Commercial disclosure: this article contains affiliate links. EuroAIGuide may earn a commission if you sign up through them. It never changes a verdict, and the sovereignty score below is never influenced by whether a tool pays us.
This is general information, not legal advice.
Evidence note: everything marked 🔵 was verified on 13 October 2026 against Brevo’s own terms, privacy policy, help centre, security page and investor announcements, with section numbers where the wording matters. The usability section is 🟢, from our own hands-on account.
How we test: https://euroaiguide.com/how-we-test/
In December 2025, Brevo announced that it had “become a unicorn following a new €500 million funding round.”
The European Commission described the same event as an acquisition of joint control, and cleared it as one.
Both are accurate, and the gap between them is a good place to start, because Brevo turns out to be the most interesting case we have examined this year: a company whose compliance story is considerably better than the category average in the place that usually fails, and quietly weaker in a place almost nobody checks.
What Brevo is
Email marketing and customer engagement. Campaigns, automation, transactional email, SMS, WhatsApp, a CRM layer, live chat, and an AI assistant called Aura running across all of it. Formerly Sendinblue, renamed Brevo in 2023. Around 600,000 customers in 180 countries.
Who owns it 🔵
The contracting entity for most European customers is Sendinblue SAS, trading as Brevo, at 17 rue Salneuve, Paris, RCS Paris 498 019 298. Founded by Armand Thiberge in 2012, who is still CEO.
On 7 October 2025 the European Commission cleared “the acquisition of joint control” of the Brevo holding company by Thiberge, Oakley Capital and General Atlantic. The deal closed that December at a valuation above one billion euro. Joint control is the operative phrase: the founder is a controlling party, not a passenger.
Reported stakes, from trade coverage rather than official disclosure, put management and employees at around 26 percent, General Atlantic at 25, Oakley at 25, and Bpifrance with Bridgepoint at a combined 24. Treat the precise numbers as indicative. The structure they describe is corroborated by Oakley’s own statement that management and employees are the largest combined shareholder group.
Three things make this unlike the pattern this site keeps finding.
The founder retained joint control. Pipedrive’s founder did not. Sellsy’s founders did not.
Bpifrance is still on the register. The French state investment bank reinvested rather than exiting.
The acquiring vehicles are European-registered. Oakley Viking Luxco in Luxembourg, General Atlantic Bloom B.V. in the Netherlands. General Atlantic is an American firm and that is a real consideration, but the holding structure sits in the EU.
Brevo is also a certified B Corp, an EcoVadis Bronze holder and a member of France’s Next40. It has made eleven acquisitions, including Newsletter2Go in Germany and Metrilo in Bulgaria, and reports ARR above 200 million euro with roughly 99 percent recurring revenue.
The contract follows the ownership. European customers get French law and the Commercial Court of Paris (Section 16). Germany, Austria and Switzerland contract with Brevo GmbH in Berlin under German law. Only US, Canadian and Mexican customers get Delaware (Appendix 2).
That runs opposite to the usual arrangement, where European customers are routed through an Irish entity and American law. Here the Americans get Delaware and the Europeans get Paris or Berlin.
Where your data actually sits 🔵
This is where Brevo is much better than we expected, and where we owe a correction.
Brevo’s privacy policy says only that data is stored in “Tier 3 and PCI DSS certified data centers,” naming no country. Its marketing pages say your data is “backed up across three geographically distinct servers,” which sounds like a residency statement and contains no information at all.
But the help centre and security page are specific, and they are the documents that count:
“The hosting servers on which Brevo processes and stores its databases are all located within the European Union.”
OVH is the primary host, in France and Germany. OVH is a French provider. Google Cloud in Belgium handles encrypted backups, with data encrypted before it is stored there. Backups run at least weekly, copied at least three times across at least two geographical locations.
There is no region selector because there is no other region. EU hosting is the only configuration, on every plan including Free.
Say that plainly, because it is rare. ElevenLabs gates EU residency behind an Enterprise sales conversation. Most American tools do the same or offer nothing. Brevo gives a business paying zero euro the same EU-only hosting as its largest enterprise customer. In three months of reviewing this category we have not found another vendor that does.
Now the part that is not in the marketing.
EU hosting is a statement about where data rests, not about who can reach it. Brevo’s privacy policy confirms personal data may be transferred “in particular to the United States of America and India,” under Standard Contractual Clauses with supplementary measures, plus EU-U.S. Data Privacy Framework certification for Brevo Inc.
Those transfers are not mysterious once you look at the group structure. Brevo CRM Solutions Private Ltd in Noida, India, and Sendinblue Inc. in the United States run support and operations. Sendinblue was founded in Paris and Noida simultaneously in 2012, so the Indian operation is not an outsourcing arrangement, it is part of the company.
A third-party GDPR review of Brevo put the point better than we could: the EU promise covers storage, not access.
Your subscriber list sits on OVH servers in France. A support engineer in Noida or Seattle can reach it.
That is not a scandal, and it is covered by a recognised transfer mechanism. But it is the question a data protection officer will ask after they have been reassured about hosting, and Brevo’s own pages do not volunteer it.
The sub-processors. The full annex sits inside the Terms and did not load for us when we tried to read it. A third-party review reproduces what appears to be most of it:
| Sub-processor | Purpose | Location reported |
|---|---|---|
| OVH | Hosting | France |
| Google Cloud | Hosting and backups | Belgium |
| Cloudflare | CDN and web firewall | USA and EU |
| Zendesk | Support tickets | EU and USA |
| Convrrt | Landing pages | USA |
| OpenAI | AI features | EU and USA |
| Google Gemini | AI features | EU and USA |
| Anthropic | AI features | USA |
| Langfuse | AI monitoring | EU |
| Brevo CRM Solutions | Support and operations | Access from India |
| Sendinblue Inc. | Support and operations | Access from USA |
Treat that table as indicative rather than authoritative, since we could not load the primary annex. If sub-processor locations matter to your assessment, request the current annex from Brevo directly. Note in particular that landing pages run through a US provider, which is worth knowing if you assumed everything in the product followed the hosting.
The paperwork is good. The DPA is built into the standard Terms, so it covers every customer including free ones. New sub-processors come with notice before authorisation, and you may terminate within 30 days if you object on EU law grounds. Audits are permitted once per contract year. Data is destroyed within three months of termination on request. There is a named DPO in Paris and a UK Article 27 representative. ISO 27001:2022 is held, with the certificate downloadable from the security page. We found no SOC 2.
The AI clause 🔵
A tool that pays us commission gets the same treatment as one that does not.
Section 6.7: “Brevo may use Content and Usage Data to enrich and train its AI Features.”
No opt-out is documented anywhere we could find. The Control Center manages AI features, but the terms state that AI-driven dashboards and embedded fraud and spam detection “are essential components and cannot be disabled.”
Section 6.2: your Input and Output “will be shared with and processed by AI Third-Party Products.” Per the sub-processor list, those include OpenAI, Google Gemini and Anthropic, with Anthropic shown as US-located.
The terms do say “The AI Features do not process Your data unless You actually and actively use the AI Features,” which narrows the exposure to use rather than to having an account. Brevo also states that third-party AI providers may use data only to deliver the feature, that it does not deploy general-purpose AI models in the service, and that its features are minimal or limited risk under the EU AI Act.
But Aura is woven through the free tier, not reserved for paying customers. Free accounts get AI email generation, an AI image generator and an AI guided builder that configures automation workflows from a plain-text description. Those are among the most prominent things the free plan offers. Avoiding AI is possible and it means working against the grain of the product.
There is also an obligation pointing back at you: customers must not put special category personal data under Article 9 into AI features, and must review outputs. If you process health, biometric or similar data, that is a hard constraint on how you use this product.
One loose thread worth noting. Brevo’s AI Lab announcement says its agents run “on its existing servers within the European Union,” which sits awkwardly beside a sub-processor list showing US-located AI providers. The likely explanation is that in-house models are EU-hosted while some Aura features call external providers. We could not confirm which is which, and if your use is sensitive, that is the question to put to Brevo.
The content licence is broad. Section 7.1 grants Brevo an “irrevocable, worldwide, fully paid-up and royalty free, non-exclusive, unlimited license” over Customer Content, with “the right to sublicense and assign to third parties.” Read alongside Section 7.4, which deletes content on termination, it is more ordinary than it reads. Sublicensable and assignable is still a wider grant than several competitors ask for.
Languages: the gap for Central and Eastern Europe 🔵
Brevo’s interface and support run in six languages: English (US and UK), French, German, Spanish, Italian and Portuguese.
That is six of the 24 official EU languages, all Western European. It covers the UK, Ireland, France, Belgium’s French speakers, Luxembourg, Germany, Austria, Switzerland, Spain, Italy and Portugal natively.
It does not cover Dutch, Polish, Czech, Slovak, Hungarian, Romanian, Bulgarian, Greek, Croatian, Slovenian, Estonian, Latvian, Lithuanian, Irish or Maltese. Teams in the Netherlands, Flanders, Poland, Czechia and across the Baltics and the Balkans use the product in English and raise support tickets in English.
The content you send is unaffected. You write your own campaigns, in any language you like(It did work in Finnish with the AI!), with any alphabet. This is a limit on the admin experience and the support relationship, not on what reaches your subscribers.
Whether that matters depends entirely on your team. For a Warsaw marketing department comfortable in English, it is a non-issue. For a Czech business whose marketing coordinator is not, it is the thing that decides the purchase, and it will not appear on any comparison chart.
Two paid features are worth knowing about: multi-language campaigns, launched March 2026, which send language variants of one campaign and require Enterprise or Professional plus an add-on, and Aura translation into a stated 18 languages, on Professional and above. Brevo does not publish which 18. If a specific language matters, ask before you buy.
What it is like to use 🟢
The website is the first thing you notice, and it is noticeably well built. Everything loads quickly, nothing hangs, and the whole thing is easy on the eye. That sounds like faint praise until you have sat through a few marketing platforms that feel like they were assembled in 2014 and patched ever since.
The free version is where Brevo separates itself, and not in the way most free tiers do.
A lot of the functionality is genuinely available. Not a locked demo with a tour, not three features and a sales call. You can actually use the thing. For a small business working out whether an email platform fits before committing budget, that is the difference between evaluating a product and looking at a brochure.
And when something is not available on free, it says so clearly. The interface marks gated features rather than hiding them, letting you click through to a dead end, or quietly degrading. You can see the shape of the paid product from inside the free one, which makes the upgrade decision an informed one.
That is worth naming because the opposite is so common. Plenty of tools in this category want a substantial payment up front while showing you almost nothing, which reads as faintly scammy even when the product turns out to be fine. Brevo is the opposite of that pattern, and it is the single thing we would point to if asked why the free tier is worth starting on.
Our full hands-on comparison against MailerLite, GetResponse and ActiveCampaign is in the email marketing guide.
The free tier is the story 🔵
Most free tiers in this category are a demo with a countdown. Brevo’s is a working business tool.
The limits: 300 emails per calendar day, resetting every 24 hours. Up to 100,000 contacts. One administrator seat. No credit card required.
That contact figure deserves a second look. Brevo prices by email volume, not list size. Almost everyone else does the opposite. MailerLite restructured its free plan in August 2026 down to 250 subscribers and 2,500 emails a month. Brevo’s free tier holds four hundred times the contacts.
If you have a large list you email occasionally, Brevo free is in a category of one. If you have a small list you email daily, the 300-a-day ceiling bites first.
What you get for nothing:
- Full drag-and-drop editor, template library, custom HTML, media library with an AI image generator
- Aura AI generation for subject lines and body copy
- Marketing automation, including pre-built welcome, abandoned cart, post-purchase, birthday and activity-triggered flows, plus a guided builder that configures a workflow from plain text
- A lightweight CRM: contact profiles with full interaction history, unlimited lists and dynamic segments, companies, tasks, and a visual deals pipeline up to 50 open deals
- Transactional infrastructure: SMTP relay on port 587, REST APIs, webhooks
- Live chat with a shared team inbox and real-time visitor monitoring
- A meetings scheduler
- One-click sync with Shopify, WooCommerce, PrestaShop, Magento, BigCommerce, Shopware and nopCommerce
- Hosted and embedded forms with GDPR consent checkboxes and CAPTCHA
Transactional email APIs and a working automation engine on a free plan is not normal. Neither is a CRM. Most competitors gate at least two of those behind the first paid tier.
What is locked: landing pages, pop-up forms, push notifications, conversion analytics, custom objects, A/B testing and send-time optimisation.
Pricing 🔵
Monthly Prices:
Brevo publishes in 17 currencies. The European ones are EUR, GBP, CHF and RON. There is no PLN, CZK or HUF, so buyers in Poland, Czechia and Hungary pay in euro and carry the conversion themselves. Annual billing saves about 10 percent.
Monthly Prices:
| Tier | EUR | GBP | CHF | USD |
|---|---|---|---|---|
| Free | €0 | £0 | CHF 0 | $0 |
| Starter | €7 | £6 | CHF 7 | $9 |
| Standard | €15 | £13 | CHF 15 | $18 |
| Professional | €499 | £429 | CHF 489 | $499 |
| Enterprise | Custom | Custom | Custom | Custom |
Prices updated: 13th of October 2026
These are entry prices. The real cost scales with email volume, contact count and seats, and SMS, WhatsApp credits and add-ons are extra. Sales and CRM sit alongside as separate packages: free up to 50 open deals, Sales Essentials at €29 a month, Sales Advanced at €59.
Payment methods:
Payment is by card through Adyen or Stripe, PayPal, or SEPA direct debit for European billing countries, though not on the first payment. Adyen is Dutch. Non-standard invoicing arrangements carry a €100 per year fee, and French public bodies can pay through Chorus Pro for €100 per purchase. Prices exclude VAT, which is added by country once you enter your VAT number.
One structural detail that matters more than any of the above: the DPA is built into the Terms rather than sold as an enterprise add-on, so it covers free-tier users. Most vendors in our free AI tools guide offer no processor agreement at any consumer tier.
Professional use is mandatory. Section 1.3 requires use “for the sole purpose of your professional activity, excluding any use as a non-professional or consumer.” A personal newsletter is outside the terms.
Verdict
If you want European hosting without an enterprise contract, this is the best answer we have found in any category. EU-only hosting on OVH in France and Germany, on every plan including the free one, with no region to select because there is no alternative region. A French parent, French or German law, ISO 27001:2022, and a DPA that covers you from zero euro.
If your assessment goes beyond hosting to access, read the sub-processor section again. Group entities in the United States and India reach data stored in France for support and operations. That is covered by Standard Contractual Clauses and it is lawful. It is also the thing Brevo’s reassuring pages do not say, and the thing your DPO will ask about second.
If you use the AI features, your content and usage data may train them, there is no documented opt-out, and third-party providers including US-located ones are in the chain. Article 9 data must not go near them.
If your team does not work in English, check the six-language list before anything else. Dutch, Polish, Czech, Hungarian, Greek and the Baltic languages are not supported in the interface or support, but you can use the AI functions with the native language.
If you are a small business, the free tier is the most generous in the category by a distance, and nothing else gives you a DPA and EU hosting at zero euro.
The honest summary: Brevo solves the problem most European buyers are actually worried about, which is where the data lives, and solves it for everyone rather than for enterprise customers only. What it does not do is volunteer who can reach that data from outside the EU. One of those is a genuine achievement. The other is a question you have to ask yourself.
Scores
Sovereignty: 7/10 🔵 Based on documentation, which is the only way sovereignty can be assessed.
In favour: EU-only hosting on every plan including Free, at OVH in France and Germany with encrypted backups on Google Cloud in Belgium. A French parent with French law and Paris courts, and a German entity with German law for DACH. Founder in joint control, management and employees the largest shareholder block, Bpifrance still invested. ISO 27001:2022 with a downloadable certificate. A DPA built into the standard Terms, covering free users. Sub-processor notice with a 30-day objection right. A named DPO in Paris. Certified B Corp.
Against: group access from the United States and India for support and operations, which the hosting claim does not cover. US-located sub-processors for landing pages and some AI features. The full sub-processor annex did not load for us. AI training on content and usage data with no documented opt-out. A content licence that is sublicensable and assignable. General Atlantic, a US firm, holding roughly a quarter of the company. Interface and support in six Western European languages only. No SOC 2 found.
Seven rather than higher because EU hosting is not EU-only access, and because a buyer cannot read the sub-processor annex without asking for it. Seven rather than lower because giving a free-tier user the same EU hosting, the same DPA and the same ISO-certified infrastructure as an enterprise customer is a structural commitment rather than a marketing line, and nothing else we have reviewed does it.
For comparison on this scale: Pipedrive scored 6, ElevenLabs 4. Brevo is the highest sovereignty score we have given a tool in this category.
Usability: 8/10 Based on signup, the interface and working through the free tier. We have not run a full campaign to a real list, so this covers the evaluation experience rather than daily production use, and gets revisited when it does.
What earns it: no card at signup, a free tier with real capability including automation and a CRM, honest labelling of what your plan includes, a fast uncluttered interface, and self-serve cancellation.
What holds it at 8 rather than higher: there was no website translation for the European customers, I mean most of the languages, but on the positive, the AI functions were working still with Finnish language for example, so thats a positive.
Sources
All checked 13 October 2026 unless a page carries its own date.
- Contracting entities, governing law, content licence (7.1), deletion (7.4), AI training (6.7), third-party AI processing (6.2), professional use (1.3), DPA as Appendix 3, country-specific terms (Appendix 2): brevo.com/legal/termsofuse
- Transfers to the US and India, Data Privacy Framework certification, named third parties, DPO contact: brevo.com/legal/privacypolicy
- EU-only hosting, OVH France and Germany, Google Cloud Belgium, backup practice: Brevo help centre, data storage location and brevo.com/security
- Interface and support languages: Brevo help centre, change account language and contact support
- Aura AI capabilities and translation: Brevo help centre, Aura
- Multi-language campaigns, March 2026: Brevo release notes
- AI Lab and EU-hosted agents claim: Brevo press release
- Currencies, payment methods, invoicing fees: Brevo help centre, payment methods and pricing
- Free tier capabilities and locked features: documented from a hands-on review of an active free Brevo account, October 2026
- EU merger clearance of joint control by Thiberge, Oakley Capital and General Atlantic, 7 October 2025: IEU Monitoring
- Transaction detail, founder and employee shareholding, Bpifrance and Bridgepoint reinvestment: Oakley Capital, General Atlantic, Goodwin
- Reported stake percentages, treated as indicative: emailexpert, French Tech Journal
- Sub-processor table and the storage-versus-access analysis: Hejlsvig Consulting (third party, October 2026). Reproduced because Brevo’s own annex did not load; treat as indicative.
Keeping this up to date
Ownership in this category changes without warning, and Brevo changed hands within the last twelve months. Pricing scales with volume and moves.
Last reviewed: 13 October 2026. Open items we will update when answered: the current sub-processor annex and which Aura features call which AI providers, whether customers can opt out of AI training under Section 6.7, the list of 18 Aura translation languages, whether Brevo holds certifications beyond ISO 27001:2022, and the Professional tier price discrepancy.
