Email sending services
Postmark privacy rating
Email API and SMTP service from ActiveCampaign for transactional and broadcast email, with separate message streams and 45 days of message history by default.
Summary
Postmark scores 27 out of 100 (grade F) on the email sending services criteria. It meets 2 of 12 criteria: TLS configuration and open and click tracking off by default. It partly meets message content deleted after delivery and encrypted delivery can be enforced. It does not meet open source, no trackers or telemetry, no ads or data sales, security headers and EU data location. Still needing evidence: independent audit, transparency report and tells users about requests. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade C-.
Score 27 out of 100. How scoring works
Criteria
- No
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The website loads Google Tag Manager and Google Analytics.
-
No
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
The ActiveCampaign privacy policy covers Postmark and discloses personal information to data enrichment providers and shares it with advertising networks for cross-context behavioral advertising.
-
Unknown
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Needs evidence. Add it
-
Unknown
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Needs evidence. Add it
-
Unknown
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
Needs evidence. Add it
-
Partial
Message content deleted after delivery Weight 3 of 3
Is the content of sent mail deleted once it has been delivered?
Message content is kept for 45 days by default and cannot be turned off. A paid add-on sets retention between 7 and 365 days.
-
Yes
Open and click tracking off by default Weight 2 of 3
Are open tracking pixels and click tracking links off unless the sender turns them on?
Link tracking is off by default for all servers and messages, and open tracking is turned on per server or message.
-
Partial
Encrypted delivery can be enforced Weight 2 of 3
Can outbound mail be kept from being delivered without TLS?
Outbound mail uses opportunistic TLS. No setting to require TLS is documented.
-
No
EU data location Weight 1 of 3
Can message content and delivery logs be processed and stored only in the European Union?
Data is hosted in a data center near Chicago and on Amazon Web Services outside the EU.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A
-
No
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade C- (45/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.