# Brevo privacy rating

Marketing and transactional email platform, formerly Sendinblue, with an SMTP relay, email API, SMS and a CRM. Data is hosted in the EU.

## Summary

Brevo scores 29 out of 100 (grade F) on the email sending services criteria. It meets 2 of 12 criteria: TLS configuration and EU data location. It partly meets no ads or data sales, security headers, message content deleted after delivery and open and click tracking off by default. It does not meet open source and no trackers or telemetry. Still needing evidence: independent audit, transparency report, tells users about requests and encrypted delivery can be enforced. It is based in France: Nine Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.

- Website: https://www.brevo.com
- Jurisdiction: France. Nine Eyes member. EU member (GDPR).
- Home page trackers: Cloudflare Web Analytics (cookieless analytics)
- Category: [Email sending services](https://privacyratings.com/email-sending/)
- Grade: F (29/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The website loads HubSpot and TikTok scripts. |  |
| No ads or data sales | Partial | Funded by paid plans and states personal data is not sold, but offers an opt-out of sharing for targeted advertising, and the website loads a TikTok pixel. | https://www.brevo.com/legal/privacypolicy/ |
| Independent audit | Unknown |  |  |
| Transparency report | Unknown |  |  |
| Tells users about requests | Unknown |  |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=brevo.com&hideResults=on |
| Security headers | Partial | Grade B (70/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=brevo.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Message content deleted after delivery | Partial | Transactional logs and email previews are kept indefinitely by default. Previews can be turned off, and logs can be set to be deleted after 1 to 24 months. | https://help.brevo.com/hc/en-us/articles/4415743225746-Manage-the-retention-period-of-transactional-logs-and-email-previews |
| Open and click tracking off by default | Partial | Opens and clicks are tracked per recipient by default. Tracking can be made anonymous for campaign and transactional mail. | https://help.brevo.com/hc/en-us/articles/11643306229906-Can-I-anonymize-the-tracking-of-opens-and-clicks-for-my-emails |
| Encrypted delivery can be enforced | Unknown |  |  |
| EU data location | Yes | Data is hosted by OVH in France and Germany and on Google Cloud in Belgium. | https://help.brevo.com/hc/en-us/articles/360001005510-Data-storage-location |

Source: https://privacyratings.com/email-sending/brevo/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-sending/brevo.md