Transactional Email
Postmark
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by AC PM, LLC · postmarkapp.com
Compare with Lettermint → Compare with Mailgun → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Postmark at a glance
- Vendor
- AC PM, LLC
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Postmark 3/5, the mean of 6 judges. Postmark, the transactional email service of AC PM, LLC, an ActiveCampaign company, earns its best marks on the sending API and pricing transparency, both a flat 7, and on deliverability at 7 to 8, resting on manual vetting of every new sender, free custom Return-Path and DKIM, and separate infrastructure for transactional and broadcast traffic including IP ranges. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 2 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Postmark, the transactional email service of AC PM, LLC, an ActiveCampaign company, earns its best marks on the sending API and pricing transparency, both a flat 7, and on deliverability at 7 to 8, resting on manual vetting of every new sender, free custom Return-Path and DKIM, and separate infrastructure for transactional and broadcast traffic including IP ranges. Its weak point is sovereignty, a flat 4: contracting is under Illinois law, personal information is stored in AWS and Deft data centres in the United States, and transfers out of the EEA are contemplated through the Data Privacy Framework and Standard Contractual Clauses, with no EU hosting region found on the captured pages. Data and security is a flat 6, held down by a licence in the terms to internally use messaging content for training and by opportunistic outbound TLS with an unencrypted fallback. The bench splits narrowly on observability and reliability and accounts, both 6 to 7, where strong webhooks and redundancy are weighed against missing spike alerts, export, SLA and response-time information; no material disagreement was computed.
Speaks for it
- Documented REST API and SMTP relay with vendor-maintained official libraries for TypeScript, Node, Python, Ruby, Rails, PHP,.NET and Java, batch sending up to 500 messages, and a test token that does not deliver
- Deliverability scored 7 to 8 on manual vetting of every new sender, free custom Return-Path and DKIM domains, separate IP ranges for transactional and broadcast traffic, and dedicated IPs with managed warm-up from 300,000 messages a month
- All four plans are public with their overage rates — free at $0.00/mo with 100 emails, Basic $15.00/mo, Pro $16.50/mo, Platform $18.00/mo — with add-ons priced openly and a 90-day refund on unused first-purchase credits
- Seven webhook event types with a documented six-attempt retry schedule, health tracked per event type with pausing of only the failing event, and 45 days of full content history customisable from 7 to 365 days
- Free trial with no credit card required, premium support at no extra charge, and migration guides from six named competitors
Held against it
- Sovereignty scores a flat 4: AC PM, LLC contracts under Illinois law, personal information is stored in AWS and Deft data centres in the United States, transfers out of the EEA are contemplated via the Data Privacy Framework and SCCs, and the judges found no public information on an EU hosting region
- The terms grant a licence to view, copy and internally use messaging content to train and improve the service
- Outbound TLS is opportunistic, falls back to unencrypted delivery, and the customer cannot control or require it
- No public information was found on an uptime SLA, service credits, SSO or an audit log, and the terms provide the service as is, cap liability at three months of fees, and reserve termination of any account at any time without notice
Best for
- You are a development team wiring transactional email into an application and want a documented REST API and SMTP relay with vendor-maintained libraries, framework guides and migration paths from six named competitors
- You send transactional mail at small or mid-size volume and want managed deliverability — manual sender vetting, free custom Return-Path and DKIM, and vendor-monitored shared IP pools
- You run an agency or platform and need per-client separation — servers with their own tokens (up to 10 on the free and Pro plans, unlimited on Platform) plus a per-server observer role for read-only client access
- You want predictable public pricing — a free Developer plan with 100 emails a month, paid tiers from $15.00/mo with stated per-thousand overage rates, and premium support at no extra charge
Avoid if
- Your compliance regime requires message content and logs to stay in EU processing — ask the vendor: the public pages we read do not show it
- You cannot accept a licence for the vendor to view, copy and internally use messaging content to train and improve the service
- You must guarantee encrypted delivery on every outbound hop — outbound TLS is opportunistic, falls back to unencrypted, and the customer cannot control or require it
- You need contractually backed reliability — the service is provided "as is", liability is capped at three months of fees, and the terms reserve termination of any account at any time without notice
The scores
| Criterion | Panel median |
|---|---|
| Sending API, SMTP & developer experience | 3.5 of 5 |
| Deliverability & sender reputation | 4 of 5 |
| Message logs, events & webhooks | 3.5 of 5 |
| Message data, retention & security | 3 of 5 |
| Reliability, accounts & support | 3 of 5 |
| European sovereignty | 2 of 5 |
| Pricing transparency | 3.5 of 5 |
Sending API, SMTP & developer experience
Show reasoningHide reasoning
How this is scored
How an application sends mail: a REST API and an SMTP relay with their limits stated, official SDKs and drivers for named languages and frameworks (PHP and Laravel, Node, Python, Ruby and Rails, Java, Go, .NET), stored templates with variables and versions, batch sending, attachments, idempotency keys, scheduled sending, a test or sandbox mode that does not deliver, inbound email parsed into a webhook, and the quality of the API reference and guides.
0 — Not a sending service; an application cannot send email through it by API or SMTP.
3 — An API or SMTP credentials to send a message; SDKs, templates, limits and a test mode are basic or not described.
5 — A documented REST API and SMTP relay, official SDKs for several named languages, stored templates with variables, attachments and batch sending, rate limits stated, a sandbox or test mode, and quick-start guides for named frameworks.
8 — An API reference with every endpoint and error code, idempotency keys, scheduled sending, template versions and a template language documented, inbound email parsed to a webhook, an OpenAPI specification or official CLI, framework drivers maintained by the vendor, and a migration guide from named competitors.
10 — An API a team builds its product on: versioning and deprecation policy published, backward compatibility stated, full parity between API and SMTP features, local or staging test tooling that mirrors production, and every limit, timeout and retry behaviour documented.
The SaaS Developer
A REST endpoint and an SMTP relay with the host, port and credentials documented, official libraries for PHP, Node, Python, Ruby,.NET and Java maintained by Postmark's own developers, quick-starts for Laravel, Rails, Express and Django, stored templates with a templates API, attachments, batch sending up to 500 messages and 50 MB, a sandbox test token, inbound mail parsed into JSON and posted to a webhook, an official CLI, and migration guides from SendGrid, Mailgun, SES, SparkPost and others — that covers almost everything my application needs. We found no public information on idempotency keys or scheduled sending, which keeps it below the top level. 1 3 6 13 14 22
The Platform Engineer
A REST API and an SMTP relay are both fully documented — host, port, token headers — with vendor-maintained libraries for TypeScript, Node, Python, Ruby, Rails, PHP,.NET and Java, framework guides for Laravel, Rails, Express, Django and Craft, templates with an API and template push, batch sending up to 500 messages with documented partial-failure semantics, a test-token mode, stated limits (10 MB per email, 50 recipients) and error codes in body and header, inbound email parsed to a webhook, an official CLI, and migration guides from six named competitors. We found no public information on idempotency keys, scheduled sending, template versioning, or a published API versioning and deprecation policy. 1 3 6 13 14 22
The Shop Operator
The captured pages document a REST API and an SMTP relay with named host and port, official libraries for TypeScript, Node, Python, Ruby, Rails, PHP,.NET and Java maintained by the vendor, framework guides for Laravel, Rails, Express, Django and Craft CMS, a WordPress plugin that overrides wp mail, batch sending up to 500 messages per call, a test-token mode that does not deliver, inbound email parsed to a webhook, a documented CLI and migration guides from SendGrid, Mailgun and others. For my Shopware shop this means sending via SMTP or REST is well covered. We found no public information on idempotency keys or scheduled sending, which is what keeps this just below the top anchors. 1 3 6 13 14 22
The Data Protection Officer
A fully documented REST API with endpoints and error codes, an SMTP relay on token authentication, vendor-maintained official libraries for eight named languages plus community libraries, batch sending capped at 500 messages and 50 MB, a test token and sandbox mode, inbound email parsed to a webhook, an official CLI, and migration guides from six named competitors. We found no public information on idempotency keys, scheduled sending, template versioning or an OpenAPI specification, which is what keeps it short of the top level. 1 3 6 13 14 22
The Agency Lead
The REST API and SMTP relay are documented down to error codes, rate limits, batch limits of 500 messages per call and a test-mode token, with inbound email parsed to a webhook and an official CLI for email, servers and templates. Official libraries for TypeScript, Node, Python, Ruby, Rails, PHP,.NET and Java are maintained in-house, with framework guides for Laravel, Rails, Express, Django and Craft CMS and migration guides from SendGrid, Mailgun, Amazon SES, SparkPost, Mailchimp Transactional and Resend. We found no public information on idempotency keys, scheduled sending or template versioning, which is what keeps this a notch below the top band. 1 3 6 13 14 22
The Skeptic
A documented REST API and SMTP relay, official libraries for TypeScript, Node, Python, Ruby, Rails, PHP,.NET and Java maintained by Postmark's own developers, a CLI, batch sending with limits stated (500 messages, 50 MB), a test token value that does not deliver, inbound email parsed to JSON and posted to a webhook, and migration guides from SendGrid, Mailgun, Amazon SES, SparkPost, Mailchimp Transactional and Resend. We found no public information on idempotency keys, scheduled sending, template versions or a documented template language, or an OpenAPI specification. Strong, quotable developer tooling — the gaps I just named are what keep it below the top band. 1 3 6 7 13 14 22
Deliverability & sender reputation
Show reasoningHide reasoning
How this is scored
What the vendor does so the mail reaches the inbox: guided SPF, DKIM and DMARC set-up with a custom return path and tracking domain, shared IP pools and how senders on them are vetted and policed, dedicated IPs with automatic warm-up, transactional and bulk mail kept on separate streams or IP pools, bounces, complaints and unsubscribes turned into suppressions automatically, feedback loops with mailbox providers, blocklist and DMARC monitoring, compliance with the Gmail and Yahoo bulk-sender rules, and published delivery times or inbox placement with their method.
0 — No sender authentication and no bounce handling; mail goes out from shared addresses with no reputation management at all.
3 — SPF and DKIM can be set up and bounces are recorded; IP policy, stream separation and suppressions are basic or not described.
5 — Guided SPF, DKIM and DMARC set-up with a custom return path, shared IPs with a stated sender vetting policy, dedicated IPs available, automatic suppression of hard bounces and complaints, transactional and marketing mail separated by stream or IP pool, and deliverability guidance in the documentation.
8 — Dedicated IPs with automatic warm-up and pool management, a stated acceptable-use and vetting process for shared pools, feedback loops and blocklist monitoring, DMARC reports, BIMI or custom tracking domains, compliance with the Gmail and Yahoo sender requirements stated, delivery times published, and access to deliverability experts.
10 — Deliverability that can be verified: delivery time and bounce rates per mailbox provider published continuously with their method, inbox placement testing included, pool reputation shown to the customer, and a documented escalation path with mailbox providers.
The SaaS Developer
Dedicated IPs with Postmark-managed warm-up (300,000 messages a month to qualify, overflow routed to the shared pool), manual vetting of every new sender with bounce and complaint limits spelled out in the terms, feedback loops and blocklist monitoring handled for you, DMARC digests, custom return-path and DKIM domains at no charge, separate IP ranges so transactional and broadcast traffic never mix, and delivery times published per major inbox provider. We found no public information on a stated compliance position for the Gmail and Yahoo bulk-sender rules or inbox placement testing. 2 4 5 8 15
The Platform Engineer
Every sender is manually vetted, SPF/DKIM/DMARC are guided with a free custom Return-Path and DKIM domain, transactional and broadcast traffic ride completely separate infrastructure including IP ranges, and dedicated IPs come with Postmark-managed warm-up plus automatic overflow to the shared pool; feedback loops, reverse DNS and blocklist monitoring with resolution attempts are handled by the vendor, DMARC digests exist as a paid add-on, and delivery times per mailbox provider are published on the Time to Inbox and status pages over a 30-60 day window. We found no public information on BIMI or custom tracking domains, a stated position on the Gmail and Yahoo bulk-sender requirements, inbox placement testing, or access to deliverability experts. 1 2 4 5 7 15
The Shop Operator
This is what my spam-foldered invoices need: the pages describe SPF, DKIM and DMARC made easy to set up with a free custom Return-Path and DKIM domain, every sender manually vetted one-on-one, transactional and broadcast mail on completely separate infrastructure including IP ranges, and dedicated IPs with Postmark-managed warm-up, blocklist monitoring and feedback loops handled for you. Delivery times are published on a Time to Inbox page and the status page shows real-time delivery metrics. We found no public information on custom tracking domains or an explicit statement of compliance with the Gmail and Yahoo bulk-sender requirements, so I stop one step short of the top. 1 4 5 7 12 15
The Data Protection Officer
SPF, DKIM and DMARC set-up with a free custom return path, every new sender manually vetted before sending, transactional and broadcast traffic kept on completely separate infrastructures including IP ranges, dedicated IPs from 300,000 messages a month with managed warm-up and overflow to the shared pool, feedback loops and blacklist monitoring handled by the vendor, automatic suppression, and delivery times published per mailbox provider on a public Time to Inbox page. We found no public information on a stated compliance position for the Gmail and Yahoo bulk-sender rules, or on BIMI or custom tracking domains. 1 4 5 7 15
The Agency Lead
Custom Return-Path and DKIM domains are free, transactional and broadcast traffic sit on separate sending infrastructure including IP ranges, and dedicated IPs come with Postmark-managed warm-up, blocklist monitoring, feedback loop registrations and reverse DNS handled by the vendor. Every new sender is manually vetted, purchased lists are prohibited, and bounce and complaint ceilings of 10% and 0.1% police the shared pools, while delivery times for Gmail, Apple, Hotmail, AOL and Yahoo are published on the Time to Inbox page and the status page. We found no public information on BIMI, custom tracking domains, inbox placement testing or a stated position on the Gmail and Yahoo bulk-sender requirements. 2 4 5 7 8 15
The Skeptic
Guided SPF, DKIM and DMARC with a free custom return-path, every new sender manually vetted with pre-send anti-abuse blocking, transactional and broadcast traffic kept apart including IP ranges, dedicated IPs from 300,000 messages a month with Postmark-managed warm-up in three to six weeks, blacklist monitoring and feedback loops handled by them, and delivery times published on a Time to Inbox page for the major providers. We found no public information on compliance with the Gmail and Yahoo bulk-sender rules, custom tracking domains or BIMI, or inbox placement testing, and the published metrics cover delivery times only — no bounce rates per provider and no method beyond a 30–60 day window. 1 4 5 7 12 15
Message logs, events & webhooks
Show reasoningHide reasoning
How this is scored
What the team can see about each message once the application has handed it over: a message log searchable by recipient, subject, tag or message ID, the full event history (processed, delivered, deferred, bounced with the remote server's answer, opened, clicked, complained), how long logs and message content are kept, event webhooks with retries and a signature, an events API, dashboards and statistics per stream, tag or domain, alerts on bounce or complaint spikes, and access for a support team without developer rights.
0 — Nothing can be seen after sending; no logs, no events and no webhooks.
3 — Totals of sent and bounced messages; per-message logs, webhooks and retention are basic or not described.
5 — A searchable message log with per-message event history and the bounce reason, log retention stated, event webhooks for delivery, bounce, open, click and complaint, statistics per tag or domain, and an API to fetch events.
8 — Webhooks signed and retried with their schedule documented, the raw SMTP response and the rendered message viewable per send, log retention configurable or extended by plan, alerts on bounce, complaint or delivery-time thresholds, export or streaming of events to a named log or data tool, and read-only roles for support staff.
10 — Full traceability: every message traceable from API call to the receiving server's final answer, events streamed in real time with ordering and delivery guarantees stated, long retention with search across the whole history, and observability features documented with their limits.
The SaaS Developer
Message activity logs with 45 days of full content history customisable from 7 to 365 days, open and delivery tracking per email, statistics per tag, an observer role that can read message history without editing, and webhooks for every event type with a documented retry schedule, stable trace IDs, per-event-type health checks and a webhook statistics API. The vendor states plainly that webhooks are not HMAC-signed and recommends HTTP Basic Authentication and IP allow-listing instead — the one thing I specifically wanted for signed bounce handling. We found no public information on alerts for bounce or complaint spikes or on exporting events to an external log tool. 2 12 13 17 18 22
The Platform Engineer
Message activity logs keep 45 days of full content by default (customizable 7 to 365), webhooks cover delivery, bounce, spam complaint, open, click, subscription change and inbound with a retry schedule spelled out attempt by attempt, per-event-type health tracking, a retries-remaining and a stable trace header, automatic pause after persistent failure, and a statistics endpoint with retry counts and response times; tags carry statistics, and a teammate or observer can view logs without edit rights. 6 7 13 17 18 21
The Shop Operator
Webhooks cover delivery, bounce, complaint, open, click and inbound with a fully documented retry schedule, retry-remaining and trace headers, per-event-type health tracking and even a webhook statistics API, while full message content is kept 45 days by default, adjustable from 7 to 365, and an observer role can review history without edit rights. That is exactly what I want when a support colleague has to check why an invoice bounced. The captured pages state plainly that HMAC webhook signatures are not supported, and we found no public information on bounce or complaint spike alerts or on exporting events to an external log tool. 2 7 12 17 18 21
The Data Protection Officer
Message activity and logs viewable by role, 45 days of full content history stated with a customisable seven-to-365-day range, seven webhook event types with a documented six-attempt retry schedule, health tracked per event type with pausing on persistent failure, and a webhook statistics endpoint plus statistics by tag. From my chair the notable gap is integrity, not visibility: the captured pages state webhooks are not signed with HMAC, and we found no public information on alerts for bounce or complaint spikes or on exporting events to a log tool. 2 7 17 18 21
The Agency Lead
Message content is retained 45 days by default and configurable from 7 to 365 days, statistics break down per tag, and event webhooks cover delivery, bounce, open, click, complaint, subscription change and inbound on a documented six-attempt retry schedule with trace and retries-remaining headers plus per-webhook statistics endpoints. A per-server observer role can review message history without editing anything, which is exactly the client self-service view I need. The vendor states plainly that webhooks carry no HMAC signature — HTTP Basic Auth and IP allowlisting are recommended instead — and we found no public information on alerts for bounce or complaint spikes or on exporting or streaming events to an external log tool. 2 7 12 17 18 21
The Skeptic
Seven webhook types including inbound, retried on a documented schedule (six attempts at 1, 5, 10, 10, 10 and 15 minutes) with a retries-remaining header and a stable trace header, per-event-type health checks that pause a failing event rather than the whole webhook, a webhook statistics endpoint, and forty-five days of full content history customisable from 7 to 365 days with statistics kept indefinitely. 2 7 13 17 18 21
Message data, retention & security
Show reasoningHide reasoning
How this is scored
What is stored about each message and what the customer controls: whether message bodies are stored or only metadata, retention periods and the setting to shorten them, deletion of a recipient's data on request, open and click tracking that can be switched off per stream or message, TLS for delivery with an option to require it, encryption at rest, API keys with scopes and per-domain restrictions, IP allow-listing, two-factor authentication and SSO for the dashboard, an audit log, a vulnerability disclosure programme, and security certifications or audits with their scope. Where the data is processed and by whom is scored under sovereignty.
0 — Stores every message indefinitely with no controls, and the vendor states it uses message content for its own purposes.
3 — A privacy policy and a statement that data is encrypted; what is stored, retention and access controls are basic or not described.
5 — What is stored per message documented, retention periods stated, open and click tracking switchable, TLS used for delivery, API keys with restricted permissions, two-factor authentication for the dashboard, and a data processing agreement offered.
8 — Message content retention configurable down to none or metadata only, enforced TLS per domain or message, encryption at rest stated, scoped API keys and IP allow-listing, SSO (SAML) and roles, an audit log, deletion of recipient data by API, and ISO 27001 or SOC 2 stated with its scope.
10 — Data minimisation that can be verified: every stored field and its retention listed, content never stored unless the customer opts in, customer-managed encryption keys or equivalent, independent audits published with their scope, and every security control the customer has listed with its effect.
The SaaS Developer
What is stored per message is documented (metadata, email address, message content), content retention runs 45 days by default and adjusts from 7 to 365 days, open and click tracking switch off per message, two-factor authentication with backup codes is on every plan including the free one, recipient data deletion can be triggered by API, and SOC 2 certified data centres plus a current SOC 2 report are cited. Outbound TLS is opportunistic and the vendor states customers cannot require it or control the version, and the terms grant a licence to internally use messaging content to train and improve the service — both of those bite for a compliance-heavy buyer. We found no public information on SSO, an audit log, or a vulnerability disclosure programme. 2 8 10 14 19 20
The Platform Engineer
What is stored per message is documented — metadata, address, content — with 45-day default retention, open and link tracking switchable per message, two-factor authentication on every plan that the owner can enforce, IP allow-listing, separate server and account tokens, encryption at rest stated, a GDPR data-removal API, and a published DPA. Outbound TLS is opportunistic with an unencrypted fallback that the customer cannot control, and the terms of service reserve the right to internally use Messaging Content to train and improve the service; we found no public information on SSO, an audit log, or ISO 27001 for the platform itself. 7 8 10 13 19 20
The Shop Operator
What is stored is documented — full message content for 45 days, adjustable from 7 to 365 days, statistics indefinitely — open and link tracking can be switched off per message, encryption at rest is stated, two-factor authentication is on every plan including the free one, IP allowlisting exists, a data-removal API and a published DPA are available, and the data centres are SOC 2 certified. As a German shop two things worry me in the captured pages: the terms state the vendor may view, copy and internally use messaging content to train and improve the service, and outbound TLS is opportunistic only with no customer control over it. We found no public information on SSO or a dashboard audit log. 2 7 8 10 13 19 20
The Data Protection Officer
The DPA names what is processed (metadata, email address, message content), content retention is 45 days by default and adjustable from 7 to 365 days, open and click tracking are switchable per message, there are server- and account-level tokens, IP allow-listing, two-factor authentication on every plan that the owner can require, encryption at rest stated, deletion of recipient data through a data removal API, and SOC 2 certified data centres with a SOC 2 report offered as the audit alternative. I must flag two findings before any health data goes near this: the terms state the vendor may view, copy and internally use messaging content to train and improve the service, and outbound TLS is opportunistic, falls back to unencrypted and the customer cannot control the TLS version; we also found no public information on SSO or an audit log. 8 10 13 14 19 20
The Agency Lead
Content retention is configurable, open and click tracking switch per message, 2FA with backup codes runs on every plan, API access uses server and account tokens with IP allowlisting, encryption at rest is stated, and a data removal API plus an executable DPA are published. Two things temper this for client work: the terms grant the vendor the right to view, copy and internally use message content to train and improve the service, and outbound TLS is opportunistic, falling back to unencrypted delivery with no customer control over the TLS version. We found no public information on SSO, a dashboard audit log, or a company-level certification beyond SOC 2 certified data centres. 8 10 13 14 19 20
The Skeptic
The DPA lists what is processed per message — metadata, email address, message content — with retention stated and adjustable (45 days default, 7 to 365), open and click tracking switchable per message, a Data Removal API for recipient deletion, two-factor authentication on every plan including the free one, and cold data at rest encrypted with 2048-bit RSA in SOC 2 certified data centres. Outbound TLS is opportunistic with a fallback to unencrypted and Postmark states the customer cannot control or require it, and the terms grant a licence to internally use messaging content to train and improve the service — the exact clause I read every contract looking for. We found no public information on SSO, an audit log, or a vulnerability disclosure programme. 7 8 10 13 14 19 20
Reliability, accounts & support
Show reasoningHide reasoning
How this is scored
Whether the platform can be relied on and run by a team: a public status page with incident history, uptime SLA and service credits published, redundancy or failover across data centres described, queueing and retry of mail during outages, sub-accounts or servers per application, client or tenant, team members with roles, separate environments, support channels and response times per plan, named migration help, and integrations with platforms that send mail on the customer's behalf (WordPress, Shopify, Shopware, Supabase, Vercel and similar).
0 — No status page, no support channel and no way to separate users or applications.
3 — A support contact and a single account; status page, SLA, sub-accounts and roles are basic or not described.
5 — A public status page with incident history, an uptime SLA on at least one plan, sub-accounts or separate servers per application, team members with roles, support by email or chat with stated hours, and plugins or guides for several named platforms.
8 — An SLA with service credits published, redundancy across data centres or regions described, mail queued and retried during incidents, sub-accounts with their own keys, domains and limits manageable by API, granular roles, support response times per plan, and migration assistance offered.
10 — Reliability that can be verified: uptime history published for years, post-mortems for incidents, multi-region failover documented, an SLA covering delivery latency as well as API availability, and white-label or reseller tooling for agencies and platforms.
The SaaS Developer
Servers work as per-application sub-accounts with their own API tokens, domains and limits, all manageable through the API; there are three roles plus an observer, a WordPress plugin that overrides wp mail, Zapier actions, framework guides, migration guides with a $75 bootstrap credit, and support included at no extra cost on every plan. Redundant data centres in multiple locations with N+2 redundancy and geographic load balancing are described. We found no public information on an uptime SLA, service credits, or an incident history — the public status page carries delivery statistics rather than a documented uptime record. 1 2 5 6 7 21 22
The Platform Engineer
Redundant data centres in multiple locations with geographic load balancing and N+2 redundancy are described, servers separate applications with their own tokens manageable by API and CLI, three roles plus per-server permissions include an observer who can review history, and there are WordPress, Zapier and Nodemailer integrations with guides for Laravel, Rails, Express, Django and Craft, plus migration guides and migration credit. We found no public information on an uptime SLA with service credits, incident history on the status page, support response times, or whether mail is queued and retried during an outage — and the terms provide the service as is with liability capped at three months of fees, which is what I would have to sign. 2 3 5 7 8 21 22
The Shop Operator
Redundant data centres in multiple locations with N+2 redundancy and geographic load balancing are described, separate servers with their own limits and up to ten message streams each let me keep order mail apart from anything else, three roles plus per-server permissions including an observer cover my team, support is included at no extra charge, and migration guides exist from named competitors. We found no public information on an uptime SLA, incident history, support response times or mail queueing during outages. A WordPress plugin is documented, but we found no public information on a Shopware plugin, and the terms reserve the right to terminate any account at any time without notice — a real risk when all my order confirmations flow through one pipe. 1 5 7 8 21 22
The Data Protection Officer
Separate servers per application with plan limits and up to ten message streams each, three roles with a documented permission matrix plus an observer role, redundant data centres in multiple locations with N+2 redundancy and geographic load balancing, free premium support, migration guides, and WordPress, Zapier and framework integrations. We found no public information on an uptime SLA or service credits, on queueing and retry of mail during incidents, or on support response times per plan, so I cannot take reliability as contractually backed. 1 5 7 21 22
The Agency Lead
Servers are per-application sub-accounts — up to ten on the free and Pro plans, unlimited on Platform — each with its own token and manageable through the account API and CLI, which maps cleanly onto one agency account with a server per client. Owner, Admin and Teammate roles plus a per-server observer let a client see their own message activity and nothing more, N+2 redundancy across multiple data centres is described, and WordPress, Nodemailer and Zapier integrations plus migration guides and a $75 switching credit are documented. We found no public information on an uptime SLA, service credits, incident history, queueing of mail during outages, or support response times; the publicised status page carries delivery statistics to the major inbox providers. 1 5 7 12 21 22
The Skeptic
Servers per application with per-plan limits and API management, three roles (Owner, Admin, Teammate) with a documented permission matrix, redundant data centres in multiple locations with N+2 and geographic load balancing, WordPress, Zapier and Nodemailer integrations, and a success team that never charges extra for premium support. The status page carries real-time delivery metrics, but we found no public information on an uptime SLA, service credits, incident history or post-mortems, mail queueing during outages, or support response times. 1 2 5 7 14 21 22
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where messages, logs and recipient data are processed and stored, whether an EU region can be chosen and what it covers, and who the subprocessors are (cloud hosting, sending infrastructure, logging, support and payment tools). Independently sourced by the sovereignty pipeline; every message carries personal data, so the whole sending chain counts, not only the dashboard.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — An EU region available and an EU contracting entity or EU representative, but parts of the chain (sending infrastructure, logs, support, payment) run through non-EU providers without a stated safeguard, or the EU region does not cover logs and account data.
8 — EU processing of messages, logs and account data on named infrastructure, an EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, sending infrastructure and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The SaaS Developer
The contracting entity is AC PM, LLC, an ActiveCampaign company, under Illinois law, with hosting on AWS and at a Deft data centre in the United States and the terms consenting to processing and storage in the United States and other countries — for a Hamburg buyer that covers the whole sending chain, not just the dashboard. A published data processing agreement with Standard Contractual Clauses governed by Irish law, an Article 27 EU representative in Kiel, and a sub-processor list with change notification all exist. We found no public information on an EU hosting region for messages or logs; transfers out of the EEA are contemplated via the Data Privacy Framework and the clauses. 8 9 10 11
The Platform Engineer
The contracting entity is AC PM, LLC, an ActiveCampaign company governed by Illinois law, personal information is stored in US data centres on AWS and Deft, and use of the service consents to processing and storage in the United States and other countries. An Article 27 EU representative is appointed, a DPA with Standard Contractual Clauses governed by Irish law is published, EU-US Data Privacy Framework certification is claimed, and a sub-processor list with change notification exists — but we found no public information on an EU hosting region, so the whole sending chain including logs runs through the United States. 8 9 10 11
The Shop Operator
The contracting entity is AC PM, LLC under Illinois law with ActiveCampaign, LLC as owner, all personal information is stored on AWS and in a data centre near Chicago, and the terms require consent to processing and storage in the United States and other countries; we found no public information on an EU hosting region for messages or logs. On the positive side there is a published DPA with Standard Contractual Clauses under Irish law, an Article 27 EU representative in Kiel, and a sub-processor list with change notification. For my German and Austrian customers this means the whole sending chain, including message content, runs through the US with contractual safeguards rather than EU processing. 8 9 10 11
The Data Protection Officer
The contracting entity is AC PM, LLC, an ActiveCampaign company under Illinois law, personal information is stored in AWS data centres, and the terms have the customer consent to processing and storage in the United States and other countries; we found no public information on an EU region covering messages, logs or account data, and the DPA's reliance on the Data Privacy Framework and the Standard Contractual Clauses confirms transfers out of the EEA are contemplated. There are real mitigations — an executable DPA with SCC modules two and three governed by Irish law, DPF certification, an Article 27 EU representative in Germany, and a published sub-processor page with change notifications — but the named sub-processor list with locations was not captured, so I place this between the levels: above a bare DPA, well short of EU processing. 8 9 10 11
The Agency Lead
The contracting entity is AC PM, LLC, an ActiveCampaign company, governed by Illinois law, with all personal information stored in AWS and Deft data centres in the United States and transfers contemplated to the United States, Australia, Ireland, Brazil and Costa Rica; we found no public information on an EU hosting region. There are genuine safeguards — an executable DPA with Standard Contractual Clauses modules under Irish law, an Article 27 representative in Kiel, EU-U.S. Data Privacy Framework certification and a published sub-processor list with change notification — but every message a client of mine sends through the platform is processed outside the EEA. For thirty German client domains under GDPR that means DPA on file and informed clients, not an EU data path. 8 9 10 11
The Skeptic
The contracting entity is AC PM, LLC, an ActiveCampaign company governed by Illinois law, storage is in AWS and Deft data centres, and users consent to processing and storage in the United States and other countries; the DPA leans on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses, so transfers out of the EEA are the stated path and no EU hosting region appears in any capture. An Article 27 representative in Kiel, published SCC modules governed by Irish law, and a sub-processor list with change notification are real, but they are safeguards on a US chain, not European processing. 8 9 10 11
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly message volume, the price per additional thousand messages, the free tier and its limits, what dedicated IPs, extra log retention, sub-accounts, SSO and support plans cost, minimum term, and whether unused volume carries over.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with volume or which features cost extra is unclear.
5 — Tiers are public with their monthly volume and price, but at least one commonly needed piece (overage rate, dedicated IP, longer log retention, SSO, support plan) is unpriced or "on request".
8 — Every tier priced publicly with its volume and overage rate per thousand messages, dedicated IPs and add-ons priced, log retention per tier stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given monthly volume, number of domains and sub-accounts and feature set, with every add-on, support and overage fee and the cancellation terms published.
The SaaS Developer
Every tier is public with its price and per-thousand overage — Free at $0.00/mo with 100 emails every month, Basic $15.00/mo, Pro $16.50/mo, Platform $18.00/mo, extra emails at $1.80 / 1,000, $1.30 / 1,000 and $1.20 / 1,000 respectively — plus dedicated IPs at $50/month per IP with no setup fees, custom activity retention starting at $5/month, DMARC monitoring at $14/month per domain, 45-day retention stated per tier, and support included rather than sold. Unused emails do not roll over, annual plans are not offered yet, and we found no public information on VAT treatment or the included monthly volume of each paid tier, so a complete annual cost calculation is not quite possible. 1 7 8 15
The Platform Engineer
Every tier is public with its overage rate per thousand emails — free at $0.00/mo with 100 emails a month and no overages, Basic at $15.00/mo with extra emails at $1.80/1,000, Pro at $16.50/mo at $1.30/1,000, Platform at $18.00/mo at $1.20/1,000 — dedicated IPs at $50/month per IP with no setup fees, DMARC monitoring at $14/month per domain, custom activity retention starting at $5/month, 45-day retention per tier, no rollover of unused emails, and monthly plans that auto-renew until cancelled with no annual option. We found no public information on VAT treatment, and the captured pages do not state the monthly email allowance included in each paid tier. 7 8 15
The Shop Operator
All four tiers are priced publicly — Free at $0.00/mo with 100 emails, Basic at $15.00/mo, Pro at $16.50/mo, Platform at $18.00/mo — each with a stated extra-email rate per thousand, dedicated IPs at $50/month per IP with no setup fees, custom retention starting at $5/month, DMARC monitoring at $14/month per domain, no rollover of unused volume, and support never charged extra. The pages state that annual plans are not offered yet and high-volume pricing is by contact. We found no public information on the included monthly volume of the paid tiers beyond the entry level or on VAT treatment, which is what keeps the annual cost for my roughly 900 orders a week from being fully computable from public pages alone. 1 7 8 15
The Data Protection Officer
Four tiers priced publicly with their overage rate per thousand messages (Free at $0.00/mo with 100 emails/month, Basic at $15.00/mo with extras at $1.80/1,000, Pro at $16.50/mo at $1.30/1,000, Platform at $18.00/mo at $1.20/1,000), dedicated IPs at $50/month per IP with no setup fees, DMARC monitoring at $14/month per domain, custom retention starting at $5/month, no rollover of unused email, and monthly auto-renewal cancelled through the service. What stops me going higher: the retention add-on is a starting price rather than a computable figure, high-volume pricing is on request, and we found no public information on VAT treatment. 7 8
The Agency Lead
Four public tiers carry their overage rate — free at $0.00/mo with 100 emails and no overages, Basic at $15.00/mo with extra emails at $1.80/1,000, Pro at $16.50/mo at $1.30/1,000, Platform at $18.00/mo at $1.20/1,000 — with server, domain and user counts per tier, dedicated IPs at $50/month per IP with no setup fees, DMARC monitoring at $14/month per domain, custom retention from $5/month, premium support at no extra charge, no rollover of unused emails, monthly auto-renewal and cancellation through the service. That is enough to write a per-client price into a maintenance contract on the Platform plan with unlimited servers. The included monthly volume for each paid tier appears only as the 10,000 emails implied for the entry tier, we found no public information on VAT treatment, annual plans are not offered yet, and high-volume pricing is on request. 1 7 8 15
The Skeptic
Every plan is public with its overage rate — $15.00 Basic at $1.80 per 1,000, $16.50 Pro at $1.30, $18.00 Platform at $1.20, and a free Developer plan of 100 emails a month — plus dedicated IPs at $50/month per IP with no setup fees, custom retention from $5/month, DMARC monitoring at $14/month per domain, users, domains, servers and log retention per tier, no rollover of unused email, and a 90-day refund on unused first-purchase credits. Annual plans are "Not right now", we found no public information on VAT treatment, and the captured pricing facts state the included monthly volume only for the free plan (100 emails) and, via an FAQ answer, 10,000 for the first paid tier. A buyer can get close to the real cost, but not all the way without asking. 4 7 8 15
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Postmark
Is Postmark European?
No. whats-best.ai classifies Postmark as Rest of world.
Where does Postmark store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Postmark have a free plan?
Yes. Postmark has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Postmark?
As of 1 Nov 2026, the panel rates Lettermint (3.5/5), Bird Email API (formerly SparkPost) (3/5) and Mailjet Email API (3/5) highest among the other 15 Transactional Email products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Lettermint (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Postmark alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- Weak sourcing — Hosting location. This sentence covers information about the user rather than explicitly all customer message content, and no excerpt offers an EU hosting region; the DPA's reliance on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses confirms transfers out of the EEA are contemplated.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 24 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (22)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage postmarkapp.com Checked 1 Nov 2026 Details →
- 2 Features page (transactional email) postmarkapp.com Checked 1 Nov 2026 Details →
- 3 Features page (SMTP relay) postmarkapp.com Checked 1 Nov 2026 Details →
- 4 Features page (message streams) postmarkapp.com Checked 1 Nov 2026 Details →
- 5 Features page (deliverability) postmarkapp.com Checked 1 Nov 2026 Details →
- 6 API documentation postmarkapp.com Checked 1 Nov 2026 Details →
- 7 Pricing page postmarkapp.com Checked 1 Nov 2026 Details →
- 8 Terms of service postmarkapp.com Checked 1 Nov 2026 Details →
- 9 Privacy policy www.activecampaign.com Checked 1 Nov 2026 Details →
- 10 Data processing agreement (dpa) postmarkapp.com Checked 1 Nov 2026 Details →
- 11 Security / trust page (EU data protection) postmarkapp.com Checked 1 Nov 2026 Details →
- 12 Security / trust page postmarkapp.com Checked 1 Nov 2026 Details →
- 13 Sending API, SMTP & developer experience — found from sitemap postmarkapp.com Checked 1 Nov 2026 Details →
- 14 Sending API, SMTP & developer experience — found from sitemap postmarkapp.com Checked 1 Nov 2026 Details →
- 15 Deliverability & sender reputation — found from sitemap postmarkapp.com Checked 1 Nov 2026 Details →
- 16 Deliverability & sender reputation — found from sitemap postmarkapp.com Checked 1 Nov 2026 Details →
- 17 Message logs, events & webhooks — found from sitemap postmarkapp.com Checked 1 Nov 2026 Details →
- 18 Message logs, events & webhooks — found from sitemap postmarkapp.com Checked 1 Nov 2026 Details →
- 19 Message data, retention & security — found from sitemap postmarkapp.com Checked 1 Nov 2026 Details →
- 20 Message data, retention & security — found from sitemap postmarkapp.com Checked 1 Nov 2026 Details →
- 21 Reliability, accounts & support — found from sitemap postmarkapp.com Checked 1 Nov 2026 Details →
- 22 Reliability, accounts & support — found from sitemap postmarkapp.com Checked 1 Nov 2026 Details →