GDPR checklist for email tools.
Email delivery tools see recipient addresses and often the full message content. Compare 23 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Brevo | Usually a processor | Usually the European Union | Obtained through the vendor |
 Resend | Usually a processor | Set per account or project | Published by the vendor |
 Postmark | Usually a processor | Usually the United States | Published by the vendor |
 SendGrid | Usually a processor | Often the United States, check your account | Published by the vendor |
 Loops | Usually a processor | Set per account or project | Published by the vendor |
 Plunk | Usually a processor | Often the European Union, check your account | Published by the vendor |
 MailerSend | Usually a processor | Often the European Union, check your account | Published by the vendor |
 SMTP2GO | Usually a processor | Set per account or project | Obtained through the vendor |
 Elastic Email | Usually a processor | Set per account or project | Published by the vendor |
 SocketLabs | Usually a processor | Set per account or project | Published by the vendor |
 Fastmail | Usually a processor | Set per account or project | Published by the vendor |
 Hey | Usually a processor | Set per account or project | Published by the vendor |
 Front | Usually a processor | Set per account or project | Published by the vendor |
 Missive | Usually a processor | Set per account or project | Obtained through the vendor |
 Superhuman | Usually a processor | Often the United States, check your account | Published by the vendor |
 ImprovMX | Usually a processor | Set per account or project | Obtained through the vendor |
 ForwardEmail | Usually a processor | Set per account or project | Published by the vendor |
 Knock | Usually a processor | Set per account or project | Published by the vendor |
 Novu | Usually a processor | Set per account or project | Published by the vendor |
 OneSignal | Usually a processor | Set per account or project | Published by the vendor |
 Airship | Usually a processor | Set per account or project | Published by the vendor |
 CleverTap | Usually a processor | Set per account or project | Published by the vendor |
 MoEngage | Usually a processor | Set per account or project | Published by the vendor |
What to check for email tools
- Check the sending region and how message content and logs are retained.
- Avoid putting more personal data in messages than the message needs.
- Make sure bounce and complaint data is handled in line with your retention rules.
- Record the provider as a recipient of customer email addresses.
All email tools
Questions, answered.
What should I check before using an email tool under the GDPR?
Check the sending region and how message content and logs are retained. Avoid putting more personal data in messages than the message needs. Make sure bounce and complaint data is handled in line with your retention rules. Record the provider as a recipient of customer email addresses.
Do I need a data processing agreement with an email provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which email tools does Privacyboard cover?
Brevo, Resend, Postmark, SendGrid, Loops, Plunk, MailerSend, SMTP2GO, Elastic Email, SocketLabs, Fastmail, Hey, Front, Missive, Superhuman, ImprovMX, ForwardEmail, Knock, Novu, OneSignal, Airship, CleverTap, MoEngage. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.