Skip to main content
SendGrid logo

SendGrid

Based exclusively on public evidence • 20 criteria (Privacy + AI)
Last review: 26 Feb 2026

E-
AITS IA

AI Trust Summary

AI Training
Not disclosed in documentation
Data Retention
Not specified in documentation
Opt-out
Not available
AIPrivacy
E-
BasePrivacy
D-
  • Regarding AI: it does not document functionalities that use AI, which can generate distrust about data usage.
  • Regarding Core Privacy: it does not mention data retention periods, which can cause uncertainties about information security.

Safer Alternatives

Higher-rated software in the same category

See Full Alternative Comparison

Attention Points in AI (3)

AI criteria that require attention. Buy the Premium Analysis to see all 3 criteria.

  • SendGrid
  • Does not document functionalities that use AI, which can generate distrust.
  • Omission of explanations about automated decisions can cause user insecurity.
  • Require clarification on the use of AI and automated decisions in the contract.

Features using AI are not identified in the policy

The policy does not describe functionalities that use AI, which can generate distrust among users about the use of their data.

Automated AI decisions have no explanation available

The absence of explanations about automated decisions can generate insecurity among users about the processing of their email data.

AI data retention (prompts and responses) is not disclosed

The lack of information about the retention of email data and user interactions in AI systems can generate insecurity.

Source: vendor public documents

Compliances in AI (1)

AI criteria the company meets. Buy the Premium Analysis to see all 1 criteria.

  • SendGrid
  • Clearly identifies the company as the controller of email data and user interactions.
  • Lists data processing purposes, ensuring transparency about collection.
  • These practices facilitate due diligence and user trust.

Contestation and human review of AI decisions available

The policy mentions support channels, allowing users to contest automated decisions, which is positive for transparency.

Source: vendor public documents

Highlights in Privacy (3)

Most relevant criteria for this category. Buy the Premium Analysis to see all 3 criteria.

Data retention period not stated in the policy

The lack of mention of retention periods for email data and user interactions can cause uncertainty about information security.

Data controller and processor roles clearly defined

The policy clearly identifies SendGrid as the controller of email data and user interactions, essential for compliance.

Performance of contract legal basis applied to essential data

The policy mentions the legal basis for the use of email data and user interactions, essential for service operation.

Source: vendor public documents

Critical Alerts

  • Decisões automatizadas por IA não têm explicação disponível: A falta de transparência em decisões automatizadas pode afetar a confiança dos usuários no serviço..
  • Período de retenção de dados não informado na política: Não informar períodos de retenção pode gerar preocupações sobre a segurança e privacidade dos dados dos usuários.

Conformance analysis (20)

Premium Feature
AITS Criterion 9
Compliant

Data controller and processor roles clearly defined

Reference: ISO/IEC 27701 (7.3)

AITS Criterion 17
Compliant

Legal basis for contract execution applied to essential data

Reference: ISO/IEC 27701 (7.2.2)

AITS Criterion 18
Compliant

Legitimate interest with rights balancing clearly explained

Reference: ISO/IEC 27701 (7.2.2)

Source: vendor public documents

Follow this company and access all 20 criteria

Track score changes, get alerts on policy updates, and view the full conformance analysis

Sign up free

Don't miss any update

Sign up to follow this company and track changes in privacy and AI scores

Sign up free

Why trust the AITS Index: Open Community Audit

Public transparency, peer review and open evidence trails — all verifiable by the community

Trust guarantees

Peer review

users, professionals and experts confirm or contest items online.

Public history

vendor and index changes are versioned and accessible.

Participate

Evidence, confirmations and contestations

participate in the collaborative validation of AITS criteria

Contact us

SendGrid Email Marketing: Privacy and Security Insights

Clear Data Controller and Processor Roles

SendGrid excels in defining the roles of data controllers and processors, which is crucial for users concerned about data privacy. This clarity ensures that users know who is responsible for their data, thereby enhancing trust. With a defined framework, users can feel more secure knowing that their data is being handled by designated parties. This is particularly important under regulations like GDPR and LGPD, which emphasize accountability in data handling. Users should take advantage of this clarity by reviewing the roles defined in their agreements with SendGrid to ensure they align with their privacy expectations.

Clearly Listed Purposes for Data Processing

Another strength of SendGrid is its transparent listing of data processing purposes categorized by data type. This transparency allows users to understand exactly how their data will be used, which is essential for compliance with privacy regulations. Users can leverage this information to assess whether the data usage aligns with their own privacy policies. It’s advisable for users to periodically review these purposes to ensure that they remain comfortable with how their data is being utilized, especially as their marketing strategies evolve.

Lack of AI Functionality Documentation

Despite its strengths, SendGrid has notable weaknesses, particularly in the area of AI functionalities. The platform does not document features that utilize AI, which can lead to uncertainty about how user data is processed and analyzed. This lack of transparency can be a red flag for users, especially those who prioritize data privacy. To mitigate this risk, users should inquire directly with SendGrid about any AI features in use and request documentation to understand how their data is being handled. This proactive approach can help users make informed decisions about their data privacy.

Absence of Explanation for Automated Decisions

Another significant weakness is the absence of explanations for automated decisions made by AI. Users may find themselves in situations where decisions affecting their email campaigns are made without clear reasoning. This can be problematic, particularly under GDPR, which requires that users be informed about the logic behind automated decision-making processes. Users should consider implementing manual review processes for critical decisions or seek alternative solutions that provide greater transparency in AI functionalities.

Unspecified Data Retention Periods

SendGrid's policy does not specify data retention periods, which poses a risk for users concerned about data security. Without clear guidelines on how long data is retained, users cannot ensure compliance with regulations like GDPR and LGPD, which mandate that personal data should not be kept longer than necessary. Users should take the initiative to clarify these retention policies with SendGrid and consider implementing their own data retention schedules to ensure compliance and minimize potential risks.

Practical Steps for Enhanced Privacy

To enhance privacy while using SendGrid, users should regularly review their account settings and privacy policies. Enable features that allow for greater control over data sharing and processing. Additionally, consider using alternative email marketing platforms that offer more robust AI documentation and data retention policies if SendGrid's weaknesses are a concern. Regular audits of your email marketing practices can also help ensure compliance with privacy laws and maintain user trust. By taking these steps, users can navigate SendGrid's strengths and weaknesses more effectively, ensuring a more secure email marketing experience.

Other Email Marketing software

Dive into in-depth research and analysis of each player

Source: vendor public documents

Evidence, confirmations and contestations

participate in the collaborative validation of AITS criteria

Contact us

Scope & Limitations

TrustThis/AITS assessments are based exclusively on publicly available information, duly cited with date and URL, following the AITS methodology (privacy & AI transparency).

The content is indicative in nature, intended for screening and comparison, not replacing internal audits.

TrustThis/AITS does not perform invasive tests, does not access vendor technology environments and does not process customer personal data. Conclusions reflect only the vendor's public communication at the date of collection.

Source: vendor public documents