ActiveCampaign

Active Intelligence is marketed hard and shipped fast: conversational campaign generation, an automation agent, a segment agent, autonomous insights, and a remote MCP server, with a named release cadence in the help center through 2026. It sits on a marketing automation platform that predates it by two decades.

On the removal test the AI layer comes off and a complete product remains: campaign email, automation builder, forms, landing pages, CRM pipelines and reporting all continue to work. The company positions as an autonomous marketing platform; the evidence supports AI as a fast moving interface and assistance layer over conventional automation.

The posture is documented and is mostly draft for review. Autonomous Campaign Optimisation generates improved automation flows for marketer review, Autonomous Insights surfaces weekly recommendations rather than acting on them, and the April 2026 agent to user capability initiates recommendations rather than sends. Custom Instructions let a customer constrain how the AI behaves. What is not documented is failure containment: nothing public states what stops a bad generated automation once live, or what an agent can do without a further human action.

The AI engine is named and its features are enumerated by release date, which is more than most peers do, but the stack behind it is not. No public statement identifies the model providers powering Active Intelligence, no explanation of how predictive sending or performance scoring reaches its conclusions is published, and nothing addresses whether AI generated campaign content is identified as such to the businesses sending it or the people receiving it.

Outcome material is customer story and headline figure shaped. The company cites billions of platform signals behind its performance intelligence and publishes customer results, but no measurement basis is stated anywhere public: no population, no period, no metric definitions, and no holdout. Third party review sites carry saved time and lift figures that trace back to vendor or affiliate material rather than an independent measurement.

Compliance is enforced in the product rather than delegated. The platform automatically inserts an unsubscribe link in every email, requires a legitimate physical sender address, and adds the List Unsubscribe header to all sends including automation and one to one email. The anti spam policy names prohibited content categories with no exceptions, treats high bounce rates as evidence of a permission failure, and puts accounts with abnormal unsubscribe rates under review. Help documentation addresses CAN SPAM, CASL and GDPR obligations by name. No public enforcement action located.

A real and readable privacy program: the full DPA text is public and signable from account settings, it incorporates Standard Contractual Clauses, a public subprocessor page carries the change notification obligation, and the company holds EU US Data Privacy Framework certification. The gap is the one this category turns on.

Lawful basis for the contacts a customer uploads is pushed entirely to the customer, and the multi regional hosting policy expressly disclaims any representation that regional hosting is legally sufficient for the customer's own residency obligations.

ActiveCampaign is not a data vendor: contact records are customer supplied, and the platform sells no prospect database. The sourcing standard it does impose is published, namely direct permission from the subscriber, with purchased and scraped lists treated as a policy violation and high bounce rates read as evidence of one. What is not published is the legal footing behind that standard or any indemnification position, which is what separates this from the top band.

Low exposure by construction. The platform sends from its own infrastructure and reaches third party systems through official interfaces: a documented public API, a Salesforce integration with two way contact and deal sync, LinkedIn Lead Gen and Facebook lead form connectors, and a Google Ads connector launched in July 2026 that creates Performance Max campaigns and embeds Google's own generative asset builder. No headless automation of a platform that prohibits it was located. The vendor does not address platform terms conformance anywhere directly, so the grade rests on architecture and connector documentation rather than a stated position.

Security documentation is strong and single tenancy is claimed for customer data separation, but the question this axis turns on is unanswered in public material: whether contact records, campaign content and conversation data from one account inform models that serve other accounts, and whether a customer can exclude itself.

The February 2026 acquisition of an AI evaluation vendor was described in terms of the thousands of daily agent conversations the platform generates, which raises the question rather than settling it. Retention and deletion defaults are likewise not published outside the contract.

Nothing published states whether AI generated marketing content carries any indication of its origin, and no material addresses Article 50 of the EU AI Act, in force since 2 August 2026, for the agentic and conversational surfaces the platform has been shipping since 2025. Sender identity is handled well on the mechanical side, since a legitimate physical address and accurate from line are enforced by policy, which is why this is not lower. The AI disclosure question is simply not engaged.

Depth is documented rather than logo listed. More than 1,000 app integrations, a public REST API with developer documentation, two way Salesforce sync including contact push and deal stage, ownership and activity logging, and named connector behaviour for Stripe, Calendly, Docusign, Aircall, Wix, Eventbrite and Microsoft Dynamics with the specific objects and triggers stated in help articles. A remote MCP server shipped in October 2025, which is early for this category and makes the platform addressable by outside agents.

Multi tenant cloud with a published Multi Regional Data Hosting Policy. EU data centre generally available since February 2024 and Asia Pacific since March 2024, at no extra cost, with a help article showing customers where their contact data sits.

Two real limits keep this out of the top band and both are disclosed honestly: accounts are assigned to a data centre by GEO IP and the customer cannot choose, and contact data continues to be processed in the United States and other subprocessor locations regardless of hosting region.

A live trust centre gives self service access to the current SOC 2 report, penetration test attestation, compliance certifications and legal and privacy policies, which is materially stronger than the common pattern of asserting a certification without letting an outsider see it. Security practice is documented beyond the badge: single tenancy for customer data separation, in house code and infrastructure scanning, and offensive testing. HIPAA posture is stated. The DPA also commits to providing the SOC 2 Type 2 report annually on request under NDA.

Real numbers are published and the model is legible: four email tiers from roughly 15 dollars a month at 1,000 contacts on annual billing, priced by contact tier, with send limits stated as a multiple of the contact limit at 10x, 12x and 15x by plan, and included seats stated per tier. Two things stop a buyer budgeting without a call. Enterprise is quote only, and several load bearing add ons including full CRM pipelines, sales engagement, custom reporting and AI activities sit on top of the base price with no published number.

Contact, campaign and automation data can be exported from the product, and the platform documents import and export mechanics well. What is not published is everything a buyer would want to read before signing: post termination data rights, a deletion commitment with a timeline, what happens to automations and engagement history at the end of a term, and renewal notice mechanics.

The known billing behaviour that new accounts are charged for unsubscribed and bounced contacts is the kind of term that belongs in this disclosure and is documented in help material rather than in exit terms.

Sending discipline is treated as an operating practice and documented as one. Volume governance is contractual through per plan send multiples. Reputation monitoring is continuous, with complaint data surfaced in campaign reports, bounce rate and unsubscribe rate thresholds treated as permission signals, and accounts placed under review when they drift.

Dedicated IP options are documented alongside the shared pool with guidance on when a dedicated IP is the wrong choice, and a first 30 days warmup path is published. Authentication guidance covers SPF, DKIM and DMARC on a custom sending domain, and the platform maintains ISP relationships and applies List Unsubscribe on the customer's behalf.

The segment claim is clear and consistent: small and mid sized businesses, agencies and ecommerce operators rather than enterprise revenue teams, evidenced by the pricing structure itself, which starts at one seat and caps the entry tier at 10,000 contacts. Product coverage now spans email, SMS and WhatsApp. Geographic and language specifics are the gap. EU and Asia Pacific data centres and a global customer claim imply broad reach, without a published account of supported languages or regional feature parity.