rapidmail
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Freiburg-based German email marketing tool hosting customer data exclusively on German servers, no public-cloud hyperscaler.
rapidmail is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under Email marketing.
Assessment notes
Freiburg-based GmbH (Positive Group) hosting customer email data exclusively on a German data-centre campus in Frankfurt that holds ISO 27001 and PCI-DSS, with explicit avoidance of public hyperscaler clouds for customer data and SCC-protected US transfers limited to marketing-site analytics. EU-owned, EU-hosted on own infrastructure with no US hyperscaler dependency, and the only US transfers are marketing-site analytics that never touch customer mailing data, so under a customer-data-at-rest definition CLOUD Act exposure is none.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 3 · 0 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About rapidmail
rapidmail is a Freiburg-headquartered German email marketing platform operated by Positive Group Deutschland GmbH (Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau; Amtsgericht Freiburg HRB 706983), founded in 2008; rapidmail is the product brand of that GmbH rather than a separate legal entity. The German company sits under the French Positive Group (Hem, France, formerly Sarbacane Software), which acquired rapidmail in 2021, with founder-CEO Mathieu Tarnus as majority shareholder and the French funds IDI and EMZ Partners as minority investors, so the ownership chain is EU end to end with no US investor, but the ultimate parent is French rather than German. It positions itself as a fully GDPR-compliant ESP for SMBs in DACH and is one of the cleanest "Made in Germany" data-residency stories in the email-marketing category: customer email data and subscriber lists are hosted exclusively on servers located within Germany, in data centres described as ISO 27001 and PCI-DSS certified (those certificates belong to the data-centre operator, not to rapidmail itself), and the company explicitly avoids public hyperscaler clouds (no AWS, no GCP, no Azure) for product workloads.
The privacy policy (last updated May 2025) is transparent about marketing-site sub-processors (Google Analytics/Ads/reCAPTCHA, HubSpot, Hotjar, Mixpanel, LinkedIn Insight, Bing Ads, Matomo, Axeptio), but these touch the website and lead funnel rather than customer email data, and any US transfers are covered by Standard Contractual Clauses under Art. 46 GDPR. The AVV names the product-side sub-processors and every one of them is EU-incorporated: uvensys GmbH (Linden, Germany) as the server host, Scoria Labs GmbH (Germany) for CaptchaFox bot protection, optional on subscription forms, and Gleap GmbH (Austria) for customer support and user feedback. The data protection officer is Nils Möllers of Keyed GmbH, a German external DPO firm. Customer satisfaction signals are strong (97% across 2,600+ reviews), and OMR Reviews has ranked rapidmail as a category Leader.
The product is in German and English. Best fit: small and mid-sized German-speaking businesses, associations, and e-commerce shops who want a no-fuss, DSGVO-konformes Newsletter tool with an unambiguous "data stays in Germany" answer for procurement and a German-speaking support team. Limitations to verify before procurement-grade buying: SSO/SAML and audit-log capabilities are not advertised on the public pages reviewed. The AVV itself is a full PDF that downloads from the help centre without a login, but it can only be executed once an account has been activated, so the signed agreement is not fully self-serve.
Sub-processor map · 3
-
Gleap GmbH EUAustria
SaaS for customer support and user-feedback analysis
-
Scoria Labs GmbH EUGermany
Bot and spam protection (CaptchaFox), optional on online subscription forms
-
uvensys GmbH EUGermany
Hosting of the servers at locations within Germany
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Gleap GmbH | Austria | SaaS for customer support and user-feedback analysis | EU |
| Scoria Labs GmbH | Germany | Bot and spam protection (CaptchaFox), optional on online subscription forms | EU |
| uvensys GmbH | Germany | Hosting of the servers at locations within Germany | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of rapidmail
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
France · €8/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €15/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
United Kingdom · €0/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Brevo
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€8/mo |
CleverReach
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€15/mo |
EmailOctopus
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€0/mo |