Email Marketing
226 martech vendors in Email Marketing, part of Campaign & Lifecycle Marketing. Each record carries the date we last verified it, so you can see how current it is before you rely on it.
Last verified:
Procurement-readiness profiles — SOC 2, ISO 27001, GDPR and DPA posture, data residency, AI-training policies — are available when you sign in.
Email marketing software sends, personalizes, and measures email campaigns at scale — from welcome flows and newsletters to lifecycle automation. Marketing teams use it to reach subscribers directly; MOps and IT security need it audited because it touches subscriber PII, sending domains, and, increasingly, AI-generated content, well before a contract gets signed.
Who it is for
- Marketing operations leads shortlisting a platform for a new channel, migration, or contract renewal.
- IT security and data governance reviewers checking where subscriber data lives and how sending domains are authenticated.
- Legal and compliance teams confirming GDPR consent handling and DPA availability before sign-off.
What your No-Committee will ask
- IT security
- Is subscriber data encrypted at rest and in transit, and is MFA enforced on admin access? Our audits capture encryption and MFA as evidenced claims, each marked verified, self-attested, or not found — never assumed.
- Data governance
- Where is subscriber data stored, and is a Data Processing Agreement available? We extract data residency and DPA availability directly from the vendor's own legal pages, with a source link on every claim.
- Architecture
- How is the sending domain authenticated against spoofing? Domain-level DMARC enforcement is measured externally by our own DNS scan, not self-reported by the vendor.
- AI governance
- If the platform generates subject lines or content with AI, is that disclosed, and does it train on customer data? Our audits track AI-output labeling and the training-data question as a single evidenced claim per vendor.
- Legal
- Is a sub-processor list published, and does GDPR posture hold up against a DPA reading? We record sub-processor disclosure and GDPR compliance status with a link back to the clause itself.
- Finance / risk
- What's the uptime SLA, and is there a status page for incident history? SLA terms and status-page links are captured wherever the vendor publishes them.
How we verify
Every claim above comes from the vendor's own public pages — trust center, privacy policy, security page, or DNS record — never from a directory or a self-reported form we didn't check ourselves. Read the full methodology, including what verified, self-attested, and not-found actually mean, on our methodology page.
Frequently asked questions
What's the difference between email marketing and marketing automation software?
Email marketing tools focus on sending, designing, and measuring campaigns to a list. Marketing automation platforms add cross-channel workflows — email plus SMS, lead scoring, and CRM sync — triggered by behavior rather than a send date. Many vendors span both; the distinction is about primary use case, not a hard technical line.
Do email marketing vendors typically publish SOC 2 or ISO 27001 certification?
It varies by vendor size. Larger, enterprise-focused platforms usually publish a SOC 2 report or an ISO 27001 certificate, often behind a trust center. Smaller or mid-market tools more often rely on a security page describing controls without third-party certification — which our audits mark as self-attested, not verified.
Is pricing usually public for these platforms?
Most email marketing vendors publish list-based or send-volume pricing tiers on their site, at least for entry plans. Enterprise tiers with dedicated IP addresses, advanced deliverability support, or higher sending volumes are more often quote-only, which we note rather than estimate.
What should I check beyond the feature list before shortlisting a vendor?
Confirm where subscriber data is stored, whether a DPA is available, and how the vendor authenticates its sending domains — deliverability problems are often a security-hygiene problem in disguise. Those three checks surface the issues a review board raises later, earlier in the process.