Mailjet
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Paris-founded transactional and marketing email API, ISO 27001-certified, EU-only data centres, owned by Sweden-listed Sinch.
Mailjet offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Email marketing.
Assessment notes
French SAS with EU-only data-centre claim, ISO 27001 (BSI), public DPA via parent Sinch (Sweden) and SCC-based transfers; the Sinch sub-processor list (verified 2026-06) shows Mailjet hosts on Google Cloud (a US-owned hyperscaler) alongside Atlassian, Zendesk, Stripe and Mailgun; a US-owned hyperscaler as the core host raises CLOUD Act exposure to material despite the EU data region and a public DPA.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 6 · 5 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Mailjet
Mailjet is a Paris-founded email-delivery platform offering transactional and marketing email APIs, drag-and-drop newsletter design, segmentation, and a real-time collaboration editor. Founded in 2010 and acquired by Pathwire in 2019, Mailjet has been part of Sinch AB (publicly listed on Nasdaq Stockholm, Sweden) since 2021 and is now branded "Sinch Mailjet", though it retains its Paris team and product identity.
Mailjet was the first email service provider to obtain ISO 27001 certification (BSI, 2017) and AFAQ certification from AFNOR for GDPR adherence. The security page now names both the provider and the sites: customer data is stored "with Google Cloud Platform in Frankfurt (Germany) and Saint-Ghislain (Belgium)", with daily encrypted backups in geographically separated EU environments, and Sinch's own sub-processor page corroborates it by listing Google Cloud France SARL with data centres in Germany and Belgium for EU customers. The contracting entity remains French, but no customer data centre sits in France, and Google Cloud is US-owned, so the at-rest custodian is a US-owned hyperscaler inside an EU region: Material. Additional certifications/attestations referenced include SOC 2, PCI DSS, CSA STAR Level 1, HIPAA, and Certified Senders Alliance (CSA member since 2014). The Data Processing Agreement is published publicly on the parent Sinch domain and uses Standard Contractual Clauses for transatlantic transfers; the sub-processors page on the same domain resolves as well and carries six Mailjet-scoped rows, four of them US-owned, with Mailgun sitting in the intra-Sinch support and managed-services path rather than in the customer-sending backbone.
Pricing starts at US$9/month (Starter, 8,000 emails), roughly €8, with a free tier of 6,000 emails/month capped at 200/day. The affiliate program pays a relatively modest 15% per lead with a 30-day cookie, paid monthly via PayPal or bank transfer. Best fit: developer teams and marketers wanting a credible French email-API with ISO 27001 and an EU-only data-residency story, who can accept a Swedish-listed parent with global operations. Procurement decisions in regulated industries should weigh the Google Cloud dependency, which the vendor now names openly, against the EU-only residency commitment.
Sub-processor map · 6
-
Atlassian Corporation USUnited States
Support ticket tracking, incident management
-
Google Cloud France SARL USFrance
Cloud datacenters (hosting/infrastructure)
-
Mailgun Technologies, Inc. USUnited States
Intra-Sinch email support / managed services
-
Stripe Payments Europe, Limited USIreland
Billing and payment systems
-
Zendesk, Inc. USUnited States
Customer support platform
-
Mailjet SAS EUFrance
Customer support, deployment, managed services (Sinch group)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Atlassian Corporation | United States | Support ticket tracking, incident management | US |
| Google Cloud France SARL | France | Cloud datacenters (hosting/infrastructure) | US |
| Mailgun Technologies, Inc. | United States | Intra-Sinch email support / managed services | US |
| Stripe Payments Europe, Limited | Ireland | Billing and payment systems | US |
| Zendesk, Inc. | United States | Customer support platform | US |
| Mailjet SAS | France | Customer support, deployment, managed services (Sinch group) | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Mailjet
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
France · €8/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €15/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
United Kingdom · €0/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Brevo
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€8/mo |
CleverReach
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€15/mo |
EmailOctopus
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€0/mo |