The state of US exposure in European email marketing, 2026

Of 14 European email marketing tools, 3 are fully clear of US exposure

Email marketing is where "European brand is not the same as leaving US jurisdiction" shows most starkly in our dataset. The category's household names, French, German and Polish companies with genuine EU roots, mostly classify as materially exposed, while the fully clear options are three lower-profile providers that run their own European infrastructure. We checked every tool against its own published sub-processor list, DPA and ownership records, and classified each on our four-level CLOUD Act exposure scale (none, minor, material, direct).

CLOUD Act exposure	Tools
None	3
Minor	5
Material	6
Direct	0
Any exposure	11

Every tool, and where the exposure enters

Tool	Country	Ownership	Hosting	CLOUD Act exposure	Where it enters
rapidmail	Germany	EU-owned	Germany	None	Freiburg GmbH keeping customer email data exclusively on an ISO 27001 German data-centre campus in Frankfurt, with deliberate avoidance of hyperscaler clouds; US transfers are limited to marketing-site analytics off the mailing-data path
Maileon	Germany	EU-owned	Germany	None	XQueue GmbH (Offenbach), ISO 27001 certified, German data centres, twenty years of operating history
Infomaniak Newsletter	Switzerland	Other	Switzerland	None	Product of Infomaniak Group SA (Geneva), founder-led and independent, running on its own Swiss data centres
Inxmail	Germany	EU-owned	Germany	Minor	Freiburg GmbH with EU-only hosting and TÜV-certified ISO 27001; a small US footprint exists for marketing-site analytics, and the DPA is gated to the enterprise contracting flow
Sender	Lithuania	EU-owned	not disclosed	Minor	Lithuanian entity whose public policy names no sub-processors and discloses no hosting region; dedicated DPA and security pages return 404
Make	Norway	Other	Norway	Minor	Norwegian AS storing subscriber data on Norwegian servers, but Intercom (support chat) and Google Workspace (internal documents) sit in the operational chain
Keila	Germany	EU-owned	Germany	Minor	Bootstrapped German open-source platform (AGPLv3) on Hetzner (DE) and Scaleway (FR) with a downloadable DPA; the only US-linked sub-processor is an optional CAPTCHA
MailerLite	Lithuania	EU-owned	Netherlands	Material	EU-owned (Polish parent via Vercom) with EU primary storage, but a US legal entity serves non-EEA customers, US sub-processors include Intercom, Stripe and OpenAI, and no public DPA is surfaced
Brevo	France	EU HQ, US-funded	France	Material	French SAS with a public DPA, but primary at-rest storage runs on Google Cloud (Belgium region) with Cloudflare and OpenAI in the sub-processor annex
Mailjet	France	EU-owned	France	Material	French SAS under Sinch (Sweden) with an EU data region, but the platform hosts on Google Cloud, a US-owned hyperscaler
CleverReach	Germany	EU-owned	Germany	Material	Markets "Email Marketing Made in Germany", yet recipient and subscriber data is processed and stored on Amazon Web Services in EU regions
GetResponse	Poland	EU-owned	EEA (not detailed publicly)	Material	Polish S.A. with EEA-primary processing per its privacy policy, but no publicly accessible DPA and no named sub-processor list, only category descriptions
EmailOctopus	United Kingdom	Other	not disclosed	Material	London company with no public certifications and no disclosed hosting provider; its historical relationship with Amazon SES suggests where the sending runs

The middle of this table is a transparency story as much as a jurisdiction story. Keila, a bootstrapped open-source platform, publishes a downloadable DPA and a named sub-processor list; Sender, with a far larger customer base, publishes neither, and its compliance pages return 404. Where disclosure is missing we classify conservatively, because a chain we cannot read is not a chain we can call clean.

The bottom third is the hyperscaler story. Brevo, Mailjet and CleverReach are exactly the brands a European buyer reaches for when leaving Mailchimp, and all three keep subscriber data at rest on US-owned clouds in EU regions. The EU region answers a latency and data-residency question. It does not answer the jurisdiction question, which follows the hosting provider's parent company rather than the server's postcode.

Our four-level classification records whether customer data could fall under US extraterritorial reach: none (EU/EEA/Swiss operator, no US parent, no notable US sub-processor), minor (a transient US sub-processor such as a CDN, with data at rest staying in the EU), material (a US parent or US-owned hyperscaler in the core data path), and direct (the operator itself is US-incorporated). For email marketing the data path we read is specific: where subscriber lists and campaign data rest, what sends the email, what tracks the opens and clicks, and who owns and finances the operator.

Sources are the vendors' own published documents: sub-processor lists where available, DPA annexes and ownership records, re-checked quarterly. Every figure and verdict on this page renders live from the dataset, so the page updates when a re-verification changes a classification. The cross-category picture is in our CLOUD Act exposure analysis; the same tools compared as Mailchimp replacements are in best European Mailchimp alternatives and on the Mailchimp alternatives page; all listings with per-tool detail are on the email marketing category page.

The figures on this page may be republished with attribution. Cite as "Source: EU Vetted, verified July 2026" and link to this page. Numbers render live from our dataset and change when a quarterly re-verification changes a classification, so the link, not a copied figure, is the durable reference.