Resend
Plus Five Five, Inc., San Francisco ·resend.com· As of: 2026-09-17
Work through this tool with an AI
Our verdict
Without reliable email sending there is no sign-in link, no password reset and no invoice, and a product whose emails land in the spam folder loses users before their first login. That makes this building block mandatory. It opens no gap to competitors, because every competitor can set up the same account in five minutes. The difference to older sending services lies in the developers' work: the API, templates in React and debugging in the log are quicker to set up. For a company in the German-speaking market a different question decides: by the vendor's own account, message content, logs and account data are always stored in the United States, even when Ireland is chosen as the sending region. Anyone who promises its customers hosting in the European Union has to settle that before the first send.
Evidence:Data processing agreement of 27 August 2026: Plus Five Five, Inc. as processor with an address in San Francisco, subprocessors with 14 days' notice, transfers under modules two and three of the EU standard contractual clauses under Irish law, processing primarily in the United States, supplementary measures on requests from authorities, independent controllership for account and usage data, Data Privacy Framework, deletion within 90 days after the account endsOpen sourceSubprocessor list of 27 August 2026 with 22 entries, all with the country USA, including Anthropic for artificial intelligence and RunPod for self-hosted language modelsOpen sourcePrivacy policy of 27 August 2026: transfer to the United States, Mixpanel and Plausible for usage analytics, no statement on trainingOpen sourceTerms of service of 27 August 2026: price changes at the end of each billing cycle, no refunds, liability capped at the amount paid, Californian law, no statement on training or an export periodOpen sourceEnterprise terms of 17 August 2026: 99.99 per cent availability with service credits and a termination right for repeated outages, first response within one business day with no remedy, aggregated data, training ban in Section 6.4, AI features and agents in Section 9, liability caps, cyber insurance of at least one million dollars, 90-day export window and 30 days until deletion, venue San FranciscoOpen sourceGDPR page: all customer data stored in the United States regardless of sending region, agreement pre-signed for every account, 30-day retention on Free, Pro and Scale, deletion within 90 days, backups 7 days, no ISO/IEC 27001 and no HIPAA, contract changes only on the Enterprise planOpen sourceDocumentation on choosing a region: four sending regions, the region only controls route and sending location, account and email data sit in the United StatesOpen sourceSOC 2 Type II, audited by Advantage Partners, reporting period 1 February 2025 to 1 February 2026, report and penetration test only after loginOpen sourceSecurity page: encryption at rest and in transit, backups 7 days, HIPAA in progressOpen sourcePrices of the transactional and marketing plans, add-ons for domains, dedicated IP address and identity provider sign-in, automation runs, AI credits and the list of AI features, Enterprise tailored from roughly three million emails a monthOpen sourceLog of API calls with endpoint, status, key and request and response body in the dashboardOpen sourceAdmin and Member roles, two-factor sign-in cannot be enforced team-wideOpen sourceSign-in through your own identity provider since 1 September 2026, an add-on on Scale and included on EnterpriseOpen sourceCSV exports for emails, broadcasts, contacts, domains, logs and keys, generally available since 13 November 2025Open sourceCertification under the EU-US Data Privacy Framework, announced on 13 March 2025Open sourceFounded 2023, Winter 2023 batch at Y Combinator, team size 45Open sourceSeed financing of 3 million dollars on 18 July 2023 with Y Combinator, SV Angel and founders as backersOpen sourceSeries A of 18 million dollars led by Andreessen Horowitz, announced on 4 December 2024, more than 200,000 registered developers by the vendor's own accountOpen sourceInvestor announcement of the investment dated 4 December 2024Open sourceVendor announcement of 18 December 2025: 1 million users, revenue up fivefold, team grown from 12 to 28 people, two acquisitionsOpen sourceVendor announcement of 3 June 2026: 3 million users, 43 people, profitable since the previous yearOpen sourceAcquisition of Mergent, announced on 23 April 2025Open sourceDocumented outage on 15 February 2026 lasting 3 hours and 31 minutes, emails delayed by about two hours, none lost, dashboard unreachableOpen sourceDocumented outage on 18 November 2025 from 11:30 to 14:31 UTC caused by a Cloudflare disruption, through which all API traffic runsOpen sourceSince 5 May 2026, AI chats in the editor and in automations draw on your own broadcasts, templates and propertiesOpen sourceNo legal notice (Impressum) in the vendor's sitemap of 950 addressesOpen source
Who it fits
Solo
suitable
The free plan carries 3,000 emails a month with at most 100 a day, three domains and one webhook, with no payment details. Pro costs 20 dollars a month for 50,000 emails with no daily limit. For a start-up or a side project that lasts a long time, and the data processing agreement applies from the very first account.
Mid-market
suitable with caveats
The price fits: Scale costs from 90 dollars a month for 100,000 emails, with each further thousand at 0.90 dollars or less. The condition lies in your own customer contracts. Message content carries names, invoice amounts and sign-in links, and that data sits in the United States for 30 days. Anyone who promises customers a storage location in the European Union, or ships a subprocessor list with countries, has to add this vendor there with the country USA. The role model knows only Admin and Member, and two-factor sign-in cannot be enforced across the team.
Enterprise
suitable with caveats
The enterprise terms of 17 August 2026 are fit for contract: 99.99 per cent availability with service credits, a termination right for repeated outages, a 90-day export window after the contract ends, a contractual training ban, a liability cap equal to a year's fees with a doubled cap for data protection breaches, and cyber insurance of at least one million dollars. Sign-in through your own identity provider costs a 150-dollar monthly surcharge on the Scale plan and is only included in the Enterprise plan, which the vendor tailors to teams sending roughly three million emails a month or more. Three points remain even there: no storage location in the European Union, no ISO/IEC 27001 certificate, and the venue is San Francisco under Californian law.
Buy, switch or build
Off-the-shelf
Stay with an established sending service or pick one with EU storage
Twilio SendGrid and Mailgun are the counterparts large groups stay with: a long operating history, their own IP pools, framework agreements with procurement and deliverability consulting. The price is older APIs and more setup effort, and anyone leaving them usually does so because of the developer work. For a company that promises its customers data storage in the European Union, sending services based or storing data in the Union such as Mailjet or Brevo deserve a look. In both cases the concrete storage location of message content belongs in the contract in writing before deciding, because sending region and storage location do not necessarily coincide there either.
AI-native
A ground-up AI-native counterpart barely exists in this cluster
Email sending is infrastructure: DNS records, IP reputation, bounces and complaint rates decide, and a language model changes little there. In this cluster the vendor itself has gone furthest toward agents, with a hosted MCP server, a command line tool, skills for coding assistants and an inbox agents can react to. Anyone using that lets an agent send emails, maintain contacts and trigger broadcasts. What you give up is control: under Section 9 of the enterprise terms the customer bears the consequences of whatever an agent acting on its rules does. So the first thing to check is which keys an agent gets; the API knows keys that may only send.
Build it yourself
Send through Amazon SES in Frankfurt with your own layer on top
Anyone who wants to decide storage location and costs themselves builds the layer on top of a raw service. Amazon SES in the Frankfurt region handles sending, templates are built with React Email, send jobs run through n8n, bounces and complaints come back as notifications and land together with the send log and suppression list in Supabase in a European region, built with Claude Code. At 8 person-days and 1,200 euros a day that is roughly 9,600 euros one-off against 1,080 dollars a year for Scale with 100,000 emails. The arithmetic tips in three places, and none of them is the sending. The first is deliverability: warming up the domain, evaluating DMARC reports, keeping complaint rates below Google's and Yahoo's thresholds and reacting when an address lands on a blocklist. The second is on-call duty: if sending fails at night, no sign-in link arrives. The third is maintenance after the builder leaves. It pays off when a customer contract demands storage in the Union and email volume is high.
Our advice
- Solo: Take it. The free plan and Pro carry a young product for a long time, and the switch stays small as long as templates live in React Email.
- Mid-market: Take it if no customer contract promises storage in the European Union. Otherwise add the vendor with the country USA to your own subprocessor list first, or pick a service with EU storage.
- Enterprise: Only consider it with an Enterprise contract. Settle storage location, training ban, deletion period, audit log and venue in writing before signing.
Who is behind it
Staying power: Funded
The company behind the product is Plus Five Five, Inc., with an address in San Francisco, and the Y Combinator directory gives 2023 as the founding year and the Winter 2023 batch. A commercial register extract could not be retrieved in this run, because the State of California's register blocks automated queries. Two financings are documented with dates: a 3-million-dollar seed round on 18 July 2023 and an 18-million-dollar Series A led by Andreessen Horowitz on 4 December 2024. On 3 June 2026 the vendor writes that it has been profitable since the previous year and employs 43 people, up from 28 in December 2025. Two acquisitions in 2025 are reported by the vendor with dates.
- Legal entity and address: Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, named as processor in Exhibit B of the data processing agreement; the vendor publishes no legal notice (Impressum)Data processing agreement of 27 August 2026: Plus Five Five, Inc. as processor with an address in San Francisco, subprocessors with 14 days' notice, transfers under modules two and three of the EU standard contractual clauses under Irish law, processing primarily in the United States, supplementary measures on requests from authorities, independent controllership for account and usage data, Data Privacy Framework, deletion within 90 days after the account endsOpen source · As of 2026-09-17
- Founding and batch: founded 2023, Winter 2023 batch at Y Combinator, team size 45 per the directory, retrieved 17.09.2026, against 43 in the vendor post of 03.06.2026, status activeFounded 2023, Winter 2023 batch at Y Combinator, team size 45Open source · As of 2026-09-17
- Seed financing 2023: 3 million dollars, vendor announcement of 18 July 2023, with Y Combinator and SV Angel plus founders such as Dylan Field, Guillermo Rauch and Paul CopplestoneSeed financing of 3 million dollars on 18 July 2023 with Y Combinator, SV Angel and founders as backersOpen source · As of 2026-09-17
- Series A 2024: 18 million dollars led by Andreessen Horowitz, vendor and investor announcements of 4 December 2024; neither announcement states whether existing shareholders sold stakesInvestor announcement of the investment dated 4 December 2024Open source · As of 2026-09-17
- Profitability and headcount by the vendor's own account, two dates: 18 December 2025: 1 million users, revenue up fivefold in 2025, team grown from 12 to 28 people; 3 June 2026: 3 million users, 43 people, profitable since the previous year; all figures without methodology and without published accountsVendor announcement of 3 June 2026: 3 million users, 43 people, profitable since the previous yearOpen source · As of 2026-09-17
- Acquisitions: Mergent, a background job service, announced on 23 April 2025; Briefer, announced on 5 August 2025; purchase prices not disclosedAcquisition of Mergent, announced on 23 April 2025Open source · As of 2026-09-17
Cost of leaving: Low
For plain transactional email the switch is small. Sending runs through an API or SMTP, and any other service accepts the same messages. Templates can be built with React Email, an open-source library from the vendor under the MIT licence that also works with other sending services. CSV exports exist for emails, broadcasts, contacts, domains, logs and keys. Three things still take time. First, deliverability: new DNS records for DKIM and SPF, and with dedicated IP addresses a warm-up phase in which emails arrive more slowly or in spam. Second, the suppression list of bounces and complaints, which has to move along so that blocked addresses stay blocked. Third, everything built in the vendor's editor: broadcasts, automations and editor templates exist in no standard format. Anyone running marketing there should plan for medium effort. The standard contract has no export window after cancellation, and deleting a team is immediate and final; only the enterprise terms guarantee 90 days of export.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, no condition attachedpublic, automatically in force for every account, with EU standard contractual clausesData processing agreement of 27 August 2026: Plus Five Five, Inc. as processor with an address in San Francisco, subprocessors with 14 days' notice, transfers under modules two and three of the EU standard contractual clauses under Irish law, processing primarily in the United States, supplementary measures on requests from authorities, independent controllership for account and usage data, Data Privacy Framework, deletion within 90 days after the account endsOpen sourceThe data processing agreement in its version of 27 August 2026 is available without login and, according to the GDPR page, takes effect when the account is created, pre-signed by the vendor, with no separate countersignature and tied to no plan. It covers subprocessors with 14 days' prior notice and a right to object, support with data subject requests, breach notification without undue delay, and audit rights once a year at the customer's cost. It carves out one role expressly: under Section 9 the vendor is an independent controller for account, billing and usage data. By its own account the vendor only negotiates changes to the agreement on the Enterprise plan.As of 2026-09-17 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, but unfavourableUnited States for all customer data; the Ireland region only controls sendingDocumentation on choosing a region: four sending regions, the region only controls route and sending location, account and email data sit in the United StatesOpen sourceThis is the profile's most important finding. When adding a domain you choose a sending region, including Ireland, and the vendor automatically recommends that region to users in Europe. The documentation on choosing a region makes clear, however, that the region only determines where emails are sent from. Message content, delivery logs, webhook payloads and account data sit in the United States regardless, and according to the GDPR page there is no setting that moves stored data to the European Union. Section 6.1 of the data processing agreement records that processing takes place primarily in the United States. The location is therefore clearly named, but the customer cannot choose it.As of 2026-09-17 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, tied to a condition22 named with purpose, all with the country USA; two analytics services only in the privacy policySubprocessor list of 27 August 2026 with 22 entries, all with the country USA, including Anthropic for artificial intelligence and RunPod for self-hosted language modelsOpen sourceThe list of 27 August 2026 names 22 subprocessors with purpose and the country USA for each, among them Amazon Web Services for hosting and sending, PlanetScale and Supabase for databases, Snowflake and Tinybird for data analysis, Svix for webhooks, Cloudflare as firewall, plus Anthropic for artificial intelligence and RunPod for self-hosted language models. Which customer data each service receives is not stated. The condition comes from the comparison: the privacy policy of the same date names Mixpanel and Plausible for analysing use of the service, and both are missing from the list. Anyone passing a list of their own on to customers should ask before signing whether customer data runs through those two services.As of 2026-09-17 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | documented, no condition attachedtransfer to the United States, based on standard contractual clauses and the EU-US Data Privacy FrameworkData processing agreement of 27 August 2026: Plus Five Five, Inc. as processor with an address in San Francisco, subprocessors with 14 days' notice, transfers under modules two and three of the EU standard contractual clauses under Irish law, processing primarily in the United States, supplementary measures on requests from authorities, independent controllership for account and usage data, Data Privacy Framework, deletion within 90 days after the account endsOpen sourceThe legal basis is anchored in the contract. Section 6.2 of the data processing agreement counts as entering into the EU standard contractual clauses, module two for controllers and module three for processors, under Irish law and Irish courts, plus the UK addendum and adjustments for Switzerland. Section 11 adds the certification under the EU-US Data Privacy Framework, which the vendor announced on 13 March 2025, and the GDPR page stresses that the standard contractual clauses apply independently of it. Section 6.6 contains supplementary measures on requests from authorities. That gives procurement everything it needs for its own transfer impact assessment.As of 2026-09-17 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | documented, tied to a conditioncontractual training ban only in the enterprise terms; standard terms are silentEnterprise terms of 17 August 2026: 99.99 per cent availability with service credits and a termination right for repeated outages, first response within one business day with no remedy, aggregated data, training ban in Section 6.4, AI features and agents in Section 9, liability caps, cyber insurance of at least one million dollars, 90-day export window and 30 days until deletion, venue San FranciscoOpen sourceSection 6.4 of the enterprise terms of 17 August 2026 prohibits using customer content to train models offered to other customers and excludes message bodies and recipients' personal data from any training corpus. Internal systems for spam detection, abuse and deliverability remain exempt, and Section 6.3 allows aggregated, de-identified data for the vendor's own purposes. The terms of service and the privacy policy that apply to the Free, Pro and Scale plans say nothing about training. That matters, because the product runs AI features on customer content and lists Anthropic and RunPod as subprocessors. Anyone buying below the Enterprise plan does not have the commitment.As of 2026-09-17 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, tied to a condition30 days in ongoing operation, deletion within 90 days after the account ends, backups 7 days; enterprise terms with a different periodGDPR page: all customer data stored in the United States regardless of sending region, agreement pre-signed for every account, 30-day retention on Free, Pro and Scale, deletion within 90 days, backups 7 days, no ISO/IEC 27001 and no HIPAA, contract changes only on the Enterprise planOpen sourceThe periods are quantified. On the Free, Pro and Scale plans emails and logs are kept for 30 days, on the Enterprise plan as agreed. Exhibit A of the data processing agreement promises deletion within 90 days after the account ends, and according to the security page backups exist for 7 days. The condition lies in the comparison with Section 15.4 of the enterprise terms: there a 90-day export window is followed by 30 days until deletion from production systems, up to 120 days in total. Which period applies belongs in the order form. At the same time, the 30-day period means that evidence of a sent email has gone from the vendor after one month.As of 2026-09-17 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, tied to a conditionSOC 2 Type II, reporting period 1 February 2025 to 1 February 2026, report only after login; no ISO/IEC 27001SOC 2 Type II, audited by Advantage Partners, reporting period 1 February 2025 to 1 February 2026, report and penetration test only after loginOpen sourceOne attestation is documented with auditor and period: SOC 2 Type II, audited by Advantage Partners, reporting period 1 February 2025 to 1 February 2026, plus an annual penetration test with a letter of attestation. Report and letter sit in the account's documents area; only the summary is public. The GDPR page expressly denies an ISO/IEC 27001 certificate and suitability for health data under HIPAA. The ISO attestations in Exhibit C of the data processing agreement belong to the data centre operators. The last publicly named reporting period ended on 1 February 2026; whether a follow-up report exists is not publicly visible.As of 2026-09-17 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | documented, but unfavourableAI features write email copy, no statement on the regulationPrices of the transactional and marketing plans, add-ons for domains, dedicated IP address and identity provider sign-in, automation runs, AI credits and the list of AI features, Enterprise tailored from roughly three million emails a monthOpen sourceThe product contains an AI system within the meaning of Regulation 2024/1689: in the editor it generates entire emails and rewrites passages, it builds automations, suggests subject lines and preview text, reviews content and answers questions through an assistant. The pricing page bills this through AI credits, and Section 9 of the enterprise terms covers outputs from third-party models and automated agents whose consequences the customer bears. The vendor mentions neither the regulation itself nor an ISO/IEC 42001 certification in any document read. Generated text only reaches recipients once the customer sends it, so the operator can set a label itself. Whether the vendor sees itself bound by Article 50 for text generation, it does not say.As of 2026-09-17 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, but unfavourablelog of API calls with export, 30 days; no documented audit log for sign-ins and team changesLog of API calls with endpoint, status, key and request and response body in the dashboardOpen sourceIn the dashboard customers see every API call with endpoint, method, status code, time, key, and request and response body, filterable, available through a dedicated API since 9 April 2026 and exportable as CSV. On the standard plans the retention period is 30 days. That answers the question of which machine sent what and when. The second half stays open: a log of dashboard sign-ins, role changes, keys created in the interface or changed domains is described neither in the documentation nor in the contract. Exhibit C of the data processing agreement describes logging only on the vendor's side.As of 2026-09-17 |
What it really costs
Entry price
Transactional email: Free with 3,000 emails a month and at most 100 a day, Pro from 20 dollars a month for 50,000 emails, Scale from 90 dollars for 100,000 up to 1,150 dollars for 2.5 million emails, with each further thousand at between 0.90 and 0.46 dollars. Marketing email is billed separately by contacts, from 40 dollars a month for 5,000 contacts. Enterprise on quote.Prices of the transactional and marketing plans, add-ons for domains, dedicated IP address and identity provider sign-in, automation runs, AI credits and the list of AI features, Enterprise tailored from roughly three million emails a monthOpen source
As of 2026-09-17
What gets expensive
In four places. First, sign-in through your own identity provider: a 150-dollar monthly surcharge on Scale, so 1,800 dollars a year just for sign-in, or a move to the Enterprise plan. Second, separate budgets: anyone sending both transactional and marketing email through the vendor pays both plans side by side, plus AI credits that expire each month and automation runs above 10,000 at 0.0015 dollars per run. Third, add-ons: a dedicated IP address for 30 dollars a month from 3,000 emails a day, and another 100 domains for 20 dollars. Fourth, the terms: under the terms of service prices may change at the end of every billing cycle, paid fees are not refunded, and liability is capped at the amount paid.
What it displaces
- Sending email through your web host's SMTP server
- Self-run Postfix mail servers for application email
- Hand-coded HTML table layouts for sign-in and invoice emails
- Sorting bounces and complaints in a shared mailbox
Interfaces
- REST API and SMTP relay, official libraries for Node.js, Python, PHP, Ruby, Go, Rust, Java and .NET
- React Email as an open-source template library under the MIT licence
- Signed webhooks for delivery, bounces, opens, clicks, domains and contacts
- Inbound email by webhook, including attachments
- Hosted MCP server, command line tool and skills for coding assistants
- Supabase, Vercel Marketplace, n8n, Zapier and Auth0
- Sign-in through your own identity provider as an add-on on Scale, included on Enterprise
- CSV exports for emails, broadcasts, contacts, domains, logs and keys
Matching methods
- Regulatory Density TestThe method measures how many obligations hang on a data flow. Application emails carry names, amounts and sign-in links, and the test shows whether storage in the United States is a footnote or a knock-out criterion for your own business.
- Activation as the Retention LeverActivation decides retention, and a new user's first touchpoint is often a confirmation or sign-in email. The method directs attention to deliverability as an activation metric in this case.
- "Context: Moat or Wall?" TestThe test asks whether an advantage remains when competitors buy the same thing. With email sending it does not, which explains why the building block is mandatory and why the choice should turn on storage location and contract.
Sources
- 1.Data processing agreement of 27 August 2026: Plus Five Five, Inc. as processor with an address in San Francisco, subprocessors with 14 days' notice, transfers under modules two and three of the EU standard contractual clauses under Irish law, processing primarily in the United States, supplementary measures on requests from authorities, independent controllership for account and usage data, Data Privacy Framework, deletion within 90 days after the account ends (opens in a new tab)resend.com/legal/dpa · As of 2026-09-17
- 2.Subprocessor list of 27 August 2026 with 22 entries, all with the country USA, including Anthropic for artificial intelligence and RunPod for self-hosted language models (opens in a new tab)resend.com/legal/subprocessors · As of 2026-09-17
- 3.Privacy policy of 27 August 2026: transfer to the United States, Mixpanel and Plausible for usage analytics, no statement on training (opens in a new tab)resend.com/legal/privacy-policy · As of 2026-09-17
- 4.Terms of service of 27 August 2026: price changes at the end of each billing cycle, no refunds, liability capped at the amount paid, Californian law, no statement on training or an export period (opens in a new tab)resend.com/legal/terms-of-service · As of 2026-09-17
- 5.Enterprise terms of 17 August 2026: 99.99 per cent availability with service credits and a termination right for repeated outages, first response within one business day with no remedy, aggregated data, training ban in Section 6.4, AI features and agents in Section 9, liability caps, cyber insurance of at least one million dollars, 90-day export window and 30 days until deletion, venue San Francisco (opens in a new tab)resend.com/legal/enterprise-terms · As of 2026-09-17
- 6.GDPR page: all customer data stored in the United States regardless of sending region, agreement pre-signed for every account, 30-day retention on Free, Pro and Scale, deletion within 90 days, backups 7 days, no ISO/IEC 27001 and no HIPAA, contract changes only on the Enterprise plan (opens in a new tab)resend.com/security/gdpr · As of 2026-09-17
- 7.Documentation on choosing a region: four sending regions, the region only controls route and sending location, account and email data sit in the United States (opens in a new tab)resend.com/docs/dashboard/domains/regions · As of 2026-09-17
- 8.SOC 2 Type II, audited by Advantage Partners, reporting period 1 February 2025 to 1 February 2026, report and penetration test only after login (opens in a new tab)resend.com/security/soc-2 · As of 2026-09-17
- 9.Security page: encryption at rest and in transit, backups 7 days, HIPAA in progress (opens in a new tab)resend.com/security · As of 2026-09-17
- 10.Prices of the transactional and marketing plans, add-ons for domains, dedicated IP address and identity provider sign-in, automation runs, AI credits and the list of AI features, Enterprise tailored from roughly three million emails a month (opens in a new tab)resend.com/pricing.md · As of 2026-09-17
- 11.Log of API calls with endpoint, status, key and request and response body in the dashboard (opens in a new tab)resend.com/docs/dashboard/logs/introduction · As of 2026-09-17
- 12.Admin and Member roles, two-factor sign-in cannot be enforced team-wide (opens in a new tab)resend.com/docs/dashboard/settings/team · As of 2026-09-17
- 13.Sign-in through your own identity provider since 1 September 2026, an add-on on Scale and included on Enterprise (opens in a new tab)resend.com/changelog/sso · As of 2026-09-17
- 14.CSV exports for emails, broadcasts, contacts, domains, logs and keys, generally available since 13 November 2025 (opens in a new tab)resend.com/changelog/exports-general-availability · As of 2026-09-17
- 15.Certification under the EU-US Data Privacy Framework, announced on 13 March 2025 (opens in a new tab)resend.com/changelog/data-privacy-framework-certification · As of 2026-09-17
- 16.Founded 2023, Winter 2023 batch at Y Combinator, team size 45 (opens in a new tab)ycombinator.com/companies/resend · As of 2026-09-17
- 17.Seed financing of 3 million dollars on 18 July 2023 with Y Combinator, SV Angel and founders as backers (opens in a new tab)resend.com/blog/resend-raises-3m-seed-round · As of 2026-09-17
- 18.Series A of 18 million dollars led by Andreessen Horowitz, announced on 4 December 2024, more than 200,000 registered developers by the vendor's own account (opens in a new tab)resend.com/blog/series-a · As of 2026-09-17
- 19.Investor announcement of the investment dated 4 December 2024 (opens in a new tab)a16z.com/announcement/investing-in-resend · As of 2026-09-17
- 20.Vendor announcement of 18 December 2025: 1 million users, revenue up fivefold, team grown from 12 to 28 people, two acquisitions (opens in a new tab)resend.com/blog/1-million-users · As of 2026-09-17
- 21.Vendor announcement of 3 June 2026: 3 million users, 43 people, profitable since the previous year (opens in a new tab)resend.com/blog/3-million-users · As of 2026-09-17
- 22.Acquisition of Mergent, announced on 23 April 2025 (opens in a new tab)resend.com/blog/resend-acquires-mergent · As of 2026-09-17
- 23.Documented outage on 15 February 2026 lasting 3 hours and 31 minutes, emails delayed by about two hours, none lost, dashboard unreachable (opens in a new tab)resend.com/blog/incident-report-for-february-15-2026 · As of 2026-09-17
- 24.Documented outage on 18 November 2025 from 11:30 to 14:31 UTC caused by a Cloudflare disruption, through which all API traffic runs (opens in a new tab)resend.com/blog/incident-report-for-november-18-2025 · As of 2026-09-17
- 25.Since 5 May 2026, AI chats in the editor and in automations draw on your own broadcasts, templates and properties (opens in a new tab)resend.com/changelog/mentions-in-ai-chats · As of 2026-09-17
- 26.No legal notice (Impressum) in the vendor's sitemap of 950 addresses (opens in a new tab)resend.com/sitemap.xml · As of 2026-09-17
Last reviewed: 2026-09-17 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.
From tool to decision
The offer that fits this tool
A tool profile tells you what the tool does and what it means for compliance. Whether it gets priority in your company is a management decision, and it takes one working day: the executive AI workshop ranks your initiatives by business value, risk, data readiness and ownership.