# Resend — Transactional Email

Resend by Plus Five Five, Inc. holds a panel rating of 2.5/5 from 6 AI judges (category median 3/5), as of 2026-11-01. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Plus Five Five, Inc. (https://resend.com)
- Category: [Transactional Email](https://whats-best.ai/software/transactional-email.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/transactional-email/resend
- Alternatives: https://whats-best.ai/software/transactional-email/resend/alternatives ([markdown](https://whats-best.ai/software/transactional-email/resend/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-01 · oldest source captured 2026-11-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Plus Five Five, Inc.
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan: Yes, per the vendor’s own page [S6]

## The panel's verdict

Resend, a transactional email service from Plus Five Five, Inc. of San Francisco, is strongest on its sending API, deliverability and observability, where scores cluster at 6-7, and weakest on reliability and accounts, a flat 4. Judges credit a documented REST API and SMTP relay with official SDKs for many languages, signed webhooks retried on a published schedule, and deliverability tooling from guided DKIM, SPF and DMARC set-up to managed dedicated IPs. Reliability is marked down because the only written uptime commitment is a 99.99% SLA on the Enterprise plan, with email support on other plans. Sovereignty scores 3-4: customer data including message content is stored in the United States, and the EU sending region controls routing and sending only — there is no setting today that moves stored data to the EU. Pricing transparency scores ranged from 4 to 6: add-ons are priced exactly (dedicated IPs at $30 / mo, single sign-on at $150 / mo), but the monthly prices of the paid plans and the overage rate are not shown, so a full annual cost cannot be computed.

**Speaks for it:**
- Documented REST API and SMTP relay with official SDKs for Node.js, PHP, Python and other languages, plus a test mode that simulates events without delivering real mail
- Signed webhooks covering delivered, opened, bounced and clicked events, retried on a published exponential-backoff schedule with attempts out to 10 hours
- Deliverability tooling includes DKIM, SPF and DMARC set-up, an automatic suppression list with bounce details, and managed dedicated IPs that warm up, monitor and autoscale
- AES-256 encryption at rest, TLS 1.3 or higher in transit, SOC 2 Type II, annual third-party penetration tests and optional open and link tracking are stated plainly
- A pre-signed GDPR Article 28 DPA with EU Standard Contractual Clauses under Irish law and Data Privacy Framework participation executes automatically at signup, with 14 days' notice on subprocessor changes

**Held against it:**
- The only written uptime commitment is a 99.99% SLA on the Enterprise plan, with email support on other plans
- We found no public information on a public status page with incident history, sub-accounts, team roles or service credits
- Customer data including message content is stored in the United States, and the EU sending region controls routing and sending only — no setting today moves stored data to the EU
- The monthly prices of the Pro and Scale plans themselves and the numeric overage rate per additional bucket of 1,000 emails are not shown, so a full annual cost cannot be computed
- The responsible-disclosure programme is temporarily pausing new reports due to team-size limitations

**Best for:**
- You want a documented REST API and SMTP relay with official SDKs across many languages and a test mode that never delivers to real inboxes
- You build automation on webhook events and need signed payloads with a published retry schedule
- You send enough volume to use a managed dedicated IP and want warm-up, monitoring and autoscaling handled for you
- You can accept US data residency when transfers are covered by the pre-signed DPA's EU Standard Contractual Clauses and Data Privacy Framework participation

**Avoid if:**
- You need message content stored in the EU — the pages state storage is in the United States and the EU sending region controls routing and sending only
- You require an uptime SLA and guaranteed response times without moving to the Enterprise plan
- You send regulated health data — the vendor states it is not HIPAA compliant and cannot sign a Business Associate Agreement
- Your legal team needs changes to the DPA or other legal documents — the pages state that requires the Enterprise Plan

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The SaaS Developer | The Platform Engineer | The Shop Operator | The Data Protection Officer | The Agency Lead | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Sending API, SMTP & developer experience | 3/5 | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3/5 |
| Deliverability & sender reputation | 3/5 | 3/5 | 3/5 | 3.5/5 | 3/5 | 3/5 |
| Message logs, events & webhooks | 3/5 | 3/5 | 3/5 | 3.5/5 | 3/5 | 3/5 |
| Message data, retention & security | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Reliability, accounts & support | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| European sovereignty | 1.5/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Pricing transparency | 2.5/5 | 2.5/5 | 2/5 | 2.5/5 | 3/5 | 2/5 |
| **Weighted verdict** | **2.5/5** | **3/5** | **2.5/5** | **3/5** | **3/5** | **2.5/5** |

### The judges

- **The SaaS Developer** (v1.0): Backend developer at a twelve-person B2B SaaS in Hamburg, built on Laravel, that sends sign-up confirmations, password resets, invoices and weekly digests to 40,000 users. Has replaced the mail driver once already and does not want to again. Wants an official driver for the framework, templates with variables, a test mode that never reaches a real inbox, signed webhooks for bounces, and a log that answers "did this user get the reset mail?" without opening a ticket.
- **The Platform Engineer** (v1.0): Platform engineer at a fintech in Frankfurt whose customers sign in with a one-time code sent by email, so a delay of three minutes is an outage. Is on call for it. Reads the status page history before the feature list, wants the SLA in writing with credits, mail queued and retried during an incident, delivery latency per mailbox provider, alerts on bounce spikes, and scoped API keys that can be rotated without a deploy.
- **The Shop Operator** (v1.0): Runs a Shopware shop for kitchen equipment in Germany and Austria with 900 orders a week. Order confirmations, invoices and shipping notices went out through the hosting provider's mail server until a customer found theirs in spam and the support inbox filled up. Wants guided SPF and DKIM set-up a non-specialist can follow, a plugin for the shop, order mail kept apart from the newsletter, and someone to ask when Gmail starts refusing.
- **The Data Protection Officer** (v1.0): In-house data protection officer at a health software company whose appointment reminders and lab-result notices carry patients' names. Treats the sending service as a processor like any other. Reads the DPA, the subprocessor list and the retention section first: whether message bodies are stored and for how long, whether open tracking can be turned off, which entity signs, and whether the EU region covers the logs as well as the mail.
- **The Agency Lead** (v1.0): Technical lead at a web agency in Cologne that builds and runs thirty client applications, from a booking portal to a membership site, each sending its own mail from the client's domain. Wants one account with a sub-account, keys and limits per client, domains verified by API, roles so a client can see their own logs and nothing else, and a price per client that can be written into a maintenance contract.
- **The Skeptic** (v1.0): Has seen "99% deliverability" with no method behind it, "dedicated IPs" that shared a pool with bulk senders, "EU hosting" that covered the API endpoint but not the logs, and seven days of log retention discovered during an incident on day eight. Reads that a vendor is "trusted by thousands of developers" and asks how bounces are suppressed, what is stored per message, which entity signs the DPA — and what moving away would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Audit records: 3 [S8]
- Audit rights: yes · 1 · yes [S8]
- Breach notification: without undue delay · yes [S11]
- Caloppa: yes [S7]
- CCPA: yes [S7]
- CCPA service provider: service provider · no [S11]
- CCPA service provider: yes · yes [S8]
- Certifications listed: SOC 2 · GDPR [S16]
- Company role: processor · controller or processor [S8]
- Controller roles: independent controller · processor [S11]
- Countryspecific DPA not offered: no [S11]
- Covered laws: CCPA, EU GDPR, UK GDPR, Swiss FADP, UK Data Protection Act 2018, PECR [S8]
- Disclosure acknowledgment: optional [S16]
- Disclosure bounty: Hall of Fame mention · monetary amount depending on severity and report quality · issue must be serious and previously unidentified [S16]
- Disclosure scope: https://resend.com · https://api.resend.com · Automated scanning · Social engineering · Password brute force · Clickjacking on pages with no sensitive actions · Missing security headers (unless you can prove exploitability) [S16]
- DPA automatic: Article 28 DPA · yes · yes · yes [S11]
- DPA exists: yes [S6]
- DPA includes EU sccs: yes · yes [S11]
- DPA signed copy download: Documents page (login required) [S11]
- Dpf certified: yes · yes [S8]
- Dpf ftc: yes [S8]
- Dpia assistance: yes [S8]
- Encryption: AES-256 · TLS 1.3 or higher [S11]
- GDPR: yes [S10]
- GDPR compliant: yes [S11]
- GDPR contact: support@resend.com [S7]
- GDPR rights: yes [S7]
- GDPR self audit: self-audit [S11]
- HIPAA: in_progress · no [S10]
- HIPAA not available: no · no [S11]
- Hosting certifications: SOC 2 Type II · ISO 27001 [S8]
- Internal procedures: Internal security procedures: 3 listed + 31 more, including tested DR plans and cybersecurity insurance [S10]
- ISO 27001 not certified: no [S11]
- MFA SSO: yes · yes [S8]
- Organizational security: Organizational security: 3 listed + 11 more controls [S10]
- Pci dss: yes [S7]
- Pentest annual: annual · yes · Documents page [S11]
- Product security: Product security: 3 listed + 2 more controls, including penetration testing [S10]
- Sccs governing law: courts of Ireland · Irish law [S8]
- Sccs UK: UK SCCs / UK Addendum [S8]
- Security controls: Infrastructure security: 3 listed + 15 more controls [S10]
- SOC 2: yes [S7]
- SOC 2: yes [S6]
- SOC 2: yes [S10]
- SOC 2 GDPR: SOC 2 · GDPR [S1]
- SOC 2 type2: SOC 2 Type II · yes [S11]
- SSO: no · no · add-on · Included [S5]
- Transfer mechanisms: yes · yes · yes [S11]
- UK swiss transfers: UK Addendum · EU SCCs with DPA modifications [S11]

**Data**
- Backup retention: 7 · yes [S10]
- Backup retention: 7 [S11]
- Breach assistance: yes [S8]
- Breach notification: without undue delay [S8]
- Deletion after termination: 90 [S11]
- Dnt: yes [S7]
- Encryption at rest: yes · yes [S10]
- Encryption in transit: 1.3 [S10]
- Export deletion product: yes · yes [S8]
- Opt out marketing: yes [S7]
- Payment card storage: no [S7]
- Retention: as long as necessary for stated purposes [S7]
- Retention deletion: yes · yes · yes [S10]
- Retention deletion period: 90 [S8]
- Retention saas plans: 30 · yes [S11]
- Return or delete: yes [S8]
- Subject request forwarding: yes [S8]
- Transfer US: United States [S7]

**Hosting**
- Data location: FAQ addresses data storage location and EU sending region / EEA residency [S10]
- Data storage location: United States [S11]
- Primary region: United States [S8]
- Sending region scope: routing/sending only · no [S11]

**Integrations**
- API surface: send · batch send · retrieve sent · list sent · update · cancel · share · attachments · metrics [S12]
- Logo provider: dashboard domain brand logos · Logo.dev [S6]
- Open source: yes [S1]
- Sdks: Node.js · Ruby · Python · PHP · CLI · Go · Rust · Java · Elixir · .NET · REST · SMTP [S1]
- Smtp ports: 25 · 465 · 587 · 2465 · 2587 [S4]
- Webhook signing secret: Webhook signing secrets validate payloads; available on webhook details page and returned by create, retrieve, or list webhook API responses [S15]
- Webhooks: delivered · opened · bounced · clicked · yes [S1]

**Legal**
- Address: 2261 Market Street #5039, San Francisco, CA 94114 [S1]
- Address: 94114 · San Francisco · CA · 2261 Market Street #5039 [S6]
- Address: 2261 Market Street #5039, San Francisco, CA 94114 [S11]
- DPA changes require enterprise: Enterprise Plan only [S11]
- DPA entity: Plus Five Five, Inc. [S8]
- DPA last updated: December 31st, 2025 [S8]
- Entity: Plus Five Five, Inc. [S7]
- Governing law: California [S6]
- Importer address: 2261 Market Street #5039 San Francisco, CA 94114 [S8]
- Last updated: 2026-08-27 [S7]
- Last updated: 2026-08-27 [S6]
- Legal entity: Plus Five Five, Inc. [S6]
- Liability cap: amount_paid_for_products_or_services [S6]
- Minimum age: 18 [S6]

**Pricing**
- Addon dedicated ip: 30 · Scale plan customers exceeding 3,000 emails/day [S5]
- Addon SSO: Scale · Enterprise · 150 [S5]
- Billing cycles: monthly · annual · yes [S6]
- Enterprise plan: 99.99 [S5]
- Fee changes: end_of_current_billing_cycle · yes [S6]
- Free tier: yes · no · yes [S6]
- Free trial: yes · yes [S6]
- Payg automations: 10000 · 0.0015 [S5]
- Payg emails: paid subscriptions · per 1,000 emails over quota [S5]
- Payg inboxes: 3 · 1 [S5]
- Refunds: yes [S6]

**Product**
- Acceptable use policy: resend.com/legal/acceptable-use [S6]
- AI credits: 100 · 5 · 500 · Flexible [S5]
- Automation suppression bounce: Automatic suppression list and bounce details included [S5]
- Bimi: yes [S1]
- Bimi requirement: BIMI [S6]
- Blocklist tracking: yes [S1]
- Broadcast analytics: yes [S1]
- Children policy: 18 [S7]
- Custom domains: 10 · 3 · 1000 · Flexible [S5]
- Daily limit: 100 · No limit [S5]
- Data retention: 30 days · 30 days · 30 days · Flexible [S5]
- Data subject requests: yes · yes [S11]
- Dedicated ips managed: Resend offers fully managed dedicated IPs with automatic warmup, monitoring, and autoscaling [S3]
- Dkim spf: DKIM · SPF [S1]
- Dmarc: yes [S1]
- Dns monitoring: yes [S1]
- Editor: yes [S1]
- Encryption: yes · HTTPS/TLS [S8]
- Features: Automations · Audiences · Broadcasts · Inbound · Templates · Webhooks · Dedicated IPs [S10]
- Features list: Automations · Audiences · Broadcasts · Inbound · Templates · Webhooks · Dedicated IPs [S5]
- Features listed: Automations · Audiences · Broadcasts · Inbound · Templates · Webhooks · Dedicated IPs [S6]
- Feedback license: exclusive, perpetual, irrevocable [S6]
- Inbox emails quota: Inbox emails count against transactional quota on all plans [S5]
- Inboxes limits: 3 · 3 · 3 · 1 [S5]
- Integration categories: Coding agents · AI · No-code · Notifications · Content Management Systems · Developer tools · Build your own integration [S17]
- Limit types: rate limits, email quotas, contact quotas [S13]
- Logo permission: yes [S6]
- Managed dedicated ips: yes [S1]
- Mcp server coding agents: yes [S17]
- Modules: Automations · Audiences · Broadcasts · Inbound · Templates · Webhooks · Dedicated IPs [S1]
- Multi region: yes [S5]
- Multi region sending: North American · South American · European · Asian [S1]
- Pen testing: annual [S8]
- Positioning: Email platform for developers delivering transactional and marketing emails at scale [S1]
- Rate limit headers: ratelimit-limit · ratelimit-remaining · ratelimit-reset · retry-after · IETF draft sixth standard [S13]
- React email: react-email open source component library [S1]
- Send email max recipients: 50 [S12]
- Sending features: Sending & receiving features listed for all plans: Inbound emails, RESTful API, SMTP relay, Official SDKs, Schedule emails, Batch sending, Open tracking, Link tracking, React Email [S5]
- Suppression list: yes [S1]
- Termination rights: immediate, sole discretion, any reason [S6]
- Test mode: yes [S1]
- Tracking: optional [S8]
- Webhook automatic retries: yes [S14]
- Webhook disabled endpoint delivery: Delivery attempts stop when endpoint is removed or disabled [S14]
- Webhook endpoints: 5 · 1 · 10 · Flexible [S5]
- Webhook retry schedule: immediately · 5 seconds · 5 minutes · 30 minutes · 2 hours · 5 hours · 10 hours · 10 hours [S14]
- Webhooks realtime: Receive real-time notifications about your emails by listening to granular events [S2]

**Subprocessors**
- Anthropic usage: Anthropic · AI Editor / AI Support Agent only [S11]
- Change notice: 14 [S11]
- Change notice: 14 [S8]
- Last update: 2026-08-27 [S9]
- List: Amazon Web Services, Inc. (USA): Third party hosting and sending provider; Anthropic, PBC (USA): Artificial Intelligence; Attio Limited (USA): Customer relationship management; Cloudflare, Inc. (USA): Web application firewall; Datadog, Inc… [S9]
- List page: yes [S7]
- List URL: https://resend.com/legal/subprocessors [S8]
- No training on customer content: no [S11]
- Objection: yes [S8]
- Payments: Stripe [S7]
- Resend liability: yes [S11]
- Runpod usage: RunPod · trust and safety sampling [S11]

1 more fact on the canonical page: https://whats-best.ai/software/transactional-email/resend

## Questions

### Is Resend European?

No. whats-best.ai classifies Resend as Rest of world.

### Where does Resend store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

### Does Resend have a free plan?

Yes. Resend has a free plan, per [the vendor’s page captured 1 Nov 2026](https://whats-best.ai/evidence/14329).

### What are the best alternatives to Resend?

As of 2 Nov 2026, the panel rates [Lettermint (3.5/5)](https://whats-best.ai/software/transactional-email/lettermint), [Bird Email API (formerly SparkPost) (3/5)](https://whats-best.ai/software/transactional-email/bird-email-api) and [Postmark (3/5)](https://whats-best.ai/software/transactional-email/postmark) highest among the other 15 Transactional Email products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Lettermint](https://whats-best.ai/software/transactional-email/lettermint) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Resend alternatives](https://whats-best.ai/software/transactional-email/resend/alternatives).

## What this page leaves out

- 61 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 8 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://resend.com/ (checked 2026-11-01)
- [S2] Features page (webhooks): https://resend.com/features/webhooks (checked 2026-11-01)
- [S3] Features page (dedicated IPs): https://resend.com/features/dedicated-ips (checked 2026-11-01)
- [S4] Documentation (SMTP relay): https://resend.com/docs/send-with-smtp (checked 2026-11-01)
- [S5] Pricing page: https://resend.com/pricing (checked 2026-11-01)
- [S6] Terms of service: https://resend.com/legal/terms-of-service (checked 2026-11-01)
- [S7] Privacy policy: https://resend.com/legal/privacy-policy (checked 2026-11-01)
- [S8] Data processing agreement (dpa): https://resend.com/legal/dpa (checked 2026-11-01)
- [S9] Subprocessor list: https://resend.com/legal/subprocessors (checked 2026-11-01)
- [S10] Security / trust page: https://resend.com/security (checked 2026-11-01)
- [S11] Security / trust page (GDPR): https://resend.com/security/gdpr (checked 2026-11-01)
- [S12] Sending API, SMTP & developer experience — found from sitemap: https://resend.com/docs/api-reference/emails/send-email (checked 2026-11-01)
- [S13] Sending API, SMTP & developer experience — found from sitemap: https://resend.com/docs/api-reference/rate-limit (checked 2026-11-01)
- [S14] Message logs, events & webhooks — found from sitemap: https://resend.com/docs/webhooks/retries-and-replays (checked 2026-11-01)
- [S15] Message logs, events & webhooks — found from sitemap: https://resend.com/docs/webhooks/verify-webhooks-requests (checked 2026-11-01)
- [S16] Message data, retention & security — found from sitemap: https://resend.com/security/responsible-disclosure (checked 2026-11-01)
- [S17] Reliability, accounts & support — found from sitemap: https://resend.com/docs/integrations (checked 2026-11-01)
- [S18] Code repository (open-source licence) — found from the homepage: https://github.com/resend/resend-node-example (checked 2026-11-01)

---

Cite as: whats-best.ai, "Resend — Transactional Email", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/transactional-email/resend

Corrections: https://whats-best.ai/correct/1279?target=page