--- title: "Best European transactional email providers in 2026: 9 ESPs compared" description: "Choosing a transactional email provider used to come down to price, API quality and deliverability. For European companies there is now a fourth question, and it is the hardest one: where does the data go?" url: https://ahasend.com/blog/best-european-transactional-email-providers-2026-9-esps-compared markdown_url: https://ahasend.com/blog/best-european-transactional-email-providers-2026-9-esps-compared.md lang: en type: blog_post published: 2026-10-06 updated: 2026-10-10 author: "Mark Kraakman" category: "Insights" image: https://cms.ahasend.com/sites/default/files/2026-10/european-email-apis-featured_2.jpg --- # Best European transactional email providers in 2026: 9 ESPs compared _By Mark Kraakman, October 6, 2026, in Insights_ ![9 ESPs compared](https://cms.ahasend.com/sites/default/files/2026-10/european-email-apis-featured_2.jpg) Choosing a transactional email provider used to come down to price, API quality and deliverability. For European companies there is now a fourth question, and it is the hardest one: where does the data go? The label "European provider" does not answer it. A provider can be a European company on US-owned infrastructure. It can offer an EU sending region while account data is replicated worldwide. It can have excellent data controls and a weak API. There is no single best European provider for every company, which is why this is a comparison and not a ranking. We compared nine providers: AhaSend, Cyso Cloud Transactional Email Service, Scaleway Transactional Email, Sweego, Mailjet, Brevo, Spotler SendPro, SMTPeter and Mailgun EU. For each we looked at who owns and controls the company, where email data is stored and processed, the API, SMTP and webhook tooling, safe retries, retention and archiving, security controls, sub-accounts and dedicated IPs, public SLAs and certifications, and price at different volumes. The full list of criteria is in the section headings below. We did not rank on deliverability percentages. Deliverability depends on your own traffic, domains, reputation, recipient mix and IP setup far more than on the provider. ## **What does "European" actually mean for an email provider?** "European email provider" is not a very useful label on its own. There are at least four separate questions. ### **1. Where is the company based?** The first question is simple: which legal company are you signing a contract with? A French, Dutch, or Swedish company gives you a European legal counterparty. That matters, but it does not tell you where your email data is stored or who can access it. ### **2. Who controls the company?** A European operating company can be owned by a larger international group. A provider can also be privately owned and independent. This can matter for buyers with strict internal rules around ownership or foreign legal access. Public ownership information is not always complete. Across the EU, public access to beneficial ownership registers was restricted after a 2022 court decision. Because of that, a vendor can often show its legal entity and registered shareholder, but not every ultimate owner from an open public database. For strict compliance reviews, ownership may need to be confirmed in the contract instead of guessed from marketing pages. ### **3. Where does the actual email data go?** This is usually the most important part. For transactional email, we care about data such as: - Recipient addresses - Email bodies - Subjects - Attachments - Delivery events - Bounce and complaint data - Suppressions - Logs - Backups A provider saying "EU hosting" does not always mean all of these stay in the EU. ### **4. What about support, billing, and account data?** Even when the message itself stays in Europe, other data can leave. Examples include: - User accounts - Billing information - Support tickets - API keys - Domain names - Telemetry - Abuse and security data This is one of the main differences between the providers in this article. For example, Mailgun has a proper EU region for message data, but it also documents that some account information is copied globally. Brevo stores its databases in the EU, but its DPA also lists support and service companies in the US and India. Mailjet stores data in the EU, while its wider service chain includes international support and tooling. None of that automatically makes these providers bad or non-compliant. It simply means that "EU data centre" and "all data stays in Europe" are not the same claim. ## **European transactional email providers compared** The table below is a quick overview. "Not publicly verified" means we could not confirm the feature or contract term from current public first-party material. It does not mean the feature definitely does not exist. #### ***How to read two of these columns*** Two columns need a definition, because providers use the same word for very different things. Safe retry key. A provider-side idempotency key. You attach a unique key to a send, and if the same request arrives again after a timeout, the provider recognises it and does not send a second email. "Yes" means this is documented for general API sends, followed by how long the key stays valid. It does not count narrower keys that only deduplicate a side feature. What happens on the retry still differs between providers, and the next section explains why that matters. Sandbox or test mode. There are three meaningfully different levels here, and calling all of them "sandbox" hides the difference: - Full pipeline — the message is validated and processed exactly like a real send, appears in your logs, fires the same webhooks, and lets you choose the simulated outcome, such as delivered, bounced, deferred, failed, or suppressed. You can test your whole event-handling path without sending anything. - Drop mode — the API validates the request and returns success, but nothing else happens. Usually no log entry and no webhook. It confirms your request is well-formed, and little more. - No — we did not find a documented test facility in the public material we reviewed. This distinction matters most when you are testing bounce handling, suppression logic, or webhook processing, because drop mode cannot exercise any of it. | **Provider** | **Core email data location** | **REST and SMTP** | **Safe retry key** | **Sandbox or test mode** | **Inbound email** | **Public SLA** | **Starting paid price** | | --- | --- | --- | --- | --- | --- | --- | --- | | AhaSend | EU/EEA | Yes | Yes; 24 hours | Full pipeline | Yes | 99.9% | €9 | | Cyso Cloud TES | Netherlands | Yes | Yes; 24 hours | Full pipeline | Yes | 99.9% | €5 | | Scaleway TEM | EU (France) | Yes | No | No | No | 99.9% on Scale | Usage-based | | Sweego | France / Europe | Yes | No | Not publicly verified | Paid add-on | No numeric public SLA found | €10 | | Mailjet | EU | Yes | No | Drop mode | Higher paid tiers | 99.99% | From €8 | | Brevo | EU databases | Yes | Yes; 30 minutes | Drop mode | Yes | Enterprise only | €7 | | Spotler SendPro | Netherlands | Yes | No | Not publicly verified; flow simulation available | Yes | Commercial terms | €105 | | SMTPeter | Netherlands | Yes | No | No | Yes | No numeric public SLA found | €55 | | Mailgun EU | EU message region | Yes | No | Drop mode | Yes | 99.99% | €14 | A table like this is useful for building a shortlist, but it should not decide the final choice. A cheap provider with the wrong data setup is still the wrong provider. A provider with more features can also be worse for a simple transactional workload if the extra product adds cost or complexity. ## **Data location and control** For European buyers, this is where the providers differ most. | **Provider** | **Company and control** | **Core email data** | **Notes** | | --- | --- | --- | --- | | AhaSend | Dutch company; says it is founder-owned with no outside investors | EU/EEA | Egress includes Norway, which is in the EEA but outside the EU | | Cyso Cloud TES | Dutch company; says it is 100% Dutch-owned | Netherlands | — | | Scaleway TEM | French company; part of Iliad | EU (fr-par) | — | | Sweego | French company; says it is 100% French-owned | France / Europe | — | | Mailjet | French company; owned by Swedish Sinch | EU | International suppliers in the wider support and service chain | | Brevo | French company | EU databases | International support and maintenance access | | Spotler SendPro | Dutch group | Netherlands | Some facility operators are US-owned | | SMTPeter | Product of Dutch Copernica | Netherlands | Public ownership and supplier information is less complete | | Mailgun EU | Swedish parent; US operating entity | EU message region | Some account data is copied globally | #### ***AhaSend*** AhaSend B.V. is a Dutch company. AhaSend says that email content, message data, metadata, logs, and analytics stay in its EU/EEA setup in Germany, Finland, Norway, and Bulgaria. **Sources:** AhaSend Trust Center, AhaSend DPA #### ***Cyso Cloud TES*** Cyso makes one of the strongest Dutch-focused claims in this comparison. It says the full service, including databases and backups, runs on infrastructure it manages in Dutch data centres. It also says it is 100% Dutch-owned with no outside investors. For companies already using Cyso Cloud, this can make transactional email much easier to fit into an existing infrastructure and compliance setup. The main gap is that some TES-specific enterprise details are not as complete in public documentation as they are for larger products. Enterprise buyers should ask for the current TES supplier list, certificate scope, SLA details, and recovery terms. **Sources:** Cyso Transactional Email Service, Cyso documentation #### ***Scaleway TEM*** Scaleway has one of the clearest service-specific EU processing statements in the group. It says all personal data for its Transactional Email service is hosted and processed in the EU and that the full technical stack is managed by Scaleway. This is strong if strict EU processing is your main goal. The service is only available in the fr-par region, and Scaleway's wider supplier wording still includes some exceptions that strict buyers should confirm in writing for TEM. **Sources:** Scaleway TEM privacy FAQ, Scaleway subprocessors #### ***Sweego*** Sweego is operated by French Mindbaz SAS. Its public supplier list places email infrastructure in France and other service suppliers in France or the Netherlands. That gives it a strong European setup. The main areas to confirm are support access, full deletion rules, and security assurance. **Sources:** Sweego DPA, Sweego subprocessors #### ***Mailjet*** Mailjet is a French company owned by Swedish Sinch. It says personal data is stored in Google Cloud locations in Frankfurt and Belgium. The important detail is that the wider Sinch supplier list also includes support, ticketing, billing, and operational providers with processing outside the EU. Mailjet is still a European company with EU storage, but it is not a closed Europe-only service chain. **Sources:** Mailjet data storage, Sinch subprocessors #### ***Brevo*** Brevo is a French company. It says its databases, copies, and backups are hosted in the EU using OVHcloud and Google Cloud. Its DPA also lists US processing by providers such as Cloudflare and Zendesk, plus Brevo companies in India and the US for support and maintenance. This is a good example of why EU database hosting and Europe-only operations are different things. **Sources:** Brevo data storage, Brevo terms and DPA #### ***Spotler SendPro*** Spotler SendPro's DPA lists Dutch data centre facilities for the service. This gives it a strong Dutch processing setup. Some of those facilities are operated by US-owned companies, and the public material does not show that every support and group-level business system is Europe-only. For most buyers, this is a contract review question rather than a reason to reject the service. **Sources:** Spotler DPA, Spotler SendPro #### ***SMTPeter*** SMTPeter is made by Amsterdam-based Copernica. Copernica says production and backup data remain in the Netherlands. The data-location story is clear, but the public material is less complete on ownership, suppliers, certification, and formal service commitments. **Source:** SMTPeter privacy policy #### ***Mailgun EU*** Mailgun is part of Swedish Sinch, but Mailgun Technologies, Inc. is a US operating entity. Mailgun's EU region keeps messages, events, suppressions, lists, tags, statistics, routes, and IP data in the EU region. At the same time, account information, users, billing data, API keys, and domain names are copied globally. For many companies, that is acceptable. For a company with a strict rule that all service data must stay in Europe, it may not be. **Sources:** Mailgun regional architecture, Sinch subprocessors ## **Pricing comparison** Pricing pages are often hard to compare because providers use different bundles, overage rules, daily limits, and add-ons. We normalised public pricing at four sending volumes. These are monthly prices before VAT and exclude items such as premium support, validation, inbound processing, and extra services unless they are included in the plan. | **Provider / plan** | **10,000 emails** | **100,000 emails** | **500,000 emails** | **1,000,000 emails** | | --- | --- | --- | --- | --- | | AhaSend Pro | €9 | €42.75 | €222.75 | €447.75 | | Cyso Cloud TES | €5 | €50 | €250 | €500 | | Scaleway Essential | €2.43 | €24.93 | €124.93 | €249.93 | | Scaleway Scale | Not applicable | €80 | €160 | €260 | | Sweego | €10 | €79 | €270 | Not publicly available | | Mailjet | €12.62 | €101 | €456 | €986 | | Brevo | €14 | €70 | €399 | €999 | | Spotler SendPro | €105 | On request | On request | On request | | SMTPeter | €55 | €71.75 | €159.75 | €269.75 | | Mailgun EU | €14 | €69 | €363 | €636 | Prices were checked on 10 September 2026. Public prices can change, so always check the provider's current pricing page before making a decision. ### **Cheapest at 100,000 emails per month** At 100,000 emails per month, the lowest public prices in this comparison are: 1\. Scaleway Essential: €24.93 2\. AhaSend Pro: €42.75 3\. Cyso: €50 4\. Mailgun: €69 5\. Brevo: €70 6\. SMTPeter: €71.75 7\. Sweego: €79 8\. Mailjet: €101 9\. Spotler SendPro: quote above 25,000 This is only a price comparison. The products are not equal. For example, Scaleway Essential does not include the same SLA and dedicated IP package as Scaleway Scale. SMTPeter includes a dedicated IP in its €55 base package. Spotler is sold more like an enterprise product. Mailjet and Brevo include a much broader marketing product around the email service. AhaSend is not the absolute cheapest service in this list, but its €9 plan includes 25,000 emails and then grows in small usage-based steps. That makes cost easier to predict without jumping between large bundles. **Sources:** AhaSend pricing, Cyso pricing, Scaleway pricing, Sweego pricing, Mailjet pricing, Brevo pricing, Spotler pricing, SMTPeter pricing, Mailgun pricing ## **Developer experience** Most providers in this list support both REST APIs and SMTP. That alone does not tell you much. The bigger differences show up when something goes wrong. Can you safely retry a failed API request? Are webhooks signed? What happens if your webhook endpoint is down? Is there a real test mode? Can you pull events later if a webhook is missed? Are limits clear enough to design around? These details matter much more in production than a nice "send your first email" example. ### **Safe retries** One of the easiest ways to accidentally send duplicate transactional emails is a timeout. Imagine this flow: 1\. Your application sends an invoice email. 2\. The provider accepts it. 3\. The HTTP response never reaches your application. 4\. Your application sees a timeout and retries. 5\. The customer gets the same invoice twice. A common way to solve this is an idempotency key. Your application sends a unique key with the request. If the same request is retried, the provider knows that it has already handled it. Three of the nine providers document one. They are not equivalent, and the difference is in what happens on the second request rather than in whether duplicates are stopped. AhaSend and Cyso are the strongest and are close to identical. Both accept an Idempotency-Key header on POST requests, both keep the key for 24 hours, and both answer a duplicate by replaying the original response. Cyso flags the replay with an Idempotent-Replayed header and returns distinct codes if the original is still in flight or failed; AhaSend additionally rejects a reused key when the request body has changed. Either way, your retry after a timeout gets back the same message ID it would have received the first time, so your application can carry on as if nothing went wrong. Brevo documents a real key too, and it is weaker in two ways worth knowing before you rely on it. The idempotencyKey is a UUID placed inside the headers object, and it lasts 30 minutes rather than 24 hours. More importantly, reusing it returns a duplicate\_parameter error instead of the original response. The duplicate email is prevented, which is the main thing — but you never learn the ID of the message that was actually sent, so a timeout still leaves your records incomplete. Mailgun looks like a match until you read the detail: it does document an idempotency key, but it applies to Inbox Placement tests rather than to sending, so it will not stop a duplicate email. For the remaining five providers we did not find a general equivalent in the public material we reviewed. That does not prove they have no duplicate protection. It means you should ask how they want clients to handle uncertain send results. **Sources:** AhaSend idempotency, Cyso API reference, Brevo idempotency ### **APIs and SDKs** Mailgun has the deepest public developer surface in this group. It has separate EU endpoints, official SDKs for several common languages, a large sending API, inbound routes, events, templates, test mode, scheduling, and detailed operational documentation. Mailjet also has a mature API and official libraries for many languages. AhaSend provides REST and SMTP, official SDKs, documented rate limits, scoped API keys, and a CLI. Alongside sending, it exposes APIs for templates, campaigns, contacts, and lists. Its API surface is smaller than Mailgun’s, but the core sending path is modern and clear. Brevo has a broad API with high documented rate limits and support for scheduling and cancelling transactional messages. Cyso has REST, SMTP, and an interactive API reference, but we did not find the same level of first-party language SDK coverage. Scaleway's API is more narrow and still labelled v1alpha1. Its REST request size is also limited to 2 MB, while SMTP accepts much larger messages. That is an important detail if you send attachments. SMTPeter has a wide API surface, but its REST API uses an access token in the query string. That is an older design and can create security problems if URLs are logged. **Sources:** AhaSend documentation, Mailgun API, Mailjet API, Brevo API, Cyso documentation, Scaleway API, SMTPeter REST API ### **Webhooks** A webhook should answer two questions well: 1\. Can I verify that this event really came from the provider? 2\. What happens if my server is temporarily down? AhaSend uses signed Standard Webhooks and has a documented retry policy. Cyso also uses Standard Webhooks with signatures, timestamps, and replay guidance. Sweego uses signed webhooks and provides verification examples in several languages, although we did not find a clear public retry schedule. Mailgun has strong public webhook documentation. It uses HMAC signatures and documents retry timing for supported event types. SMTPeter also has a technically strong design. It signs webhooks using RSA-SHA256 and publishes a rotating public key through DNS. Mailjet retries webhook delivery for up to 24 hours, but its public Event API documentation recommends HTTPS and Basic Auth rather than a per-event HMAC signature. Brevo offers IP allowlists and normal HTTP authentication options. Its retry rules deserve extra attention because some HTTP failures stop retrying earlier than many developers may expect. For Spotler, we found webhook support but not a public signing algorithm or detailed retry schedule. **Sources:** AhaSend webhooks, Cyso webhooks, Sweego webhooks, Mailgun webhook security, SMTPeter webhook security, Mailjet Event API, Brevo webhook retries ### **Bounce reports for systems that cannot use webhooks** Most providers expect you to handle bounces through webhooks or an events API. That works well for a web application. It works badly when the system consuming the result is a mail-handling application rather than an HTTP service, which is common in older ERP, billing, and case-management software. Four providers document Delivery Status Notification reports delivered by email. AhaSend generates RFC 3464 DSN reports automatically for bounced messages and sends them to addresses you configure, account-wide or overridden per domain. It is a Max feature, and AhaSend's own documentation recommends webhooks for new integrations and positions DSN for systems where webhooks are not an option. Cyso also sends DSNs for bounced emails, switched on in account settings, with the recipient set account-wide or per domain. Its documentation does not name a conformance standard. Spotler handles this per message source. dsnAddress sets where DSN messages go, and dsnDisable turns them off for that source. That is finer-grained placement than an account-level setting. SMTPeter supports the SMTP DSN extension. A REST send can set an envelope address to receive the notifications, ask for success notices, failure notices, or both, and request either the full original message or just its headers. For the other five providers, the Return-Path points at the provider's own bounce infrastructure. Mailjet and Brevo let paid accounts brand that Return-Path with their own domain, but the CNAME still resolves to the provider, so the reports do not land in a mailbox you choose. Of the four, only AhaSend states RFC 3464 conformance explicitly. If exact wire format matters to the system reading these reports, test a real bounce and put the RFC in the contract. **Sources:** AhaSend DSN reports, Cyso account settings, Spotler API, SMTPeter DSN ### **Testing and inbound email** AhaSend and Cyso are the two full-pipeline sandboxes here, and they work almost identically. AhaSend uses a sandbox\_result parameter, Cyso a seseu-Sandbox-Result header, and both accept deliver, bounce, defer, fail, and suppress. In both cases the message is processed like a real send, appears in the dashboard logs, and fires the webhooks that outcome would produce. AhaSend does not charge for sandbox sends. Brevo does have a sandbox. Adding the X-Sib-Sandbox: drop header returns a 201 with a message ID and sends nothing. Brevo's documentation is clear about the limits: no email logs are created, and sandbox mode "only validates the API request format". That is useful for checking that an integration is wired up correctly, but it cannot exercise bounce handling, suppression logic, or webhook processing. Mailgun's o:testmode and Mailjet's Send API sandbox mode behave the same way: the request is accepted and nothing is delivered. Two providers advertise something in this area that we could not confirm behaves like either level. Sweego lists Test Mode as a feature on every plan tier, but we found no documentation of what it actually does — the only test-related page in its documentation covers SMS test numbers. Spotler's pricing page lists Sandbox under Premium without describing it, and the simulate endpoint in its API is a different tool: it returns the flow a message would match and the rendered subject, HTML, and text, which is useful for checking routing and templates but produces no delivery outcome, no log entry, and no webhook. We did not find a documented test facility for Scaleway TEM or SMTPeter either. **Sources:** AhaSend sandbox, Cyso sandbox, Brevo sandbox mode, Sweego pricing, Spotler API Inbound email is supported by AhaSend, Cyso, Sweego, Mailjet, Brevo, Spotler, SMTPeter, and Mailgun. We did not find public inbound support for Scaleway TEM. Plan rules matter. Mailjet's Parse API is only available from higher tiers, and Sweego sells inbound email as an add-on. ### **Local development and the CLI** Several providers ship a command-line tool, but they do very different jobs. Scaleway's scw tem manages TEM resources inside its general cloud CLI: domains, DNS checks, email status, blocklists, and webhook configuration. Brevo's CLI scaffolds and manages OAuth applications and functions. Neither is aimed at the daily loop of writing and testing sending code. AhaSend's CLI covers the API surface — messages, domains, webhooks, routes, suppressions, SMTP credentials, API keys, statistics — and is available on every plan including Free. The part that changes day-to-day work is the webhook workflow: ahasend webhooks listen --forward-to http://localhost:3000/webhook ahasend webhooks trigger \ --events "message.bounced,message.suppressed" The first command opens a listener and delivers live events straight to a server running on your machine, filtered with --events if you only want some of them. The second fires synthetic events of your choosing at a webhook, so you can build and test a bounce handler before any real mail moves. Inbound routes have the same local path. This is the one place in this comparison where we found no close second. Everywhere else, testing a webhook against local code means an external tunnel such as ngrok, a hosted request bin, or clicking through a dashboard. Spotler comes nearest with its Samples and resend workflows, but those run in the browser rather than against your local server. It is a small thing on a feature list and a large one on a Tuesday afternoon. **Sources:** AhaSend CLI, AhaSend webhook testing, Scaleway CLI, Brevo CLI ### **Limits that can change your design** A few limits are worth checking before you start integrating: - AhaSend: 20 MB SMTP message size, 50 recipients per SMTP message, up to 100 recipients per API request, and a documented API rate limit of 100 requests per second with burst capacity. - Scaleway: 2 MB REST request limit, 50 MB over SMTP, and low default account quotas that may need support approval. - Sweego: 20 MB outbound email limit. - Mailjet: 15 MB Send API request limit and up to 50 message objects per call. - Brevo: high public request-rate limits and large batch support. - Mailgun: 25 MB maximum message size and dynamic API rate-limit headers. These limits may not matter for simple password resets or receipts. They can matter a lot if you send attachments, large batches, or sudden bursts. ## **Security, retention, and public service commitments** For many companies, security reviews focus on certificates. That is useful, but it should not be the only question. You should also ask: - How long is email content stored? - Can content retention be reduced? - How long are logs kept? - What happens to backups? - Is there a real public SLA? - Does the SLA include service credits? - Is there a public status page? ### **Retention** AhaSend and Cyso stand out for short, configurable retention. AhaSend allows Pro customers to set message content retention to zero days, with separate retention controls for metadata, and both can be overridden per message with the ahasend-data-retention and ahasend-metadata-retention headers. Cyso allows content retention from zero to 30 days and metadata from one to 30 days, also overridable per message. This can matter for password resets, authentication emails, invoices, health-related notices, and other messages where keeping the full content longer than needed adds risk without adding much value. Mailgun publishes clear plan-based retention. Foundation includes five days of logs and one day of content. Scale includes 30 days of logs and up to seven days of content. Mailjet keeps statistics for 90 days on Free and 13 months on paid plans. Contacts and templates can remain for the lifetime of the account. Brevo supports custom transactional log retention from one to 24 months. Email previews can be disabled, but if retained, the public settings are much longer than the shortest options from AhaSend or Cyso. Sweego publishes plan-based log windows of 7, 30, 60, or 90 days. Spotler is more interesting than it first appears. Its archive is a step inside a flow, so a flow that leaves the step out stores no message body at all. Once archiving is switched on, the shortest option is one month. But Message Details, which covers open and click data and technical logging, cannot be set below three months, and SendPro keeps three months of technical logging even if you never enable tracking. Spotler minimises content well and metadata poorly. SMTPeter keeps archived messages until you delete them yourself, and its public default deletion rules are less clear. Confirm them before purchase. ### **Keeping your own copy instead** Short retention creates a second question. If the provider is not keeping a copy and you still need one for audit, support, or a dispute, where does it live? AhaSend and Cyso are the only two providers here that answer that inside the product. Both can write messages and delivery logs to S3-compatible object storage using your own endpoint, bucket, and keys. On AhaSend this is a Max feature. That pairing is the point: zero days on the provider side, a full copy in storage you control, and no gap in the audit trail. Mailgun has something that looks similar and is a materially different commitment. Setting o:archive-to makes Mailgun POST the exact MIME of each message to a URL you provide. You build, host, and secure the receiver and whatever it writes to. Only successful deliveries are covered. Each POST is also counted and billed as another delivered message. The other providers offer manual exports or an internal archive rather than a continuous copy into storage you own. **Sources:** AhaSend retention, AhaSend S3 archiving, Cyso retention, Mailgun pricing, Mailgun Messages API, Mailjet retention, Brevo retention, Sweego pricing, Spotler retention ## **Security assurance** ISO 27001 is the baseline here. AhaSend, Cyso, Scaleway, Mailjet, Spotler, Mailgun and Brevo all hold it. A few go further: Cyso adds NEN 7510, Mailgun adds SOC 2 Type II, and Mailjet adds AFNOR GDPR certification. Two providers stand out for the opposite reason. Sweego says in its own cloud control review that it holds no formal security certification yet, and for SMTPeter we found no public ISO or SOC certificate in the material we reviewed. If certification matters for your procurement, ask any provider for the certificate that is in force, with its scope and expiry date. ### **Access control and scaling** Most of these providers have the same account security controls. The difference is usually which plan you have to be on to get them. | **Provider** | **Scoped API keys** | **IP allowlist** | **Enforced 2FA** | **SSO** | **Automatic DKIM rotation** | | --- | --- | --- | --- | --- | --- | | AhaSend | All plans | Per key; all plans | All plans | OIDC; Max | Yes | | Cyso Cloud TES | Domain and endpoint | Not publicly verified | Yes | OIDC | Not publicly verified | | Scaleway TEM | IAM permission sets | IAM request conditions | Yes | Yes | No; manual re-registration | | Sweego | Domain-restricted only | Not publicly verified | Not publicly verified | Social login only | Not publicly verified | | Mailjet | Content API only | Not publicly verified | Available; conflicts with SSO | From 100,000 emails | Not publicly verified | | Brevo | OAuth apps only | Account-wide | Yes | SAML | Yes | | Spotler SendPro | Submit-only role | SMTP and header authentication | Enabled by default; model unclear | Confirmed; setup not public | Not publicly verified | | SMTPeter | Token in query string | Not publicly verified | Not publicly verified | Not publicly verified | Yes | | Mailgun EU | Domain keys; RBAC on higher plans | Account-wide | Yes | SAML | Yes | Two things stand out. The first is where the controls sit in the price list. AhaSend puts scoped API keys, per-key IP allowlists, enforced two-factor authentication, and automatic DKIM key rotation on every plan, including the free one; only SSO is reserved for Max. Mailgun has a comparable set but gates role-based keys behind Enterprise and certain Business plans. Mailjet's SSO starts at 100,000 emails per month. If you are a small team that still has a real security review to pass, that difference is the whole story. The second is granularity. AhaSend's IP allowlist is set per API key, so a key used by one deployment can be locked to that deployment's addresses. Brevo's and Mailgun's equivalents are account-wide, which is simpler but blunter. ### **Sub-accounts, dedicated IPs, and bringing your own** If you send on behalf of your own customers, tenancy matters more than any of the above. AhaSend offers sub-accounts on Max: isolated child accounts with their own domains, API keys, and sending, under one billing relationship, with per-sub-account usage and allocated cost, suspend and unsuspend, and a full management API. The cost allocation is the unusual part — it answers "what did this customer cost us" without you building the arithmetic. Mailgun has plan-gated sub-accounts with separate domains, IPs, keys, and users, but usage rolls up to the primary account and sub-accounts are not billed separately. Mailjet allows one sub-account on Free and Essential, 20 on Premium, and unlimited on Custom, with additional ones subject to compliance review. Brevo offers Enterprise sub-organisations with their own dashboards, keys, and allocated quota. Spotler isolates streams through Sources, and a current case study describes delegated sub-accounts that can hide message content from the delegating party, but the provisioning and billing contract is not public. On bringing your own IP addresses, only two providers offer it. AhaSend sells BYOIP as a Max add-on. Cyso publishes a full procedure, but it is heavy: you supply an Ubuntu VPS on which port 25 egress is permitted, pay a one-time setup fee and a monthly fee, and allow roughly seven working days for configuration. Scaleway states plainly that BYOIP is not currently available, and Brevo only lets you attach dedicated IPs bought through Brevo. **Sources:** AhaSend scoped keys, AhaSend IP allowlists, AhaSend sub-accounts, Mailgun IP allowlist, Mailgun sub-accounts, Mailjet sub-accounts, Brevo sub-organisations, Cyso BYOIP, Scaleway IPAM FAQ ### **Public uptime commitments** Mailgun and Mailjet publish the highest figure, 99.99%, both backed by service credits. AhaSend, Cyso and Scaleway's Scale plan commit to 99.9%; AhaSend adds service credits in its terms, Scaleway Essential has no SLA. Spotler and Brevo offer an SLA only on commercial or Enterprise plans, without public numbers. For Sweego and SMTPeter we found no public, credit-backed SLA. ## **Where AhaSend stands out** **Best for:** product and engineering teams that want a developer-first European email platform with safe retries, short retention, simple pricing, and contacts, lists and templates on the same system as transactional email. AhaSend is an independent Dutch provider. Message content, metadata and logs are stored in Germany and Finland. Mail leaves through AhaSend's own infrastructure in Germany, Finland, Norway and Bulgaria; nothing is stored outside the EU. For developers, the sending flow is the strongest part: REST and SMTP, official SDKs, a full-pipeline sandbox, signed webhooks, inbound email, scheduling and documented rate limits. The CLI is where it separates from the rest. It covers the API on every plan, including Free, and webhooks listen --forward-to delivers live events to a server on your own machine. No other provider in this comparison documents that loop. Safe retries are built in: 24-hour idempotency on every POST, the original response replayed on a duplicate, and a reused key rejected when the body changed. Cyso comes close; Brevo's version is shorter-lived and errors instead of replaying. Security controls are not reserved for large customers. Scoped API keys, per-key IP allow lists, enforced two-factor authentication and automatic DKIM rotation are on every plan; OIDC single sign-on is on Max. AhaSend is ISO/IEC 27001 certified and a Certified Senders Alliance member. Retention is configurable down to zero days for content, with metadata controlled separately and both overridable per message. Max adds an archive to your own S3-compatible storage, so the vendor-side copy can be zero without losing the audit trail. For platforms sending on behalf of their own customers, Max adds sub-accounts with isolated domains, keys and reputation, per-sub-account usage and allocated cost, DNS whitelabeling, bring-your-own DKIM keys and per-domain DKIM selectors. RFC 3464 bounce reports by email are available for systems that cannot consume webhooks. Contacts, lists and reusable templates with a visual editor shipped in September, each with a management API. Campaign Builder itself is in early access. Support comes from the engineers who run the platform, seven days a week, with no first line in between. Pricing starts at €9 per month for 25,000 emails. Above the included volume you pay at most €0.45 per 1,000, less at higher volumes. **What only AhaSend offers here:** a CLI that forwards live webhooks to localhost; zero-day content retention combined with an archive to your own bucket; sub-accounts with allocated cost per tenant. **Main limitations:** a 99.9% public SLA against Mailgun and Mailjet's 99.99%, a shorter operating history than the largest providers and no marketing automation yet **Choose AhaSend if** you want API design, safe retries, European processing, retention and price done well, with ISO 27001 assurance on every plan, and campaigns on the same platform later. **Sources:** AhaSend Trust Center, AhaSend pricing, AhaSend documentation, AhaSend retention, AhaSend S3 archiving, AhaSend CLI, AhaSend sub-accounts, AhaSend DSN reports ## **Do not choose from a feature table alone** A feature comparison is a useful first step, but it does not tell you how a provider behaves with your real traffic. Before moving production email, we would test at least these six things. #### ***1. Contracts and data*** Ask exactly where message bodies, addresses, events, logs, backups, account data, support data, and abuse data are stored and accessed. #### ***2. API failures*** Create timeouts and server errors on purpose. Check whether retries can cause duplicate emails. #### ***3. Webhooks*** Verify signatures, return failures on purpose, measure retries, and check how to recover events that were missed. #### ***4. Retention*** Send unique test strings, wait for the selected deletion period, and confirm that the content is really gone from the UI and API. #### ***5. Performance and deliverability*** Use your own domains and real recipient mix. Measure temporary failures, delays, bounces, complaints, and throttling across the mailbox providers your users actually use. #### ***6. Real monthly cost*** Model normal traffic, a busy month, and an unexpected burst. Include dedicated IPs, support, inbound email, webhooks, validation, storage, and other add-ons. ## **How we researched this comparison** This article is based mainly on first-party sources from each provider. We used: - technical documentation - API references - pricing pages - terms and DPAs - subprocessor lists - security pages and certificates - status pages - company and ownership information We did not use crowdsourced review scores to rank providers. We also use "not publicly verified" carefully. It means we did not find enough evidence in the public first-party material we reviewed. It does not mean the feature definitely does not exist. Pricing was normalised using the lowest public option that could cover each sending volume. VAT, onboarding, premium support, validation, inbound email, and other add-ons are excluded unless they are already included in the listed plan. All pricing, product, ownership, data-location, and security information in this article is a snapshot from 10 September 2026. Re-check important points before signing a contract. ## **Frequently asked questions** #### ***What is the best European transactional email provider?*** There is no single best provider for everyone. For a developer-first European email service, we think AhaSend is one of the strongest choices, and it now covers campaigns and contacts alongside transactional email. For enterprise compliance inside a wider European cloud setup, Cyso is strong. For the deepest mature developer ecosystem, Mailgun is the benchmark. For a broad marketing suite, Brevo is a good fit. #### ***Which providers keep email data in Europe?*** All providers in this comparison have some meaningful European processing or hosting story, but they are not equal. Cyso says its full TES infrastructure, databases, and backups are in the Netherlands. Scaleway says TEM personal data is hosted and processed in the EU. AhaSend keeps standard message processing in the EU/EEA. Mailgun keeps core message data in its EU region but copies some account data globally. Mailjet and Brevo use EU database hosting but also have international support or supplier processing. #### ***Is Mailgun a European provider?*** Mailgun is part of Swedish Sinch, but Mailgun Technologies, Inc. is a US operating entity. Mailgun offers an EU region for core message data, while some account data is copied globally. So the answer depends on what you mean by European. #### ***Is Brevo a European company?*** Yes. Brevo is a French company and hosts its main databases in the EU. Its service chain also includes some processing and support outside Europe, so companies with strict Europe-only rules should review the DPA carefully. #### ***Which provider is cheapest at 100,000 emails per month?*** Based on public pricing checked on 10 September 2026, Scaleway Essential is the cheapest at about €24.93 per month. AhaSend follows at €42.75, then Cyso at €50. Price should not be the only deciding factor because plans differ in SLA, quotas, retention, support, dedicated IPs, and other features. #### ***Which provider supports safe API retries?*** Three do. AhaSend and Cyso are the strongest and near-identical: an Idempotency-Key on any POST, valid for 24 hours, with the original response replayed on a duplicate so your retry recovers the original message ID. Brevo has a real key too, but it lasts 30 minutes and returns an error rather than the original response, so the duplicate is prevented while the first result stays lost. Mailgun's key covers Inbox Placement tests, not sending. For the rest, ask how they recommend avoiding duplicate sends after an uncertain API result. #### ***Do I need a dedicated IP for transactional email?*** Not always. A dedicated IP can be useful at higher and stable volumes, but it also means you are responsible for building and maintaining the reputation of that IP. At low or irregular volume, a well-managed shared pool can perform better. Do not choose a provider just because a dedicated IP is included cheaply. ## **Final thoughts** The European transactional email market is more varied than it looks. Some providers are built like cloud infrastructure. Some are full marketing suites. Some focus on enterprise controls. Some focus on developer experience. The best way to choose is to start with hard requirements first: 1\. Where can the data go? 2\. What security and contract terms do you need? 3\. How should retries and webhooks behave? 4\. What retention period is acceptable? 5\. What does the service cost with your real traffic? Only compare features after those questions are answered. For developer-led teams that want European processing, safe API retries, short retention, a full-pipeline sandbox, and simple pricing AhaSend is built for that use case. [Start for free with AhaSend →](https://dash.ahasend.com/user/register)