Omnivery
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Czech transactional email platform (SMTP relay and API) on its own physical infrastructure, no hyperscaler cloud for core sending.
Omnivery is a European service hosted in Czechia, with at most minor, transient US exposure under the CLOUD Act. It is listed under Email marketing.
Assessment notes
Czech s.r.o. running its core sending stack on its own physical infrastructure with EU-only data at rest (vendor-confirmed 2026-07-17, customer-selectable per-domain residency), a publicly readable Art. 28-compliant DPA with immediate message-content deletion, a public sub-processor list and TAYLLORCOX-issued ISO 27001/27017/27018/27701; the only US touchpoints are a sales-only subsidiary with no data access, marketing-site Google Analytics and an optional email-validation feature that is disabled by default, so exposure is minor rather than material, but the score is held at 4 rather than 5 because the specific EU data-centre country is not publicly named, a US data location is being set up, and the EU-only/opt-in facts rest on vendor statements not yet reflected in public documentation.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 4 · 3 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Omnivery
Omnivery is a transactional email platform (SMTP relay plus REST API) operated by Omnivery s.r.o. in Chrášťany near Prague, Czech Republic. The product is the 2021 relaunch of Mailkit, a Czech email-delivery vendor founded in 2006 by Jakub Olexa (still CEO), and it targets developers and businesses sending transactional and notification email who want an alternative to US-hosted senders such as SendGrid, Mailgun, Postmark, SparkPost and Bird.
Its central differentiator is genuine: unlike most of the category, Omnivery runs its core sending stack on its own physical infrastructure rather than AWS, Azure or Google Cloud, and states it never stores email content. The company holds a stack of ISO certifications issued by the Czech body TAYLLORCOX, including ISO 27001, 27017, 27018 and 27701 (a 7-certificate PDF is published on the site), plus HIPAA readiness and CSA / M3AAWG / Signal Spam memberships. The Data Processing Agreement, privacy policy and sub-processor list are all public and readable without a sales gate, which is a strong transparency signal for the category.
On sovereignty the picture largely holds up, with caveats worth knowing. The vendor confirms (July 2026) that the EU is currently its only data location, that data residency is customer-selectable per sending domain, and that storage can also be on-premise or dedicated to a single customer or domain. The US subsidiary, Omnivery US Inc. (Austin, Texas), is sales-only with no technical access to customer data, and the Google LLC entry in the privacy policy covers Google Analytics on the marketing site rather than the customer data path. The three US-owned sub-processors on the GDPR page (Amazon Web Services, Filestack and Kickbox) serve an optional email-validation feature that is disabled by default and warns before it is enabled, and the vendor says it will move to an EU validation provider. Two things to watch: a US data location is being set up, and the specific EU data-centre country is still not named publicly. Pricing is quote-based with no free tier and no self-serve signup, an intentional anti-abuse measure. Best fit: EU teams that want a non-hyperscaler transactional sender with public compliance docs and can accept enterprise, contact-sales onboarding.
Sub-processor map · 4
-
Amazon Web Services, Inc. USUnited States
E-mail validation (optional feature, disabled by default; processing in Ireland/EU region)
-
Filestack, Inc. USUnited States
E-mail validation (optional feature, disabled by default)
-
J2 Martech Corp DBA Kickbox USUnited States
E-mail validation (optional feature, disabled by default)
-
ProfiSMS s.r.o. EUCzechia
SMS delivery
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services, Inc. | United States | E-mail validation (optional feature, disabled by default; processing in Ireland/EU region) | US |
| Filestack, Inc. | United States | E-mail validation (optional feature, disabled by default) | US |
| J2 Martech Corp DBA Kickbox | United States | E-mail validation (optional feature, disabled by default) | US |
| ProfiSMS s.r.o. | Czechia | SMS delivery | EU |
Source: the vendor’s published sub-processor list, read 17 Jul 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Omnivery
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
France · €8/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €15/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
United Kingdom · €0/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Brevo
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€8/mo |
CleverReach
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€15/mo |
EmailOctopus
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€0/mo |