Skip to content
CLOUD Act flagged on every listing
EU VETTED

EmailOctopus

VERIFIED
Email marketing · United Kingdom
Founded 2014 · emailoctopus.com ↗

London-based low-cost email marketing (Three Hearts Digital, 2014), generous free tier, indie-friendly, campaign sending via Bird's EU infrastructure.

In short

EmailOctopus, in the Email marketing category, offers EU hosting with Ireland as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.

Assessment notes

Three Hearts Digital Ltd (London, 86-90 Paul Street, EC2A 4NE) operates EmailOctopus as a low-cost subscriber-based email marketing service with a generous free tier: GDPR-compliant, indie-friendly, and competitively priced ($480/year at 100k subscribers), and it does publish a named sub-processor list and a DPA. But it is UK-incorporated post-Brexit, holds no public certifications (ISO 27001 / SOC 2), and its own list states that all of its infrastructure runs on AWS virtual servers, in the EU Ireland region, with customer data stored there. UK-incorporated (adequacy-covered) with material CLOUD Act exposure because a US-owned hyperscaler is the entire infrastructure and the store of record.

CLOUD ACT
Ownership
Sub-procs
not disclosed
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
Jump to
Overview

About EmailOctopus

EmailOctopus is the low-cost email-marketing service operated by Three Hearts Digital Ltd at 86-90 Paul Street, London EC2A 4NE, United Kingdom. The product targets indie creators, bloggers, small SMBs, and price-sensitive marketers who want a Mailchimp / MailerLite / ConvertKit alternative with a particularly generous free tier (free up to a meaningful subscriber count) and competitive paid pricing, for example approximately $480/year at 100,000 subscribers. The brand is well-known in the indie-hacker and content-creator community.

For an EU-sovereignty audit the listing has structural caveats. The operating entity is UK-incorporated post-Brexit (UK adequacy decision under Art. 45 GDPR keeps transfers EU↔UK legally clean), and the sending path is now documented rather than assumed. The published sub-processor list names Bird and its EU-based infrastructure for campaign sending on the regular EmailOctopus service; Amazon SES survives only inside EmailOctopus Connect, the bring-your-own-sending-account product, so SES is no longer the customer-campaign backbone. The US exposure is the infrastructure underneath instead: the same list states that all of EmailOctopus's infrastructure runs on AWS virtual servers located within the European Union, in the Ireland region, with customer data stored there, so a US-owned hyperscaler is the store of record even though the region is Irish: Material. There are no public ISO 27001 or SOC 2 certifications, but the DPA is a publicly readable PDF and the sub-processor list is public and reachable without a login.

Pricing is quoted in USD: a Starter tier that is free forever at 2,500 subscribers and 10,000 emails a month with EmailOctopus branding, then Pro from US$9/month on annual billing, a 10% discount against the monthly rate. Best fit: indie creators, low-volume bloggers, small SMBs, and price-sensitive marketers who want a serviceable Mailchimp alternative and accept a UK counter-party with AWS Ireland underneath. Procurement-grade EU buyers who need the infrastructure itself off a US-owned hyperscaler should choose rapidmail (DE) at SMB tier, or Inxmail or Maileon at enterprise.

Sub-processors

Sub-processor map · not disclosed

Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
Certifications

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-08-26).
Features

Capability matrix

Automation Yes
Landing pages Yes
A/B testing No
Transactional email No
SMS marketing No
Built-in CRM No
Dedicated IP No
Free tier Yes
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option No
Pricing

Pricing & tiers

FREEMIUM
from €0/mo
View pricing page ↗
Public documents

Public documents

  • Data Processing Addendum (DPA)
    wordpress-media.emailoctopus.com/blog…
    Open ↗
  • Sub-processors list
    docs.google.com/spreadsheets…
    Open ↗
  • Terms of Service
    emailoctopus.com/legal…
    Open ↗
Alternatives

Alternatives in this category

Brevo
France · Founded 2012
EU-HOSTED

Paris-headquartered multi-channel customer-engagement platform with email, SMS, CRM, automation, ISO 27001 and a public DPA.

Public DPA Sub-processors Open source
FROM
€8/mo
CLOUD ACT
MATERIAL
CleverReach
Germany · Founded 2007
EU-HOSTED

German email marketing platform with EU-only customer data storage in Germany and Ireland and a permanently free Lite tier.

Public DPA Sub-processors Open source
FROM
€15/mo
CLOUD ACT
MATERIAL
GetResponse
Poland · Founded 1998
EU-HOSTED

Gdańsk-headquartered Polish email marketing and automation platform with webinars, landing pages, and a 350k+ customer base.

Public DPA Sub-processors Open source
FROM
€16/mo
CLOUD ACT
MATERIAL