Postmark (ActiveCampaign)
Communications API · postmarkapp.com · last read 2026-11-09
At a glance
- Is Postmark (ActiveCampaign) GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Postmark (ActiveCampaign) itself publishes, each answer linked to its source and the date we read it.
- Does Postmark (ActiveCampaign) have a data processing agreement (DPA)?
- Yes. Postmark (ActiveCampaign) publishes a data processing agreement at postmarkapp.com. It gives between 14 and 30 days' notice before a new subprocessor is added, depending on the case; the terms tab gives each. It promises breach notification "without undue delay", with no number of hours. Source and date
- Which version of the Postmark (ActiveCampaign) DPA is current?
- On 2026-11-09, Postmark (ActiveCampaign)'s DPA at postmarkapp.com printed “Effective November 17, 2025”. Source and date
- How does Postmark (ActiveCampaign) transfer personal data out of the EU?
- Postmark (ActiveCampaign)'s agreement relies on the EU standard contractual clauses, the EU-U.S. Data Privacy Framework and the UK transfer addendum. ActiveCampaign, LLC (covered entity: AC PM LLC) is on the official Data Privacy Framework List (status: Active). Source and date
- Where does Postmark (ActiveCampaign) store EU customer data?
- The vendor states that no EU location is offered. Source and date
- Who are Postmark (ActiveCampaign)'s subprocessors?
- Postmark (ActiveCampaign) lists 5 third-party subprocessors; 1 of them name at least one processing country outside the EEA. We last read the list on 2026-10-25. The page we read covers only part of the list. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | AC PM, LLC |
|---|---|
| HQ | — |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | postmarkapp.com · 2026-10-25 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | No EU location | — | postmarkapp.com | 2026-10-25 |
EU: Postmark says it is a US-based company that stores its data in the US, including the data it processes for customers. The FAQ acknowledges that it doesn't have servers in the EU and relies on SCCs for transfers instead.
The same question for every vendor: where SaaS vendors store EU data.
Postmark (ActiveCampaign)'s subprocessor list names AWS for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
5 third parties · 1 with a country outside the EEA · all read 2026-10-25 · partial: the page we read covers only part of the vendor's subprocessors
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services | — | Cloud infrastructure hosting |
| Amazon Web Services (AWS) | — | Hosting of primary data and servers |
| Deft | US | Hosting of primary data and servers (data center) |
| Deft (formerly known as ServerCentral) | — | Infrastructure hosting |
| Zendesk | — | help desk software to communicate with our customers |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-25 · postmarkapp.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | By updating the Sub-processor webpage; customer can subscribe to email notifications via a form on that page; no advance notice period stated |
| Notice of new subprocessors | Module Three: 30 days in advance, specific written notice to controller of additions/replacements to agreed list |
| Notice of new subprocessors | Module Two: 14 days in advance, specific written notice to data exporter of additions/replacements to agreed list |
| If you object to one | Customer may object in writing, on reasonable grounds relating to the protection of personal data, within 7 days of notice; if it does not, it is deemed to consent |
| If you object to one | Customer may object to changes before the sub-processor is engaged; importer must provide information needed to exercise the right to object |
| Obligations passed to subprocessors | Sub-processor access restricted to what is strictly necessary for its subcontracted services; sub-processor prohibited from processing personal data for any other purpose |
| Breach notification | without undue delay (commercially reasonable efforts) |
| Breach notification | without undue delay after becoming aware of the breach |
| Breach notification | without undue delay after becoming aware of the breach (to data exporter and, where appropriate and feasible, the controller) |
| Deletion when the service ends | When the customer terminates its use of the Services, the vendor deletes the customer's user/customer data within 30 days of account termination |
| Getting your data back | upon termination and written request by the customer, returns all personal data to the customer (or destroys it) |
| Requests from data subjects | Notifies User of any third-party or Data Subject request to restrict, port, access, rectify or erase Personal Information; uses commercially reasonable efforts to assist User, on reasonable written request, where User cannot access the data through the Service |
| Audit | Audit Information (records and information demonstrating compliance) on written request identifying the information and legal requirement, up to once per year, where required by Data Protection Law; separate NDA required; at User's cost |
| Audit | Audit per Section 7 of the DPA; scoped to matters not covered by Audit Information; no more than annually unless breach or suspected non-compliance; 90 days' advance audit plan; at customer's expense with day rates; auditor NDA required |
| Audit | Audits at reasonable intervals or on indications of non-compliance; by exporter or independent auditor; may include on-site inspections with reasonable notice; certifications may be considered |
| Audit | Customer may rely on a current SOC 2 report or third-party audit, or conduct an independent audit under SCC Clause 8.9 at its own cost (auditor fees); scope, timing and duration of any on-site audit to be agreed beforehand |
| Audit | Exporter may audit itself or mandate an independent auditor; may include inspections at premises with reasonable notice |
| Audit | Importer provides information to show compliance and allows audits at exporter's request, at reasonable intervals or if there are signs of non-compliance; exporter may audit itself or appoint an independent auditor; audits may include on-site inspections with reasonable notice |
| Audit | SCC Clause 8.9 audits performed in accordance with Section 7 of the DPA |
| Audit | audits by data exporter at reasonable intervals or if there are indications of non-compliance; relevant certifications may be taken into account |
| Transfer impact assessment | Exporter is responsible for checking whether the laws of the destination country stop the Importer from complying; the Importer will make commercially reasonable efforts to tell the Exporter if it can no longer comply |
| Transfer impact assessment | Parties assess third-country laws and practices (Clause 14(b)), document the assessment, and make it available to the competent supervisory authority on request; importer provides relevant information to exporter |
| Processing on your instructions | only in accordance with User's documented instructions; no retaining, using or disclosing outside the direct business relationship, and no selling or sharing |
| Confidentiality of staff | AC PM personnel processing Personal Information are subject to obligations of confidentiality |
| Security measures | technical and organizational measures set out in Schedule 2 of the DPA |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
On 2026-11-09, the agreement printed: Effective November 17, 2025
at postmarkapp.com
In effect from 2025-11-17
This version is in our copies from 2026-10-25.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
No certification claims transcribed yet.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · ActiveCampaign, LLC (covered entity: AC PM LLC) | Active | non-HR data | 2027-09-24 | 2026-10-25 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · ActiveCampaign, LLC (covered entity: AC PM LLC) | Active | non-HR data | 2027-09-24 | 2026-10-25 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · ActiveCampaign, LLC (covered entity: AC PM LLC) | Active | non-HR data | 2027-09-24 | 2026-10-25 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under AC PM, LLC; Postmark (ActiveCampaign)
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under AC PM, LLC; Postmark (ActiveCampaign)
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under AC PM, LLC; Postmark (ActiveCampaign)
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under AC PM, LLC; Postmark (ActiveCampaign)
- Data Privacy Framework List (US): checked 2026-11-09, 3 entries under AC PM, LLC; Postmark (ActiveCampaign)
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under AC PM, LLC; Postmark (ActiveCampaign)
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under AC PM, LLC; Postmark (ActiveCampaign)
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under AC PM, LLC; Postmark (ActiveCampaign)
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under AC PM, LLC; Postmark (ActiveCampaign)
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under AC PM, LLC; Postmark (ActiveCampaign)
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: no security.txt at the well-known path (read 2026-10-25)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| dpa | Public | full | 200 | 2026-10-25 |
| identity | Public | full | 200 | 2026-10-25 |
| residency | Public | full | 200 | 2026-10-25 |
| subprocessors | Public | partial | 200 | 2026-10-25 |
History
Nothing has moved since we started watching this vendor on 2026-10-25. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.