

SendGrid
Based exclusively on public evidence • 20 criteria (Privacy + AI)
Last review: 26 Feb 2026
AI Trust Summary
- •Regarding AI: it does not document functionalities that use AI, which can generate distrust about data usage.
- •Regarding Core Privacy: it does not mention data retention periods, which can cause uncertainties about information security.
Safer Alternatives
Higher-rated software in the same category
Attention Points in AI (3)
AI criteria that require attention. Buy the Premium Analysis to see all 3 criteria.
- •SendGrid
- •Does not document functionalities that use AI, which can generate distrust.
- •Omission of explanations about automated decisions can cause user insecurity.
- •Require clarification on the use of AI and automated decisions in the contract.
Features using AI are not identified in the policy
The policy does not describe functionalities that use AI, which can generate distrust among users about the use of their data.
Automated AI decisions have no explanation available
The absence of explanations about automated decisions can generate insecurity among users about the processing of their email data.
AI data retention (prompts and responses) is not disclosed
The lack of information about the retention of email data and user interactions in AI systems can generate insecurity.
Source: vendor public documents
Compliances in AI (1)
AI criteria the company meets. Buy the Premium Analysis to see all 1 criteria.
- •SendGrid
- •Clearly identifies the company as the controller of email data and user interactions.
- •Lists data processing purposes, ensuring transparency about collection.
- •These practices facilitate due diligence and user trust.
Contestation and human review of AI decisions available
The policy mentions support channels, allowing users to contest automated decisions, which is positive for transparency.
Source: vendor public documents
Highlights in Privacy (3)
Most relevant criteria for this category. Buy the Premium Analysis to see all 3 criteria.
Data retention period not stated in the policy
The lack of mention of retention periods for email data and user interactions can cause uncertainty about information security.
Data controller and processor roles clearly defined
The policy clearly identifies SendGrid as the controller of email data and user interactions, essential for compliance.
Performance of contract legal basis applied to essential data
The policy mentions the legal basis for the use of email data and user interactions, essential for service operation.
Source: vendor public documents
Critical Alerts
- •Decisões automatizadas por IA não têm explicação disponível: A falta de transparência em decisões automatizadas pode afetar a confiança dos usuários no serviço..
- •Período de retenção de dados não informado na política: Não informar períodos de retenção pode gerar preocupações sobre a segurança e privacidade dos dados dos usuários.
Conformance analysis (20)
Data controller and processor roles clearly defined
Reference: ISO/IEC 27701 (7.3)
Legal basis for contract execution applied to essential data
Reference: ISO/IEC 27701 (7.2.2)
Legitimate interest with rights balancing clearly explained
Reference: ISO/IEC 27701 (7.2.2)
Source: vendor public documents
Follow this company and access all 20 criteria
Track score changes, get alerts on policy updates, and view the full conformance analysis
Don't miss any update
Sign up to follow this company and track changes in privacy and AI scores
Why trust the AITS Index: Open Community Audit
Public transparency, peer review and open evidence trails — all verifiable by the community
Trust guarantees
Peer review
users, professionals and experts confirm or contest items online.
Public history
vendor and index changes are versioned and accessible.
Participate
Evidence, confirmations and contestations
participate in the collaborative validation of AITS criteria
SendGrid Email Marketing: Privacy and Security Insights
Clear Data Controller and Processor Roles
SendGrid excels in defining the roles of data controllers and processors, which is crucial for users concerned about data privacy. This clarity ensures that users know who is responsible for their data, thereby enhancing trust. With a defined framework, users can feel more secure knowing that their data is being handled by designated parties. This is particularly important under regulations like GDPR and LGPD, which emphasize accountability in data handling. Users should take advantage of this clarity by reviewing the roles defined in their agreements with SendGrid to ensure they align with their privacy expectations.
Clearly Listed Purposes for Data Processing
Another strength of SendGrid is its transparent listing of data processing purposes categorized by data type. This transparency allows users to understand exactly how their data will be used, which is essential for compliance with privacy regulations. Users can leverage this information to assess whether the data usage aligns with their own privacy policies. It’s advisable for users to periodically review these purposes to ensure that they remain comfortable with how their data is being utilized, especially as their marketing strategies evolve.
Lack of AI Functionality Documentation
Despite its strengths, SendGrid has notable weaknesses, particularly in the area of AI functionalities. The platform does not document features that utilize AI, which can lead to uncertainty about how user data is processed and analyzed. This lack of transparency can be a red flag for users, especially those who prioritize data privacy. To mitigate this risk, users should inquire directly with SendGrid about any AI features in use and request documentation to understand how their data is being handled. This proactive approach can help users make informed decisions about their data privacy.
Absence of Explanation for Automated Decisions
Another significant weakness is the absence of explanations for automated decisions made by AI. Users may find themselves in situations where decisions affecting their email campaigns are made without clear reasoning. This can be problematic, particularly under GDPR, which requires that users be informed about the logic behind automated decision-making processes. Users should consider implementing manual review processes for critical decisions or seek alternative solutions that provide greater transparency in AI functionalities.
Unspecified Data Retention Periods
SendGrid's policy does not specify data retention periods, which poses a risk for users concerned about data security. Without clear guidelines on how long data is retained, users cannot ensure compliance with regulations like GDPR and LGPD, which mandate that personal data should not be kept longer than necessary. Users should take the initiative to clarify these retention policies with SendGrid and consider implementing their own data retention schedules to ensure compliance and minimize potential risks.
Practical Steps for Enhanced Privacy
To enhance privacy while using SendGrid, users should regularly review their account settings and privacy policies. Enable features that allow for greater control over data sharing and processing. Additionally, consider using alternative email marketing platforms that offer more robust AI documentation and data retention policies if SendGrid's weaknesses are a concern. Regular audits of your email marketing practices can also help ensure compliance with privacy laws and maintain user trust. By taking these steps, users can navigate SendGrid's strengths and weaknesses more effectively, ensuring a more secure email marketing experience.
Other Email Marketing software
Dive into in-depth research and analysis of each player

Adobe Marketo Engage
Oracle Eloqua

Brevo

Customer.io

Drip

EngageBay

Zoho Marketing Automation

Constant Contact
Source: vendor public documents
Analyzed Sources
Public documents used in the audit of SendGrid:
Evidence, confirmations and contestations
participate in the collaborative validation of AITS criteria
Scope & Limitations
TrustThis/AITS assessments are based exclusively on publicly available information, duly cited with date and URL, following the AITS methodology (privacy & AI transparency).
The content is indicative in nature, intended for screening and comparison, not replacing internal audits.
TrustThis/AITS does not perform invasive tests, does not access vendor technology environments and does not process customer personal data. Conclusions reflect only the vendor's public communication at the date of collection.
Source: vendor public documents