EmailOctopus
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
London-based low-cost email marketing (Three Hearts Digital, 2014), generous free tier, indie-friendly, campaign sending via Bird's EU infrastructure.
EmailOctopus offers EU hosting in Ireland, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Email marketing.
Assessment notes
Three Hearts Digital Ltd (London, 86-90 Paul Street, EC2A 4NE) operates EmailOctopus as a low-cost subscriber-based email marketing service with a generous free tier: GDPR-compliant, indie-friendly, and competitively priced ($480/year at 100k subscribers), and it does publish a named sub-processor list and a DPA. But it is UK-incorporated post-Brexit, holds no public certifications (ISO 27001 / SOC 2), and its own list states that all of its infrastructure runs on AWS virtual servers, in the EU Ireland region, with customer data stored there. UK-incorporated (adequacy-covered) with material CLOUD Act exposure because a US-owned hyperscaler is the entire infrastructure and the store of record.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About EmailOctopus
EmailOctopus is the low-cost email-marketing service operated by Three Hearts Digital Ltd at 86-90 Paul Street, London EC2A 4NE, United Kingdom. The product targets indie creators, bloggers, small SMBs, and price-sensitive marketers who want a Mailchimp / MailerLite / ConvertKit alternative with a particularly generous free tier (free up to a meaningful subscriber count) and competitive paid pricing, for example approximately $480/year at 100,000 subscribers. The brand is well-known in the indie-hacker and content-creator community.
For an EU-sovereignty audit the listing has structural caveats. The operating entity is UK-incorporated post-Brexit (UK adequacy decision under Art. 45 GDPR keeps transfers EU↔UK legally clean), and the sending path is now documented rather than assumed. The published sub-processor list names Bird and its EU-based infrastructure for campaign sending on the regular EmailOctopus service; Amazon SES survives only inside EmailOctopus Connect, the bring-your-own-sending-account product, so SES is no longer the customer-campaign backbone. The US exposure is the infrastructure underneath instead: the same list states that all of EmailOctopus's infrastructure runs on AWS virtual servers located within the European Union, in the Ireland region, with customer data stored there, so a US-owned hyperscaler is the store of record even though the region is Irish: Material. There are no public ISO 27001 or SOC 2 certifications, but the DPA is a publicly readable PDF and the sub-processor list is public and reachable without a login.
Pricing is quoted in USD: a Starter tier that is free forever at 2,500 subscribers and 10,000 emails a month with EmailOctopus branding, then Pro from US$9/month on annual billing, a 10% discount against the monthly rate. Best fit: indie creators, low-volume bloggers, small SMBs, and price-sensitive marketers who want a serviceable Mailchimp alternative and accept a UK counter-party with AWS Ireland underneath. Procurement-grade EU buyers who need the infrastructure itself off a US-owned hyperscaler should choose rapidmail (DE) at SMB tier, or Inxmail or Maileon at enterprise.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of EmailOctopus
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
France · €8/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €15/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Poland · €16/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Brevo
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€8/mo |
CleverReach
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€15/mo |
GetResponse
Poland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€16/mo |