By ActiveCampaign

Postmark

Transactional email API known for inbox placement and clear message streams. US vendor (ActiveCampaign); not a mailbox product.

Proprietary · https://postmarkapp.com

Transactional email

Postmark cloud

Hosting: Global SaaS Reviewed

US SaaS; verify residency options and subprocessor list for NGO mail.

Fair 1.7
Easy 3.7
Secure 3.0

FES Scores 9

Pillar	Criterion	Score	Evidence
Easy	Day-one UX Can non-technical staff use it without a project?	3	Postmark provides a simple API and SMTP integration for sending transactional emails with minimal setup required. Source
Easy	Operate Admin burden, updates, backups and language coverage.	4	Rule baseline (rubric_v1): vendor-operated SaaS — low ongoing ops burden for a small NGO. Source
Easy	Integrate SSO, mail/CalDAV, APIs and common NGO connectors.	4	Postmark supports multiple integration methods including REST API, SMTP, and SDKs for popular languages. Source
Fair	Lock-in / exit Can you leave with your data in open formats, at known cost?	2	Rule baseline (rubric_v1): global SaaS APIs/export exist, but suite gravity and remapping remain. Source
Fair	Sovereignty EU legal entity, EU hosting, and exposure to extra-EU lawful access?	1	Rule baseline (rubric_v1): non-EU legal entity + global SaaS — high extra-EU lawful-access exposure. Source
Fair	Openness Open source or open standards? Are independent implementations possible?	2	Rule baseline (rubric_v1): proprietary / non-OSI license — openness capped unless open standards dominate. Source
Secure	IT security Authentication, encryption, patch cadence and independent audit.	4	Postmark uses TLS 1.2+ for data in transit and AES-256 encryption for data at rest. Source
Secure	User security 2FA, roles, phishing resistance and safe defaults.	3	Postmark requires API key authentication and supports IP allowlisting for enhanced user security. Source
Secure	Personal data GDPR fit: DPA, residency, sub-processors and Schrems II posture.	2	Rule baseline (rubric_v1): global SaaS without a usable DPA URL — weak personal-data story until reviewed. Source

Indicative scores from public information — how we score.

Subprocessors 3

Name	Role	Residency	Verification date	Source
SendGrid	Email	EU + abroad	07 Oct 2026	Source
DigitalOcean	Hosting	EU + abroad	07 Oct 2026	Source
Amazon Web Services	Hosting	EU + abroad	07 Oct 2026	Source