{
  "slug": "mailchimp-transactional",
  "category": "email-sending",
  "name": "Mailchimp Transactional",
  "description": "Transactional email API and SMTP relay from Mailchimp, formerly Mandrill, sold as an add-on to Mailchimp plans.",
  "website": "https://mailchimp.com/features/transactional-email/",
  "license": null,
  "platforms": [],
  "jurisdiction": {
    "code": "US",
    "name": "United States",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "provider"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "F",
  "score": 33,
  "coverage": 92,
  "summary": "Mailchimp Transactional scores 33 out of 100 (grade F) on the email sending services criteria. It meets 1 of 12 criteria: TLS configuration. It partly meets no ads or data sales, independent audit, transparency report, tells users about requests, message content deleted after delivery and open and click tracking off by default. It does not meet open source, no trackers or telemetry, security headers and EU data location. Still needing evidence: encrypted delivery can be enforced. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade C+.",
  "url": "https://privacyratings.com/email-sending/mailchimp-transactional/",
  "markdown": "https://privacyratings.com/email-sending/mailchimp-transactional/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "no",
      "evidence": null,
      "note": "Closed source."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "no",
      "evidence": "https://www.intuit.com/privacy/statement/",
      "note": "The Intuit privacy statement covers advertising cookies, pixels and session-replay tools, and the website loads Google Tag Manager."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://www.intuit.com/privacy/statement/",
      "note": "Funded by subscriptions and states data is not sold, but personal information is shared with advertising networks for targeted ads unless users opt out."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://mailchimp.com/about/security/",
      "note": "SOC 2 and ISO 27001 audits are done, but the reports are only available through the Intuit compliance portal."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://mailchimp.com/legal/service-of-legal-process/",
      "note": "Publishes how it accepts legal process from governments, but no request counts."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "partial",
      "evidence": "https://mailchimp.com/legal/service-of-legal-process/",
      "note": "Mailchimp reserves the right to notify customers of legal process, and some customer agreements require notice unless prohibited."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.ssllabs.com/ssltest/analyze.html?d=mandrillapp.com&hideResults=on",
      "note": "Grade A+"
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "no",
      "evidence": "https://developer.mozilla.org/en-US/observatory/analyze?host=mandrillapp.com",
      "note": "Grade C+ (60/100+)"
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "pending",
      "evidence": null,
      "note": "Not tested yet."
    },
    "content_retention": {
      "title": "Message content deleted after delivery",
      "weight": 3,
      "answer": "partial",
      "evidence": "https://mailchimp.com/developer/transactional/docs/activity-reports/",
      "note": "A copy of the HTML and text parts of each sent email is kept for 30 days."
    },
    "tracking_off_by_default": {
      "title": "Open and click tracking off by default",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://mailchimp.com/developer/transactional/docs/activity-reports/",
      "note": "Click tracking is on by default for HTML and text email. Open and click tracking can be turned off in account settings or for each message."
    },
    "enforced_tls": {
      "title": "Encrypted delivery can be enforced",
      "weight": 2,
      "answer": "unknown",
      "evidence": null,
      "note": null
    },
    "eu_data_location": {
      "title": "EU data location",
      "weight": 1,
      "answer": "no",
      "evidence": "https://mailchimp.com/help/mailchimp-european-data-transfers/",
      "note": "Servers are located in the United States. No EU storage option is offered."
    }
  },
  "tests": {
    "ssllabs": "A+",
    "observatory": "C+",
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": [
      {
        "name": "OneTrust",
        "host": "cdn.cookielaw.org",
        "effect": "none"
      },
      {
        "name": "Optimizely",
        "host": "cdn.optimizely.com",
        "effect": "no"
      }
    ],
    "tested_at": "2026-10-01T07:29:16.374Z"
  },
  "last_modified": "2026-10-01T07:44:20Z"
}