AhaSend

Transactional Email With the Paperwork Actually Done

AhaSend is a developer-facing sending service, competing with the transactional side of the large platforms. What makes it worth a close look here is not the API, which is conventional and well documented. It is that the compliance documentation is the best of any tool in this tranche, by a distance.

The Product

• REST API and SMTP relay with official SDKs, a CLI and sandbox mode
• Dedicated IPs with automated warm-up, dedicated IP pools, and bring-your-own-IP at the top tier
• Inbound email routing and signed webhooks, so replies and events come back into your own system
• Platform Partner features: sub-accounts, DNS whitelabeling, per-domain DKIM selectors and bring-your-own-DKIM keys, which is what you need if you are reselling sending inside your own product
• Reputation Shield and typosquatting protection
• Configurable retention, from zero days upward, so you can choose not to have message bodies stored at all

Pricing starts at a genuine free tier of 1,000 emails a month with no card, on the same multi-region EU infrastructure as the paid plans. Pro covers 25,000 and Max 100,000, with flat-rate billing plus per-thousand overage, in USD or EUR. There are no long-term contracts.

Named Sub-processors, With Countries

Most vendors write "we use third-party providers". AhaSend writes this:

Cloud Hosting and Infrastructure: Hetzner Online GmbH (Germany/Finland, and optionally USA if you chose to use our US-based SMTP relay) and DA International Group Ltd (operating as AlphaVPS, Bulgaria) to host our Services and associated data.

Then it names the US ones separately and says exactly what each does: Stripe for payments, PostHog for analytics, Cloudflare for website security, all three relying on the EU-US Data Privacy Framework, and Trackdesk in Czechia for the affiliate programme. It commits to erasing personal data within 14 days of an account deletion request, and explains that billing records are kept seven years because Dutch tax law requires it.

The DPA at ahasend.com/dpa is a real Article 28 agreement, not a compliance page: Annex 1 details of processing, Annex 2 technical and organisational measures, Annex 3 the live sub-processor list, with the online version declared authoritative.

Where the Exposure Actually Sits

Your message content and recipient data sit on Hetzner in Germany and Finland, and Hetzner is German. AlphaVPS is Bulgarian. So the default configuration keeps the email itself entirely inside EEA-owned infrastructure, which is rarer than it sounds in this category.

Two caveats, both stated by the vendor rather than found by us. First, the US providers are real but touch adjacent data: Stripe sees your billing details, PostHog sees product analytics, Cloudflare fronts the website. Second, AhaSend offers an optional US-based SMTP relay. If you choose it, your message data does go to Hetzner's US infrastructure, under Standard Contractual Clauses. That is a choice you make, not a default, and this listing rates the default.

ISO 27001 is listed as pending rather than held, which the site says itself.

Where It Fits

Compare with EmailLabs and MessageFlow in Poland, and with the transactional layer of Brevo and Mailjet. Among European senders, this is the one to point a developer at when the question is "where does the data actually go". See email deliverability.