Inxmail
VERIFIEDEmail marketing ·
Germany
Founded 1999 · inxmail.de ↗
Freiburg-based premium German enterprise email marketing platform with ISO 27001 (TÜV Rheinland) and EU-only hosting.
Why this score?
Freiburg-based GmbH with EU-only hosting, ISO 27001 certified by TÜV Rheinland, SCC for the small US sub-processor footprint that exists for marketing-site analytics, and 'Software Made in Germany' designation — but the enterprise sales model means no publicly-linked DPA or sub-processors document, which caps the score at 3/5.
- SCORE
- 3.0/5
- CLOUD ACT
- CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- OWNERSHIP
- OWNERSHIP
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
-
- SUB-PROCS
- — not disclosed
JUMP TO
OVERVIEW
About Inxmail
Inxmail is a Freiburg-headquartered German email marketing platform operated by Inxmail GmbH (Wentzingerstr. 17, 79106 Freiburg im Breisgau), founded in 1999 and one of the longest-running independent ESPs in DACH. The product is positioned as a premium enterprise solution for media and publishing, energy utilities, banking and insurance, and retail/e-commerce, with a modular platform covering newsletter campaigns, marketing automation, transactional / trigger-based emails, and an SMTP Mail Relay. Inxmail reports more than 2,000 corporate customers.
The compliance posture is strong on the technical side: customer data is hosted exclusively on EU servers, the company is ISO 27001-certified by TÜV Rheinland (first issued 2020) for development and operation of its email marketing applications, and it carries the "Software Made in Germany" industry seal. The privacy policy notes that any transatlantic transfers (e.g. for Google Analytics or LinkedIn marketing pixels on the corporate website) are covered by Standard Contractual Clauses; the external Data Protection Officer is DDSK GmbH. Where Inxmail is weaker for a procurement-grade scoring is transparency: the dedicated DPA (AVV), security, and sub-processor pages were not publicly resolvable at audit time, and pricing is enterprise-only on a sales-contact basis, so small EU buyers cannot self-serve a copy of the DPA — which is precisely the cap-at-3/5 rule in our compliance rubric.
Pricing is custom: per the public prices page, fees cover hosting, administration, deliverability team, and monthly user support, scaling with email volume; no public price tier or freemium is advertised. Best fit: mid-market and enterprise marketers in DACH (publishers, utilities, financial services) who want a long-running independent German vendor, ISO 27001 attestation, and white-glove deliverability support, and are comfortable with sales-mediated procurement. Buyers who need a freemium entry tier or self-serve DPA download should look at CleverReach or rapidmail in this category.
SUB-PROCESSORS
Sub-processor map · not disclosed
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
CERTIFICATIONS
Frameworks & certifications
ISO/IEC 27001
ACTIVE
FEATURES
Capability matrix
INTEGRATION & ACCESS
REST API
Yes
SSO (SAML / OIDC)
No
COMPLIANCE & GOVERNANCE
Audit log
No
Self-host / on-prem option
No
PRICING
Pricing & tiers
PUBLIC DOCUMENTS
Public documents
Vendor does not publish a public DPA.
Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement — this caps the compliance score (see How we score).
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
ALTERNATIVES
Alternatives in this category
Maileon
Germany
German enterprise email marketing (XQueue GmbH, Offenbach, 2002), ISO 27001, EU data centres, 3k+ customers, 10 offices worldwide.
VERIFIED SIGNALS
Jurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency
- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
CleverReach
Germany
German email marketing platform with EU-only customer data storage in Germany and a permanently free Lite tier.
VERIFIED SIGNALS
Jurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency
- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
rapidmail
Germany
Freiburg-based German email marketing tool hosting customer data exclusively in a Frankfurt ISO 27001 data centre, no public cloud.
VERIFIED SIGNALS
Jurisdiction
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
Transparency
- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.