By Theo Brandt ยท Updated
SaaS security guideEmail Platform Security: 14 Platforms Compared (2026)
A security page is a claim. This guide separates what each vendor writes down from what you still have to test yourself.
Picking an email platform means deciding where customer addresses, product events, message content and unsubscribe records will live. The shortlist below comes from reading each vendor's security, trust or compliance page on 7 October 2026 and quoting only what the page says. Where a page was missing or silent, the entry says so instead of guessing, and the gap becomes a question for the vendor's sales or support team.
Prices checked 7 October 2026; each price links to the vendor page it came from. None of this is legal advice: a certificate on a vendor page tells you the vendor is audited, not that your workspace, roles and integrations are configured safely.
The short answer
Best documented for lifecycle email: Customer.io. Its security page states SOC 2 Type II, ISO 27001, two-factor authentication, single sign-on, role-based permissions, a choice of US or EU data centers when you create the account, and a DPA on its legal page. Essentials starts at $100 a month at 5,000 profiles on its pricing page.
Best for isolating service mail: Postmark. Its message streams page says transactional and broadcast traffic run on separate infrastructure, including IP ranges. Basic is $15 a month at 10,000 emails.
Best developer-first option with an audit report: Resend. Resend's security page says it holds SOC 2 Type II and signs its DPA in advance, but data is stored in the United States and it is not HIPAA compliant.
What counts as evidence here
Most security pages blend three different things: audits (SOC 2, ISO 27001), product controls (single sign-on, MFA, roles, API key scopes) and legal paper (DPA, subprocessor list, data region). They matter for different reasons. An audit tells your security reviewer the vendor runs a managed program. A product control is what your own admins use every day. Legal paper is what your data protection officer needs before a single EU address is imported.
For each platform below, the entry lists which of those three the vendor's own page states, which it does not, and the price at which the entry plan starts. A missing statement is not proof the control does not exist; it is a reason to ask in writing before you sign.
Two outside rules shape the sending side. Google's sender guidelines require SPF, DKIM and DMARC for anyone sending more than 5,000 messages a day to Gmail, and Yahoo's sender requirements ask bulk senders for the same plus a working list-unsubscribe header. Every platform here supports authenticating your domain; the question is who in your team owns the DNS records.
| # | Platform | Best for | Stated on its own pages | Entry price |
|---|---|---|---|---|
| 1 | Customer.io | Event-driven lifecycle teams | SOC 2 Type II, ISO 27001, SSO, MFA, roles, US/EU data centers | $100/mo at 5,000 profiles |
| 2 | Postmark | Isolated transactional mail | Separate transactional and broadcast infrastructure, per-server permissions, 2FA | $15/mo at 10,000 emails |
| 3 | Resend | Developer-owned sending | SOC 2 Type II, pre-signed DPA, AES-256 at rest, US storage | Free 3,000 emails/mo; Pro $20 at 50,000 |
| 4 | Klaviyo | Behavior-rich segments | SOC 2 and ISO 27001 audits, SSO with JIT provisioning, scoped API keys | $20/mo at 500 profiles |
| 5 | HubSpot | CRM-owned programs | SOC 2 Type II, EU Cloud Code of Conduct, EU data center | Starter $7/mo; Professional $800/mo |
| 6 | ActiveCampaign | Sales-assisted nurture | SSO via identity provider, MFA on every account, SOC 2 report in its Trust Center | Starter $15/mo at 1,000 contacts |
| 7 | Mailgun | Engineering-run delivery | SOC 2 Type II, ISO 27001, AES-256 at rest, SAML listed | Basic $15/mo at 10,000 emails |
| 8 | Braze | Large multichannel programs | Sold by quote; ask for the security packet | Pricing on request (quote-based) |
| 9 | Userlist | B2B account-level lifecycle | No security page found to quote | Basic $149/mo up to 10,000 users |
| 10 | Loops | Small product-led teams | No security page found to quote | $99/mo at 10,000 subscribers |
| 11 | SendGrid | API plus marketing under one vendor | SPF, DKIM, DMARC and TLS named; dedicated IPs on higher tiers | Essentials from $19.95/mo |
| 12 | Amazon SES | AWS-native infrastructure | Dedicated IP pools, configuration sets, global suppression list | $0.16 per 1,000 emails (Essentials) |
| 13 | Brevo | Small teams on one workspace | Security page text did not load for us; ask for specifics | Starter $9/mo; Standard $18/mo |
| 14 | Gorgias | Support desks, not lifecycle | SOC 2 Type II, SSO for Google and Microsoft 365, per-agent roles | See its pricing page |
Option 1 of 14
1. Customer.io
Best for: lifecycle teams that need a vendor security page their reviewer can read in one sitting. Customer.io's security page says the platform is "SOC 2 Type II certified" and "ISO 27001 certified", lists two-factor authentication, single sign-on and role-based permissions, and says data is encrypted over HTTPS in transit and with Cloud KMS at rest. You pick the US or EU data center when you create the account, and regional API keys steer your data there.
Its GDPR section names rectification, the right to be forgotten and an audit trail, and the DPA is available from its legal page. What the page does not do is describe a separate audit-log feature or list subprocessors, so ask for both. The same page says HIPAA is covered, while the pricing page ties HIPAA to the Premium plan, which starts at $1,000 a month billed yearly. Essentials is $100 a month at 5,000 profiles and $235 at 20,000, so the controls most reviewers want sit in the cheaper plan, and the HIPAA question is where the price jumps.
Option 2 of 14
2. Postmark
Best for: keeping receipts, resets and invoices away from anything promotional. Postmark's message streams page says "transactional and broadcast traffic never intersect in Postmark, including IP ranges", and a server can hold up to 10 streams. Broadcast mail needs an opt-out link and new accounts need approval before sending it, which is a small guardrail against a team blasting a list from the wrong stream.
Its security page describes per-server user permissions with observer roles that cannot edit or delete a server, two-factor authentication through an authenticator app or SMS, and TLS on the SMTP and API endpoints. It does not mention SOC 2 for Postmark itself (the only audit wording is a SOC 1 accredited hosting facility), SSO or a DPA, so a regulated buyer should ask for those directly. Basic is $15 a month at 10,000 emails and $55 at 50,000 on the pricing page.
Option 3 of 14
3. Resend
Best for: developer teams that want an audit report and a pre-signed DPA without a sales call. Resend's security page says "Resend is SOC 2 Type II compliant", names Vanta and Advantage Partners as the auditors, and adds that it holds no ISO 27001 certificate. Data is encrypted with AES-256 at rest and over TLS in transit, and the page says "The DPA is pre-signed by Resend and fully executed once you sign up."
The limits are worth reading before you commit. Stored data is held in the United States, the page says Resend is not HIPAA compliant and cannot sign a BAA, and email and log data is kept for 30 days on Free, Pro and Scale. It says nothing about customer-facing SSO or API key scopes. Resend is also no longer sending-only: its pricing page has a Marketing tab with a free plan at 1,000 contacts and automations, so the same account can hold a broader data footprint than an API-only setup. Pro is $20 a month at 50,000 emails and $35 at 100,000 on its pricing page.
Option 4 of 14
4. Klaviyo
Best for: teams with rich behavioral data who want SSO and scoped keys on the vendor's own list of features. Klaviyo's trust page mentions annual third-party audits covering SOC 2 and ISO 27001 with reports in a self-service Trust Center, single sign-on with just-in-time provisioning for owners and admins, multi-factor authentication, role-based permissions, and API keys and OAuth with feature-specific permission scopes.
The page describes Klaviyo as a data processor and points to a Data Processing Agreement in its Legal Hub. It does not state encryption at rest for customer data or a data region, so those go on your question list. Because Klaviyo is built around profiles and events, the practical risk is not the vendor's controls but how much you load into profiles: every extra property is another thing to export and delete on request. The free plan covers up to 250 active profiles and 500 sends a month, and the Email plan starts at $20 a month at 500 profiles on Klaviyo's pricing page.
Option 5 of 14
5. HubSpot
Best for: programs owned by marketing and sales together, where CRM permissions already govern who sees what. HubSpot's Trust Center shows SOC 2 Type II, SOC 1 Type II and SOC 3 badges, says it is certified by the EU Cloud Code of Conduct for GDPR, offers a Transfer Impact Assessment, and mentions annual third-party penetration tests and a bug bounty program. It says an EU data center launched in 2021 and refers to further regional data centers without listing them on the page.
The index page does not show an ISO certificate, encryption detail, SSO support or a DPA, though it links a subprocessor list and says super admins can restrict the permitted login methods. Pricing is where HubSpot catches teams out: the marketing pricing page lists Starter at $7, Professional at $800 and Enterprise at $3,600 a month, billed annually, and the controls a security review asks for usually sit above Starter. Model the hub and seat bundle you need, not the headline price.
Option 6 of 14
6. ActiveCampaign
Best for: a small operations team running nurture that hands off to sales. ActiveCampaign's security page says users can log in through an identity provider, that multi-factor authentication using SMS and TOTP is available to every account, and that its architecture is single-tenant. Idle sessions can be logged out after a set period, and it points to a Trust Center with a penetration test attestation and its latest SOC 2 report.
Read the wording on compliance carefully: the page says the company is "heavily focused on GDPR, SOC 2, and HIPAA compliance", which is not the same as stating a certificate, so get the report from the Trust Center. The page gives no encryption statement, data location or DPA, and nothing on customer-facing roles inside an account. Contact tags and CRM sync can copy personal data into more places than people expect. Starter is listed at $15 a month at 1,000 contacts on ActiveCampaign's pricing page, with Plus at $49, Pro at $79 and Enterprise at $145.
Option 7 of 14
7. Mailgun
Best for: engineering teams that run delivery themselves and want certificates on paper. Mailgun's security page states "SOC 2 Type II and ISO/IEC 27001 Certified", GDPR compliance, AES-256 encryption at rest for customer data, TLS and HTTPS in transit, two-factor authentication and SAML authentication through an enterprise page. Internally it describes least-privilege access and 365-day retention of critical security logs.
It does not say where data is stored, whether an EU region exists, or how API keys are scoped, and the DPA link in the footer goes to a Sinch legal page, so confirm which legal entity signs. Mailgun is a sending service, not a preference center: consent records, suppression logic and campaign approvals live in your own code. The free plan allows 100 emails a day, Basic is $15 a month for 10,000 emails, Foundation is $35 for 50,000 and Scale is $90 for 100,000 on Mailgun's pricing page.
Option 8 of 14
8. Braze
Best for: large companies running email, push and in-app messaging together with a dedicated vendor-risk process. Braze's pricing page shows editions called Go, Select, Pro and Enterprise, billed on monthly active users plus usage credits, with no public price. The security page at the address we tried returned a not-found error on 7 October, so this entry quotes no Braze security claims.
With a quote-based vendor the security review runs through procurement: ask for the current security packet, the list of data regions, the subprocessor list, the SSO and role model for your edition, and which of those sit behind the Pro or Enterprise tier. Each added channel means another processor in the chain, such as push gateways and SMS carriers, so the review should cover those too. If you are weighing Braze against a lighter lifecycle tool, Customer.io vs Braze covers the product differences.
Option 9 of 14
9. Userlist
Best for: B2B SaaS where lifecycle logic runs on companies as well as people. Its security page returned a not-found error at the usual address on 7 October, so no Userlist security claim is quoted here. What the vendor does publish is pricing: Userlist's pricing page lists Basic at $149 a month for up to 10,000 users and Professional at $349, with $10 and $12 per extra 1,000 users.
Because the account model is the product, the questions to put in writing are about identity: what happens to a person who belongs to two companies, how a deletion request removes a user from every company record, which API keys can read company data, and who at Userlist can view your workspace. Ask for the DPA and the subprocessor list at the same time. A team of three people who each hold a full-access key is a bigger exposure than any missing badge, so scope and rotate keys whichever vendor you choose.
Option 10 of 14
10. Loops
Best for: small product-led teams that want the fewest places to administer. Its security page returned a not-found error at the usual address on 7 October, so nothing about Loops certifications or data regions is stated here. On pricing, Loops offers a free plan with unlimited contacts but 4,000 sends in any rolling 30 days to the 1,000 newest contacts, and paid plans scale by subscribers: $99 a month at 10,000 and $249 at 50,000, with no seat fee.
A simple interface says nothing about controls behind it. Before moving subscribers, ask whether the team can restrict who edits workflows, whether API keys can be rotated without downtime, what the vendor signs as a DPA, and where the data sits. The free plan also adds a "Powered by Loops" footer, which is not a security matter but is a reason some teams skip it for customer mail. Since there is no seat charge, the cost to give every editor their own login is zero, so use separate accounts and never share one.
Option 11 of 14
11. SendGrid
Best for: teams that already use Twilio and want API sending and marketing campaigns billed together. SendGrid's email API page lists SPF, DKIM, DMARC and TLS under protections and says higher tiers add dedicated IPs. That page does not mention subusers, API key permissions, two-factor authentication or SSO, and Twilio's security page returned a not-found error at the address we tried, so confirm each of those in the SendGrid documentation.
The breadth is the hazard: API volume and Marketing Campaigns are separate products with separate prices. Email API Essentials starts at $19.95 a month and Pro at $89.95, while Marketing Campaigns is free up to 2,000 contacts and 6,000 emails, then $15 for Basic and $60 for Advanced, per Twilio's pricing page. Decide up front which sender identities, keys and sub-accounts belong to which workload, and keep the marketing keys unable to send transactional mail.
Option 12 of 14
12. Amazon SES
Best for: teams that already run production on AWS and want sending to follow the same account structure. The SES FAQ describes dedicated IP pools, says a configuration set can be linked to a pool so that "those emails are only sent from the IP addresses in the associated pool", and explains that a global suppression list treats listed addresses as hard bounces that still count toward your quota and bounce rate.
SES is infrastructure, not a program: there is no template approval flow, preference center or editor roles unless you build them or buy a layer on top. Access is whatever you configure in your AWS account, which is a strength for a team with strong cloud practice and a weakness for one without it. The SES pricing page lists $0.16 per 1,000 emails on the Essentials tier, but that figure leaves out engineering time and the services you add around it.
Option 13 of 14
13. Brevo
Best for: small teams that want campaigns, SMTP and basic automation inside one workspace. Brevo's data security and privacy page loaded with only its title when we read it on 7 October, so no Brevo certification or hosting claim is made here. Ask in writing for ISO and SOC status, the hosting location of your data, user roles and how API keys are managed.
The pricing structure matters for security because the cheapest plans may not include everything a reviewer asks for. Brevo's pricing page shows a free plan with 300 sends a day, Starter from $9 a month and Standard from $18, and the Professional plan is listed from $499. Because one workspace can hold campaigns, transactional SMTP and contacts, set up separate API keys and separate sender domains for each use before the first import.
Option 14 of 14
14. Gorgias
Best for: support teams that need a helpdesk with agent roles, not a lifecycle sender. Gorgias's security page lists SOC 2 Type II and HIPAA reports on request, HTTPS-only app traffic, continuous encrypted backups, two-factor authentication, single sign-on for Google and Microsoft 365, and per-agent roles and permissions. It does not mention GDPR or a DPA on that page, and it runs on Google Cloud Platform without naming a region.
It sits last because it answers a different question. A helpdesk holds customer conversations; it does not decide who receives a trial reminder or an invoice notice, and it should not be the system of record for consent. Use it where your support team already works and keep lifecycle and transactional mail in a tool from the list above. We quote no Gorgias price here, since billing depends on seats and ticket volume that you should read off its pricing page.
Where the security features sit on the price ladder
Controls are often bundled with plan tiers. At Customer.io the step from Essentials at $100 a month (5,000 profiles) to Premium from $1,000 a month billed yearly is a factor of ten, and the pricing page is where HIPAA appears. At HubSpot the jump from Starter at $7 to Professional at $800 a month is about 114 times, which is why a security review on a CRM-led stack should name the exact hub edition. Mailgun's ladder runs $15 for Basic, $35 for Foundation and $90 for Scale, each tied to volume rather than a security tier, so the security page applies across them but SAML lives behind an enterprise page.
Resend is the opposite case: SOC 2 Type II and the pre-signed DPA are stated for the platform in general, and the plans (Free 3,000 emails, Pro $20 at 50,000, Scale $90 at 100,000) differ in volume and retention rather than in who is audited. For vendors without public prices, such as Braze, treat the quote as the place to negotiate the security addendum, regional data terms and incident-notice period together.
Security evidence to request
| Area | Ask for | Question it should answer |
|---|---|---|
| Identity | SSO and MFA settings, roles, API-key scopes, offboarding steps | Can one person lose access without rotating the key every integration shares? |
| Data | Signed DPA, subprocessor list, region options, retention and deletion terms | Can a single subscriber be found and deleted across profiles, events and logs? |
| Sending | Domain authentication steps, suppression behavior, stream or pool separation | If a marketing campaign draws complaints, does a password reset still leave on time? |
| Assurance | SOC 2 report with scope and exceptions, ISO certificate, incident process | Does the audited service match the plan you will actually buy? |
Run a security pilot before you migrate
Choose one workflow that is easy to reverse: a trial-expiry reminder plus a password-reset message, for example. Use synthetic contacts so no real person is affected. Write down the event that triggers the message, the identity key it relies on, the template version and where the data will be retained.
Give the pilot a fixed window of a week. In that time invite an editor without admin rights, rotate an API key and note what stops working, request deletion of one test contact and look for traces in event and message logs, trigger a bounce, and unsubscribe a test address from marketing to confirm that service mail is not blocked. Keep screenshots and the vendor's written answers next to the result. Do not import the full audience until each failed check has an owner and a dated fix.
Pilot acceptance checklist
| Test | Pass condition | Evidence to keep |
|---|---|---|
| Access | Editor can draft and preview; only approved admins change domains, keys or exports | Role matrix and results from a non-admin test login |
| Preference boundary | A marketing unsubscribe does not block critical account mail | Preference events and delivery logs before and after |
| Data lifecycle | Export and deletion work for profile, event and log data | Deletion request and the vendor's written response |
| Incident readiness | Someone is named to receive alerts, pause sends and roll back | Runbook with contacts and one rehearsal |
Verdict: pick by workload, then verify the paper
For lifecycle email with a security reviewer in the room, start with Customer.io: it states the most controls and certificates on its own page, and its US or EU data center choice is stated on the page. For service mail that must never share infrastructure with promotions, choose Postmark, or Amazon SES if your team already runs AWS well. Resend suits developer teams that want an audit report and a pre-signed DPA and can live with US storage and 30-day log retention.
Klaviyo and ActiveCampaign fit when behavioral segmentation or sales follow-up drives the choice, HubSpot when the CRM is the system of record, and Braze when a procurement process will pull a security packet from a quote. Userlist, Loops and Brevo may be perfectly sound, but this guide could not quote a security page for them, so put the DPA, region and role questions to them in writing first. Related reading: the platform selection guide, the transactional versus marketing guide, the deliverability guide, and the lists of secure SaaS platforms and enterprise SaaS platforms.
Frequently asked questions
Which email platform has the most security evidence on its own pages?
For lifecycle email, Customer.io states the most in one place: SOC 2 Type II, ISO 27001, two-factor authentication, single sign-on, role-based permissions, US and EU data centers and a downloadable DPA. Mailgun and Klaviyo also name SOC 2 and ISO 27001 audits. Postmark and Resend are narrower products, so judge them on stream separation and the DPA rather than on a long certificate list.
Does SOC 2 mean my customer data is safe in that tool?
No. A SOC 2 Type II report says an auditor tested the vendor's controls over a period. It does not cover how you configure roles, who holds your API keys, or what personal data you push into events. Ask for the report, read its scope and exceptions, and then run your own access and deletion tests as described in the pilot section.
Do I need a DPA with an email platform?
If you send to people in the EU or UK, yes: the platform is a processor of their data and you need a signed data processing agreement. Resend says its DPA is pre-signed and executed when you sign up, and Customer.io points to a DPA on its legal page. For HubSpot, Klaviyo and ActiveCampaign, find the DPA in the legal or trust area before you import contacts.
Which tools can keep transactional and marketing mail on separate infrastructure?
Postmark is the clearest case: its message streams page says transactional and broadcast traffic never intersect, including IP ranges. Amazon SES can pin configuration sets to dedicated IP pools. SendGrid and Mailgun can also split workloads across domains and accounts, but you design that split yourself.
What should I test in a trial before moving real subscribers?
Use synthetic contacts. Invite a non-admin editor and confirm they cannot change domains or keys, rotate an API key and see what breaks, delete a test contact and look for it in event logs, and unsubscribe a test address from marketing mail to confirm a password reset still arrives. Do this in a trial or separate test workspace, never in the account that holds real subscribers.