandbox mode that intercepts mail before it delivers, which is rarer and more useful than most vendors' test story. What holds it back: we found no published rate-limit figures, no public information on attachment handling, and none on idempotency keys, template versioning or a migration guide from named competitors. 2 3 6 13 20
Deliverability & sender reputation
Show reasoningHide reasoning
How this is scored
What the vendor does so the mail reaches the inbox: guided SPF, DKIM and DMARC set-up with a custom return path and tracking domain, shared IP pools and how senders on them are vetted and policed, dedicated IPs with automatic warm-up, transactional and bulk mail kept on separate streams or IP pools, bounces, complaints and unsubscribes turned into suppressions automatically, feedback loops with mailbox providers, blocklist and DMARC monitoring, compliance with the Gmail and Yahoo bulk-sender rules, and published delivery times or inbox placement with their method.
0 — No sender authentication and no bounce handling; mail goes out from shared addresses with no reputation management at all.
3 — SPF and DKIM can be set up and bounces are recorded; IP policy, stream separation and suppressions are basic or not described.
5 — Guided SPF, DKIM and DMARC set-up with a custom return path, shared IPs with a stated sender vetting policy, dedicated IPs available, automatic suppression of hard bounces and complaints, transactional and marketing mail separated by stream or IP pool, and deliverability guidance in the documentation.
8 — Dedicated IPs with automatic warm-up and pool management, a stated acceptable-use and vetting process for shared pools, feedback loops and blocklist monitoring, DMARC reports, BIMI or custom tracking domains, compliance with the Gmail and Yahoo sender requirements stated, delivery times published, and access to deliverability experts.
10 — Deliverability that can be verified: delivery time and bounce rates per mailbox provider published continuously with their method, inbox placement testing included, pool reputation shown to the customer, and a documented escalation path with mailbox providers.
The SaaS Developer
Domain verification with DKIM, SPF and DMARC, a mandatory three-week IP warm-up with a published day-by-day schedule and overflow to shared pools, separate transactional and bulk streams with dedicated bulk IPs and per-stream suppressions, plus integrations with 26 feedback loops show real deliverability engineering. We found no public information on shared-pool vetting, blocklist monitoring, DMARC reports or published delivery times, and only Gmail's bulk-sender requirements are addressed. 3 13 14 15
The Platform Engineer
Stream separation is real — separate SMTP hosts and IP pools for transactional versus bulk, with marketing mail required onto the bulk stream — and dedicated IPs go through a mandatory three-week automatic warm-up with a published day-by-day schedule and overflow to shared IPs. Feedback loops with 26 named providers, the Gmail bulk-sender requirements handled automatically, and a deliverability team reviewing Google Postmaster spam rates daily for paid customers put this well above the basics. We found no public information on published delivery times or inbox placement with a method, blocklist monitoring, or DMARC reports. 3 13 14 15
The Shop Operator
This is what I care about most: domain verification with DKIM, SPF and DMARC records, a mandatory three-week dedicated IP warm-up with a published day-by-day schedule and overflow to shared IPs, transactional and marketing mail forced onto separate streams with their own infrastructure and suppression lists, and twenty-six named feedback loops. The Bulk Stream handles Gmail's 5,000-a-day rules and the spam-rate limit automatically, and a Deliverability team reviews dedicated IP requests and can check Google Postmaster spam rates daily for paid customers. I found no public information on custom return-path or tracking domains, DMARC reports, blocklist monitoring, or published delivery times. 3 13 14 15
The Data Protection Officer
Domain verification covers DKIM, SPF and DMARC, transactional and bulk mail run on separate streams with dedicated IPs for bulk and per-stream suppression lists, and dedicated IPs get a documented mandatory three-week warm-up with a day-by-day schedule. Feedback loops with 26 named providers, a Gmail Feedback-ID header and stated compliance with the Gmail 5,000-messages-a-day sender rules are published; we found no public information on DMARC reports, BIMI, custom tracking domains or published delivery times. 3 13 14 15
The Agency Lead
Domain set-up covers DKIM, SPF and DMARC, transactional and bulk mail run on separate streams with dedicated IPs for bulk, and a new dedicated IP goes through a mandatory three-week warm-up documented day by day with overflow to shared IPs. Feedback loops with twenty-six named providers feed the stats and the Gmail bulk-sender rules are addressed with automatic unsubscribe and RFC 8058 headers; we found no public information on blocklist or DMARC monitoring, or on published delivery times. 3 13 14 15
The Skeptic
The dedicated-IP warm-up is documented to the day — mandatory three weeks, 300 emails on day one growing roughly 30 percent daily, overflow routed to shared IPs — and transactional and bulk mail are forced onto separate streams with separate SMTP hosts and per-stream suppression lists, plus feedback loops with 26 named providers and automatic List-Unsubscribe, RFC 8058 and Feedback-ID headers for Gmail. The high-deliverability claim is stated by design, not by measurement: we found no published delivery times or method, and no public information on DMARC reporting, blocklist monitoring, a custom return path, or how senders on shared pools are vetted and policed. 3 13 14 15
Message logs, events & webhooks
Show reasoningHide reasoning
How this is scored
What the team can see about each message once the application has handed it over: a message log searchable by recipient, subject, tag or message ID, the full event history (processed, delivered, deferred, bounced with the remote server's answer, opened, clicked, complained), how long logs and message content are kept, event webhooks with retries and a signature, an events API, dashboards and statistics per stream, tag or domain, alerts on bounce or complaint spikes, and access for a support team without developer rights.
0 — Nothing can be seen after sending; no logs, no events and no webhooks.
3 — Totals of sent and bounced messages; per-message logs, webhooks and retention are basic or not described.
5 — A searchable message log with per-message event history and the bounce reason, log retention stated, event webhooks for delivery, bounce, open, click and complaint, statistics per tag or domain, and an API to fetch events.
8 — Webhooks signed and retried with their schedule documented, the raw SMTP response and the rendered message viewable per send, log retention configurable or extended by plan, alerts on bounce, complaint or delivery-time thresholds, export or streaming of events to a named log or data tool, and read-only roles for support staff.
10 — Full traceability: every message traceable from API call to the receiving server's final answer, events streamed in real time with ordering and delivery guarantees stated, long retention with search across the whole history, and observability features documented with their limits.
The SaaS Developer
Log filtering by recipient, subject, status and category together with the full response from the mailbox provider server, per-message event history and Raw, HTML Source and Preview tabs would let me answer whether a user got the reset mail without opening a ticket, and webhooks are HMAC-SHA256 signed, retried forty times every five minutes and batched on a documented schedule. We found no public information on bounce-spike alerts, event export to external tools or read-only support roles, and log retention is plan-dependent, up to 30 days. 1 16 17
The Platform Engineer
The message log is what an on-call engineer needs: searchable by recipient, subject, category and the full response from the mailbox provider's server, with per-message event history, HTML source, raw view and spam analysis, retention stated at up to 30 days depending on plan. Webhooks are signed with HMAC-SHA256 and retried on a published schedule — 40 retries every five minutes, batches of up to 500 events every 30 seconds, a 30-second timeout, a test button and fixed sending IP ranges. We found no public information on alerting when bounces or complaints spike, on streaming events to an external log tool, or on read-only dashboard access for support staff. 1 5 16 17
The Shop Operator
Email Logs can be searched by recipient, subject, status, category and mailbox provider, with per-message event history, the full server response, HTML source, spam analysis and a preview, and the webhook documentation is unusually complete — HMAC-SHA256 signatures, forty retries every five minutes with a documented timeout and batch size, and delivery, bounce, open, click and complaint events. Log retention is stated as up to thirty days and varies by plan. I found no public information on alerts for bounce or complaint spikes, on exporting or streaming events to external tools, or on read-only access for support staff. 1 5 16 17
The Data Protection Officer
Email Logs are searchable by recipient, subject, category and status, showing event history, the rendered message, its HTML source and the full raw answer from the receiving server, with retention stated as up to 30 days and plan-dependent; webhooks cover nine event types, are signed with HMAC-SHA256, batched up to 500 events and retried forty times every five minutes. We found no public information on exporting events to an external log tool, read-only roles for support staff, or alerts tied to bounce or complaint levels. 1 5 16 17
The Agency Lead
Email Logs search by recipient, subject, category, status and the mailbox provider's full response, every message shows its event history with raw source, text and preview, and webhooks are signed with HMAC-SHA256, batched up to five hundred events, retried forty times on a five-minute schedule and testable from the interface. Retention is stated at up to thirty days and varies by billing plan; we found no public information on alerts for bounce or complaint spikes or on exporting events to an external log tool. 1 5 16 17
The Skeptic
Email Logs are searchable by recipient, subject, status, event, category and even the full raw response from the receiving mailbox provider, with per-message tabs for event history, HTML source, text, raw content and spam analysis — exactly the detail I want during an incident, and the retention answer is public: up to 30 days, varying with the billing plan. Webhooks are signed with HMAC-SHA256, retried 40 times at five-minute intervals with the schedule published, batched every 30 seconds, testable from the console and sent from fixed published IP ranges. We found no public information on an events API for fetching history, export or streaming to external tools, or alerts that fire when bounce or complaint rates spike. 1 5 16 17
Message data, retention & security
Show reasoningHide reasoning
How this is scored
What is stored about each message and what the customer controls: whether message bodies are stored or only metadata, retention periods and the setting to shorten them, deletion of a recipient's data on request, open and click tracking that can be switched off per stream or message, TLS for delivery with an option to require it, encryption at rest, API keys with scopes and per-domain restrictions, IP allow-listing, two-factor authentication and SSO for the dashboard, an audit log, a vulnerability disclosure programme, and security certifications or audits with their scope. Where the data is processed and by whom is scored under sovereignty.
0 — Stores every message indefinitely with no controls, and the vendor states it uses message content for its own purposes.
3 — A privacy policy and a statement that data is encrypted; what is stored, retention and access controls are basic or not described.
5 — What is stored per message documented, retention periods stated, open and click tracking switchable, TLS used for delivery, API keys with restricted permissions, two-factor authentication for the dashboard, and a data processing agreement offered.
8 — Message content retention configurable down to none or metadata only, enforced TLS per domain or message, encryption at rest stated, scoped API keys and IP allow-listing, SSO (SAML) and roles, an audit log, deletion of recipient data by API, and ISO 27001 or SOC 2 stated with its scope.
10 — Data minimisation that can be verified: every stored field and its retention listed, content never stored unless the customer opts in, customer-managed encryption keys or equivalent, independent audits published with their scope, and every security control the customer has listed with its effect.
The SaaS Developer
Retention is documented (sending email content and logs no more than 30 days, server logs 30 days), emails are encrypted with AES256 and KMS-managed secrets, 2FA is enforced for all users, SSO ships on Business and Enterprise, and both a SOC 2 Type II report with a stated audit period and ISO/IEC 27001:2022 certification are published. The audit log is enterprise-only, and the privacy policy states that flagged emails may undergo AI-assisted content analysis, which I would want bounded contractually. 9 10 11 18
The Platform Engineer
Retention periods are stated in days — sending content and email logs no more than 30 days, server and application logs no more than 30 days — encryption at rest is AES256 under managed keys, two-factor authentication is enforced for all users, SSO ships on Business and Enterprise, and ISO 27001:2022 plus a SOC 2 Type II report with its period and independent auditor are published, with written deletion certification in the DPA. The audit log and activity logs are enterprise-only, and AI content analysis is limited to mail flagged by abuse detection. We found no public information on scoped API keys, IP allow-listing, or making message-content retention configurable down to metadata only. 9 10 11 17 18
The Shop Operator
Retention is documented in days rather than vague promises — sending email content and logs up to thirty days, server logs up to thirty, deletion on request with a written deletion certificate, AES256 encryption at rest with key management in AWS and Google KMS, enforced two-factor authentication, SSO on Business and Enterprise plans, and both an ISO/IEC 27001:2022 certificate and a SOC 2 Type II report with its period and auditor stated. The audit log is limited to Enterprise customers, and one caveat matters to me: emails flagged by abuse detection may be analyzed with AI tools. I found no public information on enforced TLS per message, IP allow-listing for the API, or setting content retention down to none. 8 9 10 11 18
The Data Protection Officer
Message bodies and email logs are kept no more than 30 days, server logs the same, the DPA promises deletion or return within 30 days of a written request with a written destruction certificate, open and click tracking is optional, and the AI-assisted analysis of abuse-flagged email content is at least disclosed. AES-256 encryption at rest with managed keys, two-factor authentication enforced for all users, SSO on Business and Enterprise, ISO/IEC 27001:2022 and a SOC 2 Type II report with its audit period stated are published. We found no public information on shortening content retention to nothing, enforced TLS per domain, IP allow-listing, or deleting a recipient's data by API. 9 10 11 16 18
The Agency Lead
The captured pages state what is kept — email content and logs for up to thirty days, server and application logs for up to thirty days — encryption at rest with AES256, two-factor authentication enforced for all users, SSO on Business and Enterprise plans, an audit log on Enterprise, written deletion with a certificate on request, and ISO 27001:2022 plus a SOC 2 Type II report with its audit period published. We found no public information on IP allow-listing or an option to require TLS per domain. 9 10 11 18 20
The Skeptic
Retention is stated plainly — sending email content and logs up to 30 days, server and application logs up to 30 days, sandbox emails until the inbox is cleared — 2FA is enforced for all users, SSO ships on Business and Enterprise, an audit log exists for Enterprise, and ISO/IEC 27001:2022 plus a SOC 2 Type II with its audit period and independent auditor named are on the record. The wrinkle a buyer should see: Mailtrap states it may run automated, AI-assisted content analysis on emails flagged by its own abuse-detection systems. We found no public information on a vulnerability disclosure programme, enforced TLS per domain or message, API key scopes, or message content retention configurable down to zero. 9 10 11 18
Reliability, accounts & support
Show reasoningHide reasoning
How this is scored
Whether the platform can be relied on and run by a team: a public status page with incident history, uptime SLA and service credits published, redundancy or failover across data centres described, queueing and retry of mail during outages, sub-accounts or servers per application, client or tenant, team members with roles, separate environments, support channels and response times per plan, named migration help, and integrations with platforms that send mail on the customer's behalf (WordPress, Shopify, Shopware, Supabase, Vercel and similar).
0 — No status page, no support channel and no way to separate users or applications.
3 — A support contact and a single account; status page, SLA, sub-accounts and roles are basic or not described.
5 — A public status page with incident history, an uptime SLA on at least one plan, sub-accounts or separate servers per application, team members with roles, support by email or chat with stated hours, and plugins or guides for several named platforms.
8 — An SLA with service credits published, redundancy across data centres or regions described, mail queued and retried during incidents, sub-accounts with their own keys, domains and limits manageable by API, granular roles, support response times per plan, and migration assistance offered.
10 — Reliability that can be verified: uptime history published for years, post-mortems for incidents, multi-region failover documented, an SLA covering delivery latency as well as API availability, and white-label or reseller tooling for agencies and platforms.
The SaaS Developer
24/7 expert support is claimed with a support address, user management covers project-level permissions per user, and native integrations exist for Supabase, Vercel and Salesforce. We found no public information on a status page, an uptime SLA, redundancy across data centres, or queueing of mail during outages, which is thin for a service I would route password resets through. 2 8 11 20 21
The Platform Engineer
Environments separate cleanly — sandboxes grouped into projects with project-level user permissions, and the Vercel integration wires separate development, preview and production settings — with 24/7 support stated, an email support channel, and native Supabase, Vercel and Salesforce integrations. We found no public information on a public status page with incident history, an uptime SLA with service credits, or mail being queued and retried during an incident, and those are the first pages I would read before signing anything. 1 2 4 11 20 21
The Shop Operator
I need to trust the pipe: 24/7 expert support is claimed with a support email, team members can be given project-level permissions, separate sandbox and production environments exist, and there are native integrations and guides for Supabase, Vercel and Salesforce. But I found no public information on a status page, an uptime SLA, support response times per plan, or queueing of mail during outages — and no Shopware integration appears among the named platforms, which for my shop would mean custom work on the PHP side. 1 2 8 11 20 21
The Data Protection Officer
Support is offered around the clock by email with an API reference and troubleshooting guides, user management covers project-level permissions, and native integrations exist for Vercel, Supabase and Salesforce. We found no public information on a public status page with incident history, an uptime SLA or service credits, sub-accounts with their own keys and domains, or migration assistance. 2 4 8 11 20
The Agency Lead
This is the weak point for an agency with thirty clients: user management is per project with permissions per user and API tokens can be generated per sending domain, but we found no public information on sub-accounts with their own keys, domains and limits, on a public status page, on an uptime SLA or on support response times per plan. Support is described as 24/7 expert support with native integrations for Supabase and Vercel and separate testing sandboxes per environment; note that the terms of service state a customer agrees not to resell any portion of the service, which matters when writing mail into a maintenance contract. 1 8 11 20 21
The Skeptic
Support is claimed around the clock with a published contact address, permissions are managed per project, and the environment story is real — the Vercel integration wires Development, Preview and Production to either the sandbox or live sending, and native Supabase and Salesforce integrations are documented. But we found no public information on a status page with incident history, an uptime SLA or service credits, redundancy across data centres, or what happens to queued mail during an outage — the first things I check when a sender goes quiet — and support response times per plan are not stated. 2 8 11 20
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where messages, logs and recipient data are processed and stored, whether an EU region can be chosen and what it covers, and who the subprocessors are (cloud hosting, sending infrastructure, logging, support and payment tools). Independently sourced by the sovereignty pipeline; every message carries personal data, so the whole sending chain counts, not only the dashboard.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — An EU region available and an EU contracting entity or EU representative, but parts of the chain (sending infrastructure, logs, support, payment) run through non-EU providers without a stated safeguard, or the EU region does not cover logs and account data.
8 — EU processing of messages, logs and account data on named infrastructure, an EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, sending infrastructure and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The SaaS Developer
Railsware Products Studio LLC is a Delaware-incorporated entity with a Pasadena address, hosting runs on AWS and Google with no region stated, and we found no public information on an EU hosting option for messages or logs. A published data processing agreement with EU Standard Contractual Clauses, Data Privacy Framework certification and a subprocessor list with a 72-hour objection window offer transfer safeguards, but nothing in the captured pages evidences European processing. 8 9 10
The Platform Engineer
The contracting entity is Railsware Products Studio LLC, incorporated in Delaware with a business address in Pasadena, California, and no captured page names a hosting location or server region — AWS and Google appear as infrastructure in the security documentation without regions. European transfers rest on standard contractual clauses, the UK addendum and Data Privacy Framework compliance, with a published DPA and a subprocessor list linked with a 72-hour objection window. We found no public information on an EU hosting option or EU-region processing of messages and logs, which keeps this at the low end for a European buyer. 9 10 11
The Shop Operator
As a German-Austrian shop I have to weigh this carefully: the contracting entity is Railsware Products Studio LLC, incorporated in Delaware with a Pasadena address, hosting runs on AWS and Google with no region named, and we found no public information on an EU region or an EU entity. The safeguards are real but transatlantic — a published data processing agreement with EU Standard Contractual Clauses, Data Privacy Framework compliance, and a sub-processor list published at a link, though the captured pages do not show where each sub-processor runs. 9 10 11
The Data Protection Officer
The contracting entity is Railsware Products Studio LLC, incorporated in Delaware with a business address in Pasadena, California; hosting is named as AWS and Google without any stated location, and we found no public information on an EU region for mail, logs or account data. Transfers from the EEA and UK are safeguarded by the EU-U.S. Data Privacy Framework and standard contractual clauses incorporated in the DPA, and a sub-processor list is linked with a 72-hour objection right, but beyond AWS and Google as hosting we found no public information on the sub-processors' identities or locations. 8 9 10
The Agency Lead
The contracting entity is Railsware Products Studio LLC, incorporated in Delaware with a business address in Pasadena, California; a data processing agreement is published with EU standard contractual clauses and Data Privacy Framework certification, a subprocessor list is linked, and hosting runs on AWS and Google. We found no public information naming an actual hosting region or an EU hosting option, so for our German clients this is a US vendor with contractual safeguards rather than EU processing. 9 10 11
The Skeptic
Railsware Products Studio LLC is a Delaware entity with a Pasadena business address, subject to US export controls, and it covers UK and EEA transfers with Standard Contractual Clauses and Data Privacy Framework participation under FTC enforcement. Hosting is on AWS and Google with certifications listed, but no captured page names a region, no EU hosting option is offered, and the sub-processor list is published online yet its names and locations are not in the captured pages. For a European buyer this is an American chain with contractual safeguards, not European processing. 9 10
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly message volume, the price per additional thousand messages, the free tier and its limits, what dedicated IPs, extra log retention, sub-accounts, SSO and support plans cost, minimum term, and whether unused volume carries over.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with volume or which features cost extra is unclear.
5 — Tiers are public with their monthly volume and price, but at least one commonly needed piece (overage rate, dedicated IP, longer log retention, SSO, support plan) is unpriced or "on request".
8 — Every tier priced publicly with its volume and overage rate per thousand messages, dedicated IPs and add-ons priced, log retention per tier stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given monthly volume, number of domains and sub-accounts and feature set, with every add-on, support and overage fee and the cancellation terms published.
The SaaS Developer
The captured terms show a free tier limited to one user, USD pricing with taxes excluded, and add-ons for a dedicated IP, SSO and a Salesforce sandbox named without prices, plus a 30-day refund that lapses once usage exceeds 30 percent of the plan. We found no tier prices, volume limits or per-thousand overage rates in the captured pages, so I cannot compute an annual cost for our volume from public material. 7 8
The Platform Engineer
A free plan exists for one user, and add-ons are named — dedicated IP, SSO and the Email Sandbox for Salesforce — but their prices are not stated, subscription fees are exclusive of taxes, and no refund is given once usage exceeds 30% of the paid plan scope. We found no public information on tier prices by monthly volume, per-thousand overage rates, or the cost of a dedicated IP or longer log retention, so a real annual cost cannot be computed from public pages. 7 8
The Shop Operator
From the captured pages I cannot compute my annual cost for 900 orders a week: a free plan for one user exists, prices are in US dollars and exclusive of taxes, dedicated IP, SSO and the Salesforce sandbox integration are sold as flat-fee add-ons, and a 30-day refund window lapses once usage passes 30 percent of the plan. No tier prices, monthly volumes, overage rates or add-on prices appear on the captured pages, though log retention is said to depend on the billing plan. 8 11 16
The Data Protection Officer
A free plan for a single user exists, add-ons for a dedicated IP, SSO and the Email Sandbox for Salesforce are named as flat fees, and the terms state prices in US dollars exclusive of taxes, billing on the first business day of the period, a 30-day refund refused if usage volume exceeds 30% of the paid plan scope, and no refunds on add-ons. We found no public information on tier prices with their monthly volumes, per-thousand overage rates, or what the dedicated IP, SSO or longer log retention cost. 7 8
The Agency Lead
We found a free plan limited to one user and named paid add-ons — dedicated IP, SSO and the Email Sandbox for Salesforce — with billing in US dollars exclusive of taxes and a thirty-day refund that does not apply to add-ons, but the captured pages give no tier prices by message volume, no overage rate per thousand messages and no prices for the add-ons. As it stands I cannot compute an annual cost per client from the public pages, which is what I would need for a maintenance contract. 7 8
The Skeptic
A free plan limited to one user exists, prices are in US dollars excluding taxes, and refunds run 30 days from first purchase only — not on renewals, denied once usage exceeds 30 percent of the plan, and excluded for add-ons — with prices changeable without prior notice. The captured pages give no figures for tier prices, volumes per tier, an overage rate per thousand messages, or the cost of the dedicated IP, SSO and Salesforce add-ons, so a real annual cost cannot be computed from public information. 8
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Mailtrap Email API/SMTP
Is Mailtrap Email API/SMTP European?
No. whats-best.ai classifies Mailtrap Email API/SMTP as Rest of world.
Where does Mailtrap Email API/SMTP store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Mailtrap Email API/SMTP have a free plan?
Yes. Mailtrap Email API/SMTP has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Mailtrap Email API/SMTP?
As of 2 Nov 2026, the panel rates Lettermint (3.5/5), Bird Email API (formerly SparkPost) (3/5) and Postmark (3/5) highest among the other 15 Transactional Email products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Lettermint (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Mailtrap Email API/SMTP alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Legal entity. Not confirmed on the vendor’s own pages as captured.
- Weak sourcing — Hosting location. No page names an actual hosting location or server region and no EU hosting option is offered, so the US default is read from the DPA transfer clause rather than an explicit statement about where data is stored.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 7 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (22)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage mailtrap.io Checked 1 Nov 2026 Details →
- 2 Features page (email API) mailtrap.io Checked 1 Nov 2026 Details →
- 3 Features page (email sending) mailtrap.io Checked 1 Nov 2026 Details →
- 4 Features page (email sandbox) mailtrap.io Checked 1 Nov 2026 Details →
- 5 Features page (analytics) mailtrap.io Checked 1 Nov 2026 Details →
- 6 API documentation (transactional sending) docs.mailtrap.io Checked 1 Nov 2026 Details →
- 7 Pricing page mailtrap.io Checked 1 Nov 2026 Details →
- 8 Terms of service mailtrap.io Checked 1 Nov 2026 Details →
- 9 Privacy policy mailtrap.io Checked 1 Nov 2026 Details →
- 10 Data processing agreement (dpa) mailtrap.io Checked 1 Nov 2026 Details →
- 11 Security / trust page mailtrap.io Checked 1 Nov 2026 Details →
- 12 Sending API, SMTP & developer experience — found from sitemap docs.mailtrap.io Checked 1 Nov 2026 Details →
- 13 Sending API, SMTP & developer experience — found from sitemap docs.mailtrap.io Checked 1 Nov 2026 Details →
- 14 Deliverability & sender reputation — found from sitemap docs.mailtrap.io Checked 1 Nov 2026 Details →
- 15 Deliverability & sender reputation — found from sitemap docs.mailtrap.io Checked 1 Nov 2026 Details →
- 16 Message logs, events & webhooks — found from sitemap docs.mailtrap.io Checked 1 Nov 2026 Details →
- 17 Message logs, events & webhooks — found from sitemap docs.mailtrap.io Checked 1 Nov 2026 Details →
- 18 Message data, retention & security — found from sitemap docs.mailtrap.io Checked 1 Nov 2026 Details →
- 19 Message data, retention & security — found from sitemap docs.mailtrap.io Checked 1 Nov 2026 Details →
- 20 Reliability, accounts & support — found from sitemap docs.mailtrap.io Checked 1 Nov 2026 Details →
- 21 Reliability, accounts & support — found from sitemap docs.mailtrap.io Checked 1 Nov 2026 Details →
- 22 Code repository (open-source licence) — found from the homepage github.com Checked 1 Nov 2026 Details →