# Postmark — Transactional Email

Postmark by AC PM, LLC holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-02. Provenance: Rest of world; sovereignty: not determined.

- Vendor: AC PM, LLC (https://postmarkapp.com)
- Category: [Transactional Email](https://whats-best.ai/software/transactional-email.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/transactional-email/postmark
- Alternatives: https://whats-best.ai/software/transactional-email/postmark/alternatives ([markdown](https://whats-best.ai/software/transactional-email/postmark/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-02 · oldest source captured 2026-11-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: AC PM, LLC
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan: Yes, per the vendor’s own page [S7]

## The panel's verdict

Postmark, the transactional email service of AC PM, LLC, an ActiveCampaign company, earns its best marks on the sending API and pricing transparency, both a flat 7, and on deliverability at 7 to 8, resting on manual vetting of every new sender, free custom Return-Path and DKIM, and separate infrastructure for transactional and broadcast traffic including IP ranges. Its weak point is sovereignty, a flat 4: contracting is under Illinois law, personal information is stored in AWS and Deft data centres in the United States, and transfers out of the EEA are contemplated through the Data Privacy Framework and Standard Contractual Clauses, with no EU hosting region found on the captured pages. Data and security is a flat 6, held down by a licence in the terms to internally use messaging content for training and by opportunistic outbound TLS with an unencrypted fallback. The bench splits narrowly on observability and reliability and accounts, both 6 to 7, where strong webhooks and redundancy are weighed against missing spike alerts, export, SLA and response-time information; no material disagreement was computed.

**Speaks for it:**
- Documented REST API and SMTP relay with vendor-maintained official libraries for TypeScript, Node, Python, Ruby, Rails, PHP,.NET and Java, batch sending up to 500 messages, and a test token that does not deliver
- Deliverability scored 7 to 8 on manual vetting of every new sender, free custom Return-Path and DKIM domains, separate IP ranges for transactional and broadcast traffic, and dedicated IPs with managed warm-up from 300,000 messages a month
- All four plans are public with their overage rates — free at $0.00/mo with 100 emails, Basic $15.00/mo, Pro $16.50/mo, Platform $18.00/mo — with add-ons priced openly and a 90-day refund on unused first-purchase credits
- Seven webhook event types with a documented six-attempt retry schedule, health tracked per event type with pausing of only the failing event, and 45 days of full content history customisable from 7 to 365 days
- Free trial with no credit card required, premium support at no extra charge, and migration guides from six named competitors

**Held against it:**
- Sovereignty scores a flat 4: AC PM, LLC contracts under Illinois law, personal information is stored in AWS and Deft data centres in the United States, transfers out of the EEA are contemplated via the Data Privacy Framework and SCCs, and the judges found no public information on an EU hosting region
- The terms grant a licence to view, copy and internally use messaging content to train and improve the service
- Outbound TLS is opportunistic, falls back to unencrypted delivery, and the customer cannot control or require it
- No public information was found on an uptime SLA, service credits, SSO or an audit log, and the terms provide the service as is, cap liability at three months of fees, and reserve termination of any account at any time without notice

**Best for:**
- You are a development team wiring transactional email into an application and want a documented REST API and SMTP relay with vendor-maintained libraries, framework guides and migration paths from six named competitors
- You send transactional mail at small or mid-size volume and want managed deliverability — manual sender vetting, free custom Return-Path and DKIM, and vendor-monitored shared IP pools
- You run an agency or platform and need per-client separation — servers with their own tokens (up to 10 on the free and Pro plans, unlimited on Platform) plus a per-server observer role for read-only client access
- You want predictable public pricing — a free Developer plan with 100 emails a month, paid tiers from $15.00/mo with stated per-thousand overage rates, and premium support at no extra charge

**Avoid if:**
- Your compliance regime requires message content and logs to stay in EU processing — ask the vendor: the public pages we read do not show it
- You cannot accept a licence for the vendor to view, copy and internally use messaging content to train and improve the service
- You must guarantee encrypted delivery on every outbound hop — outbound TLS is opportunistic, falls back to unencrypted, and the customer cannot control or require it
- You need contractually backed reliability — the service is provided "as is", liability is capped at three months of fees, and the terms reserve termination of any account at any time without notice

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The SaaS Developer | The Platform Engineer | The Shop Operator | The Data Protection Officer | The Agency Lead | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Sending API, SMTP & developer experience | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Deliverability & sender reputation | 4/5 | 3.5/5 | 3.5/5 | 4/5 | 4/5 | 3.5/5 |
| Message logs, events & webhooks | 3.5/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | 3.5/5 |
| Message data, retention & security | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Reliability, accounts & support | 3.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| European sovereignty | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Pricing transparency | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| **Weighted verdict** | **3.5/5** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** |

### The judges

- **The SaaS Developer** (v1.0): Backend developer at a twelve-person B2B SaaS in Hamburg, built on Laravel, that sends sign-up confirmations, password resets, invoices and weekly digests to 40,000 users. Has replaced the mail driver once already and does not want to again. Wants an official driver for the framework, templates with variables, a test mode that never reaches a real inbox, signed webhooks for bounces, and a log that answers "did this user get the reset mail?" without opening a ticket.
- **The Platform Engineer** (v1.0): Platform engineer at a fintech in Frankfurt whose customers sign in with a one-time code sent by email, so a delay of three minutes is an outage. Is on call for it. Reads the status page history before the feature list, wants the SLA in writing with credits, mail queued and retried during an incident, delivery latency per mailbox provider, alerts on bounce spikes, and scoped API keys that can be rotated without a deploy.
- **The Shop Operator** (v1.0): Runs a Shopware shop for kitchen equipment in Germany and Austria with 900 orders a week. Order confirmations, invoices and shipping notices went out through the hosting provider's mail server until a customer found theirs in spam and the support inbox filled up. Wants guided SPF and DKIM set-up a non-specialist can follow, a plugin for the shop, order mail kept apart from the newsletter, and someone to ask when Gmail starts refusing.
- **The Data Protection Officer** (v1.0): In-house data protection officer at a health software company whose appointment reminders and lab-result notices carry patients' names. Treats the sending service as a processor like any other. Reads the DPA, the subprocessor list and the retention section first: whether message bodies are stored and for how long, whether open tracking can be turned off, which entity signs, and whether the EU region covers the logs as well as the mail.
- **The Agency Lead** (v1.0): Technical lead at a web agency in Cologne that builds and runs thirty client applications, from a booking portal to a membership site, each sending its own mail from the client's domain. Wants one account with a sub-account, keys and limits per client, domains verified by API, roles so a client can see their own logs and nothing else, and a price per client that can be written into a maintenance contract.
- **The Skeptic** (v1.0): Has seen "99% deliverability" with no method behind it, "dedicated IPs" that shared a pool with bulk senders, "EU hosting" that covered the API endpoint but not the logs, and seven days of log retention discovered during an incident on day eight. Reads that a vendor is "trusted by thousands of developers" and asks how bounces are suppressed, what is stored per message, which entity signs the DPA — and what moving away would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Audit rights: yes · user · 1 [S10]
- Australia privacy act: yes [S9]
- Brazil lgpd: yes [S9]
- CCPA do not sell: yes [S9]
- CCPA rights: yes [S9]
- Data sales: no · yes [S9]
- Dpf certification: yes · yes · yes [S9]
- Dpf certified: yes · yes · yes [S10]
- Dpf dispute resolution: JAMS · no cost [S9]
- Encryption at rest: yes · 2048-bit RSA [S10]
- EU data protection: EU Data Protection policy page linked [S1]
- EU data protection: EU Data Protection policy page linked [S6]
- EU data protection: yes [S7]
- EU rep address: EU-REP.Global GmbH, Hopfenstr. 1d, 24114 Kiel, Germany [S9]
- EU representative: GDPR Article 27 · EU-REP.Global [S9]
- Ftc authority: yes [S9]
- GDPR: yes [S7]
- GDPR: yes [S12]
- GDPR page: yes [S11]
- Minors: no [S9]
- Pci stripe: PCI Level 1 Service Provider · Stripe · no [S12]
- Pen testing: yes · yes [S7]
- Processor scope: yes [S9]
- Sccs available: yes [S9]
- Security audits: automated systems and manual audits from security firms · regularly [S12]
- Security measures: yes [S9]
- SOC 2 datacentres: yes [S10]
- SOC 2 report audit alternative: yes [S10]
- Tls API smtp endpoints: yes · yes [S12]
- Tls outbound: opportunistic · 100% [S12]
- UK rep address: DP Data Protection Services UK Ltd., 16 Great Queen Street, London, WC2B 5AH [S9]

**Data**
- Account update delete: account settings · privacy@activecampaign.com · yes [S9]
- Deletion contact: privacy@activecampaign.com [S9]
- Retention: lifetime of account plus legal obligations [S9]
- Return deletion: yes [S10]
- Termination data loss: yes · no [S8]

**Hosting**
- Aws: Amazon Web Services (AWS) [S10]
- Data center: Type 2 SSAE 16 SOC 1 accredited facility [S12]
- Data location: United States · other countries [S8]
- Deft: Deft (formerly ServerCentral) · yes [S10]
- Transfer locations: United States · Australia · Ireland · Brazil · Costa Rica [S9]

**Integrations**
- AI tooling: Agent Skills for Claude Code, Cursor, and Copilot; llms.txt; MCP server; CLI [S6]
- API auth tokens: X-Postmark-Server-Token · X-Postmark-Account-Token [S14]
- API batch limit: 500 [S14]
- API bulk approval: yes [S14]
- API community libraries: yes [S14]
- API docs AI export: yes · yes [S14]
- API email size limit: 10 · 50 [S14]
- API endpoint: yes · REST · https://api.postmarkapp.com [S14]
- API error code header: X-PM-ApiErrorCode [S14]
- API error structure: ErrorCode · Message [S14]
- API GDPR data removal: yes [S14]
- API libraries: API libraries for many programming languages [S1]
- API official libraries: yes [S14]
- API rate limiting: yes · 429 [S14]
- API server list limit: 500 [S14]
- API smtp tokens: yes [S14]
- API stats date range: 365 [S14]
- API template push: yes [S14]
- API test mode: yes · POSTMARK_API_TEST [S14]
- API webhook verification: yes · ?verify=false [S14]
- Auth token: X-Postmark-Server-Token header, server-level token [S13]
- Framework guides: Laravel · Rails · Express · Django · Craft CMS [S3]
- List: Email API · SMTP Service · Message Streams · Transactional Email · Email Delivery · Email Templates · Inbound Email · Analytics · Webhooks · Security · Rebound · Bulk API [S2]
- Migration guides: SendGrid · Mailgun · Amazon SES · SparkPost · Mailchimp Transactional · Resend [S1]
- Official libraries: TypeScript · Node.js · Python · Ruby · Rails · PHP · .NET · Java [S6]
- Third party integrations: yes [S9]
- Webhook custom headers: yes [S18]
- Webhook default stream: outbound [S18]
- Webhook edit reverify: yes [S18]
- Webhook http auth: yes [S18]
- Webhook include content: yes · yes [S18]
- Webhook no hmac signing: no · HTTP Basic Authentication · IP allowlisting [S22]
- Webhook server token: X-Postmark-Server-Token (server-level) [S18]
- Webhook stats endpoint: GET /webhooks/{Id}/statistics [S18]
- Webhook stats metrics: TotalRequests · SuccessCount · FailureCount · RetryCount · SuccessRate · SlowCount · VerySlowCount · AverageTerminalResponseTimeMs · AverageRetryResponseTimeMs [S18]
- Webhook stats window: 24 [S18]
- Webhook triggers: Triggers: Open (with PostFirstOpenOnly), Click, Delivery, Bounce, SpamComplaint, SubscriptionChange [S18]
- Webhook types: 7 · delivery · bounce · spam_complaint · open_tracking · click · subscription_change · inbound [S14]
- Webhook unverified paused: persistent failure pauses delivery for that event type [S18]
- Webhook verification: yes [S18]
- Webhook verification pause on fail: yes [S18]
- Webhook verify API: POST /webhooks/{ID}/verify [S17]
- Webhook verify default: yes [S18]
- Webhook verify endpoint: POST /webhooks/{Id}/verify [S18]

**Legal**
- Claims time limit: 1 [S8]
- Controller: ActiveCampaign, LLC [S9]
- Copyright: ActiveCampaign, LLC [S4]
- Copyright: ActiveCampaign, LLC [S19]
- Copyright entity: ActiveCampaign, LLC [S11]
- DPA available: yes [S11]
- DPA existing scc modules: 2 · 3 [S10]
- DPA GDPR coverage: yes · yes · yes [S10]
- DPA parties: Terms of Service · AC PM [S10]
- DPA scope new customers: customers who signed up on or after December 10, 2024 [S10]
- Entity: ActiveCampaign, LLC [S2]
- Entity: AC PM, LLC · Postmark Terms of Service [S8]
- Existing DPA no selling: yes [S10]
- Governing law: State of Illinois [S8]
- Liability cap: fees paid in the 3 months preceding the claim [S8]
- Minimum age: 18 [S8]
- Owner: ActiveCampaign, LLC [S1]
- Owner: ActiveCampaign, LLC [S6]
- Owner: ActiveCampaign, LLC [S12]
- Policy last updated: 2026-10-01 [S9]
- Postmark controller: AC PM LLC [S9]
- Privacy policy URL: https://www.activecampaign.com/legal/privacy-policy [S8]
- Publicity rights: yes [S8]
- Related entities: AC PM LLC · ActiveCampaign Australia Pty Limited · ActiveCampaign Ireland Limited · ActiveCampaign Brasil LTDA · ActiveCampaign Costa Rica S.R.L. · AC Snudrovia LLC [S9]
- Scc governing law: courts of Ireland · Ireland [S10]
- Termination rights: no · yes [S8]
- Terms update notice: posting updated Terms to the Site and updating Effective date [S8]
- Third party payment processor: yes [S8]
- Warranty disclaimer: "as is" and "as available" [S8]

**Pricing**
- Addon custom retention: Pro or higher · 5 · yes [S7]
- Addon dedicated ips: Pro or higher · 300000 · 50 [S7]
- Addon dmarc: 14 [S7]
- Annual plans: no [S7]
- Auto renewal: yes · via the Service [S8]
- Basic: 15 · 1.8 [S7]
- Bootstrap credit: 75 [S7]
- Broadcast no extra fees: no · yes [S4]
- Chargeback policy: yes [S8]
- Dedicated ip: 50 [S15]
- Dedicated ip billing timing: Charged on the first monthly plan invoice after assignment [S15]
- Dedicated ip setup fees: no [S15]
- Expired quota: monthly · no [S8]
- Free: 0 · 100 · no [S7]
- High volume: yes [S7]
- Legacy credits broadcast: 1 [S4]
- No small tier: no [S7]
- Overage billing: Overage calculated at end of billing cycle, billed with next month's plan cost [S7]
- Overage charges: yes [S8]
- Platform: 18 · 1.2 [S7]
- Pro: 16.5 · 1.3 [S7]
- Refund policy credit based: 90 [S8]
- Users: up to 6 · up to 6 · up to 4 · unlimited [S7]

**Product**
- 2FA availability: yes · yes · yes [S20]
- 2FA backup codes: yes · yes [S20]
- 2FA methods by plan: app · app · sms [S20]
- 2FA multiple methods: yes [S20]
- 2FA no backup sms number: no [S20]
- 2FA owner visibility: yes [S20]
- 2FA required by owner: yes [S20]
- 2FA sms free plan restriction: yes · no [S20]
- 2FA supported apps: Google Authenticator · Authy · 1Password [S20]
- Account settings permissions: no · yes · no [S21]
- Advertising campaigns: Facebook · Twitter · LinkedIn [S9]
- Analytics: yes [S1]
- Analytics tracking: yes [S9]
- Anti abuse systems: yes [S4]
- API alternative: yes [S3]
- API endpoints: Email · Bulk · Bounce · Templates · Server · Servers · Message Streams · Messages · Domains · Sender signatures · Stats · Triggers: Inbound rules · Webhooks · Suppressions · Data Removal [S6]
- API message stream field: Email routing via a single MessageStream field in the API call [S4]
- API smtp: yes · yes [S1]
- Article last updated: 2025-03-27 [S19]
- Attachments support: yes [S13]
- Authentication: yes · yes · yes [S7]
- Authentication support: SPF · DKIM · DMARC [S5]
- Batch limits: 50 · 500 [S13]
- Batch partial failure: yes [S13]
- Blacklist monitoring: Postmark monitors all IPs including blacklist alerts and attempts resolution without customer involvement [S15]
- Blacklist repeated issues consequence: Persistent problems may lead to revoking dedicated IP access or account suspension [S15]
- Bounce API: yes [S6]
- Bounce rate limit: 0.1 [S8]
- Bounce webhooks: yes [S2]
- Breach notification: without undue delay · yes [S10]
- Broadcast approval required new users: yes [S4]
- Broadcast available existing customers: yes [S4]
- Broadcast stream definition: sender schedule · many [S4]
- Bulk API: yes [S1]
- Cli commands: email · servers · templates [S22]
- Community libraries available: yes [S22]
- Content history: 45 · 365 · 7 [S2]
- Content use for training: yes [S8]
- Craft custom message stream: transactional Message Stream · yes [S22]
- Custom dkim returnpath free: 0 · yes [S15]
- Custom domains: up to 10 · up to 10 · up to 5 · unlimited [S7]
- Custom metadata: X-PM-Metadata headers · yes · API · webhooks · web app [S3]
- Dedicated ip additional eligibility: 100000 [S15]

**Subprocessors**
- General authorization: yes [S10]
- List and notification: yes · yes [S11]
- Nylas email: Nylas, Inc. · email account connection features · yes [S9]

**Support**
- 2FA lockout contact: contact success team [S20]
- Article updated: 2025-09-30 [S21]
- Payment methods: no · Visa · MasterCard · American Express · Diners · JCB · no [S7]
- Premium free: no [S1]
- Privacy contact: privacy@activecampaign.com · 1 North Dearborn Street, 5th floor, Chicago, IL 60602 [S9]

157 more facts on the canonical page: https://whats-best.ai/software/transactional-email/postmark

## Questions

### Is Postmark European?

No. whats-best.ai classifies Postmark as Rest of world.

### Where does Postmark store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

### Does Postmark have a free plan?

Yes. Postmark has a free plan, per [the vendor’s page captured 1 Nov 2026](https://whats-best.ai/evidence/14585).

### What are the best alternatives to Postmark?

As of 1 Nov 2026, the panel rates [Lettermint (3.5/5)](https://whats-best.ai/software/transactional-email/lettermint), [Bird Email API (formerly SparkPost) (3/5)](https://whats-best.ai/software/transactional-email/bird-email-api) and [Mailjet Email API (3/5)](https://whats-best.ai/software/transactional-email/mailjet-email-api) highest among the other 15 Transactional Email products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Lettermint](https://whats-best.ai/software/transactional-email/lettermint) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Postmark alternatives](https://whats-best.ai/software/transactional-email/postmark/alternatives).

## Head-to-head

- [Postmark vs Lettermint](https://whats-best.ai/compare/lettermint-vs-postmark.md)
- [Postmark vs Mailgun](https://whats-best.ai/compare/mailgun-vs-postmark.md)

## What this page leaves out

- 24 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://postmarkapp.com/ (checked 2026-11-01)
- [S2] Features page (transactional email): https://postmarkapp.com/transactional-email (checked 2026-11-01)
- [S3] Features page (SMTP relay): https://postmarkapp.com/smtp-service (checked 2026-11-01)
- [S4] Features page (message streams): https://postmarkapp.com/message-streams (checked 2026-11-01)
- [S5] Features page (deliverability): https://postmarkapp.com/email-delivery (checked 2026-11-01)
- [S6] API documentation: https://postmarkapp.com/developer (checked 2026-11-01)
- [S7] Pricing page: https://postmarkapp.com/pricing (checked 2026-11-01)
- [S8] Terms of service: https://postmarkapp.com/terms-of-service (checked 2026-11-01)
- [S9] Privacy policy: https://www.activecampaign.com/legal/privacy-policy (checked 2026-11-01)
- [S10] Data processing agreement (dpa): https://postmarkapp.com/dpa (checked 2026-11-01)
- [S11] Security / trust page (EU data protection): https://postmarkapp.com/eu-privacy (checked 2026-11-01)
- [S12] Security / trust page: https://postmarkapp.com/security (checked 2026-11-01)
- [S13] Sending API, SMTP & developer experience — found from sitemap: https://postmarkapp.com/developer/api/email-api (checked 2026-11-01)
- [S14] Sending API, SMTP & developer experience — found from sitemap: https://postmarkapp.com/developer/api/overview (checked 2026-11-01)
- [S15] Deliverability & sender reputation — found from sitemap: https://postmarkapp.com/dedicated-ips (checked 2026-11-01)
- [S16] Deliverability & sender reputation — found from sitemap: https://postmarkapp.com/guides/improve-your-transactional-emails-with-gmail-inbox-actions (checked 2026-11-01)
- [S17] Message logs, events & webhooks — found from sitemap: https://postmarkapp.com/developer/webhooks/webhooks-overview (checked 2026-11-01)
- [S18] Message logs, events & webhooks — found from sitemap: https://postmarkapp.com/developer/api/webhooks-api (checked 2026-11-01)
- [S19] Message data, retention & security — found from sitemap: https://postmarkapp.com/support/article/what-tls-does-postmark-support-and-use (checked 2026-11-01)
- [S20] Message data, retention & security — found from sitemap: https://postmarkapp.com/support/article/1081-how-do-i-use-two-factor-authentication-2fa (checked 2026-11-01)
- [S21] Reliability, accounts & support — found from sitemap: https://postmarkapp.com/support/article/roles-permissions-in-postmark (checked 2026-11-01)
- [S22] Reliability, accounts & support — found from sitemap: https://postmarkapp.com/developer/integration/official-libraries (checked 2026-11-01)

---

Cite as: whats-best.ai, "Postmark — Transactional Email", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/transactional-email/postmark

Corrections: https://whats-best.ai/correct/1277?target=page
