MailRush.io

This vendor markets no model driven capability at all, on any page read, which under the grading convention lands here rather than lower: the bottom band is reserved for a marketed claim that fails the removal test, not for a competent product that makes no claim. The absence is worth recording rather than passing over.

Five of the six vendors graded before this one in the same session sell model driven personalisation as their central differentiator, and this one, which sells none, takes a higher grade than four of them on the axes that govern whether a message actually arrives and whether it was lawful to send.

Nothing autonomous is sold, so this axis is graded on what is knowable, and what is knowable runs in an unusual direction. Every other vendor graded this session gives the buyer more autonomy and asks for oversight in return. This one removes autonomy from the buyer by contract: a mandatory ramp governs volume for the first 90 days regardless of the plan purchased, and an abuse clause lets the vendor throttle sending to a specific receiving provider without the customer's agreement. Those are vendor imposed limits on the customer rather than customer imposed limits on a machine, and they are recorded on the sending row where they carry the most weight.

Nothing model driven is offered, so there is nothing here to disclose, and the axis is graded on what is knowable rather than skipped. The observation worth keeping for comparison is that this vendor's silence is honest silence: it claims no intelligence and therefore owes no account of one, which is a different position from the several vendors in this alphabetical block that market model driven personalisation heavily and name no model, provider or version anywhere.

The review evidence is thin but verifiable at source, which keeps it above the band below: an independent software directory rating of 4.2 out of 5 is displayed with the review count shown honestly as 14 and the badge linked directly to the listing, so a reader can check it. A testimonials page exists and was not read. What is absent is any named customer, any quantified outcome, any case study and any measurement basis.

The corporate evidence is unusually solid for a vendor this size, with a named team carrying individual roles and joining years going back to 2008, but that speaks to who runs the company rather than to what the product achieves.

The mechanisms are shipped rather than promised and they reach every price point, including the lowest. Unsubscribe automation and a suppression list are listed as included in all three tiers, alongside an assessment of email copy for spam characteristics before sending.

The terms add a contractual scope restriction that is genuinely uncommon and genuinely load bearing: use is limited to business to business outreach and consumer outreach is stated as unsupported, which removes the vendor and its customers from the regimes where marketing exposure is sharpest. The customer separately warrants that its use will not breach applicable law.

Off the top band because no statute is named anywhere, no consent position is stated, and no numeric complaint threshold is published, so the buyer gets working machinery without a stated standard to hold it to.

The privacy policy is a single paragraph inside the terms of service and it addresses only the vendor's confidentiality toward its own customer. Coverage of the data that actually matters here is absent entirely: uploaded contact lists reaching 50,000 records on the top tier are third party personal data, and no lawful basis, retention period, deletion rule, sub processor, transfer mechanism or data subject route appears for any of it.

No named privacy statute appears on any page read, and no data processing addendum was located. One clause in that paragraph deserves a buyer's attention rather than alarm, and it is a disclosure against interest: the vendor commits to withhold customer information from everyone except the Panamanian government on formal request, and states that such a disclosure would happen without further consent or notification to the customer. Most vendors of this kind commit to notify unless legally barred from doing so.

There is no data supply chain to interrogate, which is the cleanest position this axis can record for a sending tool. Contacts arrive by file upload or from external sources the buyer already controls, and the vendor supplies no directory, no database, no enrichment credits and no waterfall of unnamed providers. Validation runs against the buyer's own list rather than against an inventory the vendor sells.

What is unaddressed is what happens to those uploaded lists after the fact: retention, deletion outside the termination clause, and whether validation results derived from one customer's list inform anything served to another are all unstated.

The exposure this axis usually measures is absent by design, because the vendor is the sending infrastructure rather than a layer riding on somebody else's. Mail leaves through a relay the vendor operates, on shared or dedicated addresses it controls, and a buyer who prefers to attach an existing mailbox may do so instead.

Nothing here rents an account, rotates identities, proxies a session or drives a browser extension against a platform that prohibits it, which is the distinguishing fact against most of the vendors graded around it in this session. Off the top band because the vendor states no conformance position with the mailbox providers it delivers into, and its terms disclaim in that direction rather than commit, stating that delivery is not guaranteed and that recipient filtering may prevent it.

No models are involved, so stewardship turns on custody, and one structural question goes unanswered that a buyer on the lower tiers should ask. Sending runs through a shared address pool unless the buyer pays for a dedicated one, which means the sending reputation each customer depends on is partly produced by the conduct of other customers on the same infrastructure.

The vendor's abuse clause shows it manages that boundary actively, and nothing published describes how, whether reputation data is pooled, or what a customer inherits when they join a pool. Retention of campaign content and uploaded lists is likewise unaddressed outside the termination clause.

The authenticity picture is honest by construction. Messages leave from the buyer's own domain under the buyer's own identity, nothing is generated, no persona is manufactured and no account belongs to anyone else, so the manufactured authorship question that drove several low grades earlier in this session does not arise. Unsubscribe automation and a suppression list ship in every tier, which gives the recipient a working exit. Two things keep it at the middle band.

Nothing proactive is done for the recipient beyond that exit, unlike the data vendors in this index that notify individuals directly. And support for randomised copy variation is included in every tier, a technique whose purpose is to make bulk sends read as individually composed to filtering systems.

Programmatic access is documented at its own address and, unusually, it is not gated. Interface access and webhooks appear as included at every tier including the 19 dollar entry plan, which inverts the pattern this index keeps finding, where the integration a buyer needs sits behind the enterprise conversation.

A general automation connector has its own page and appears in all three tiers, an existing mailbox can be attached directly, contacts import from file or external sources, and a maintained knowledge base and a public roadmap both exist.

Off the top band on destinations rather than access: not one customer relationship platform connector is named anywhere, which is a real gap for a sales tool, and the top tier's promise that all integrations are included implies gating that the comparison table does not show.

The legal regime is stated with more clarity than most vendors manage: the agreement and, in the vendor's own words, any data the customer provides are subject to the law of the Republic of Panama, and the corporate entity, city and telephone number are all published. Knowing which law governs your data is closer to a residency posture than the consent clauses naming nowhere that appeared twice earlier in this session.

Physical location is still missing, along with any processing region, any transfer mechanism and any option for the buyer to choose. For a customer with European contacts in an uploaded list, a Panamanian regime with no adequacy finding and no standard contractual clauses on offer is a gap worth pricing into the decision.

The security surface is empty. A certification, an audit, a penetration test, a documented control set and a trust page were all sought and none was located, from a vendor that holds mailbox credentials for attached accounts, stores uploaded contact lists of up to 50,000 records, and operates the sending infrastructure those campaigns run through.

The terms go further than silence and disclaim in this direction explicitly, stating that the services are provided as they are and that the vendor does not warrant them to be uninterrupted, error free or completely secure. A published control set would move this row one band even without certification.

The price card is complete and the usage economics behind it are unusually granular: three tiers at 19, 39 and 99 dollars a month, each publishing a daily sending limit, a monthly sending limit, an uploaded contact cap, a validation allowance and a campaign count, then a fourteen row comparison table marking every feature by tier. A fourteen day trial requires no card and cancellation is stated as available at any time.

The refund position is adverse and published anyway, which this axis rewards: no refunds on any service, prepayment treated as a commitment for the period, and account credit usable but never returnable. What holds it off the top band is that the vendor's stated differentiator is unpriced.

Dedicated sending addresses are the thing the marketing says no competitor offers, and no figure for them appears on the pricing page or anywhere else read, so a buyer drawn by that specific promise cannot budget it.

This is the most adverse exit position graded in this index and every part of it is published in the terms, so a buyer can know it in advance and most will not read far enough to. An invoice unpaid for four days permits suspension without notice, at which point the sending infrastructure stops answering.

An invoice unpaid for fifteen days permits termination without further notice, and the clause states plainly that at that point any data, email and files stored on the vendor's servers will be deleted. No refund is available at any stage. Against that sequence there is no published export function, file format, download path or retrieval window, no grace period after termination, and no post termination data right of any kind. A single missed payment can therefore destroy campaign history and uploaded lists inside a fortnight, with no mechanism for getting them out first.

This is the strongest sending discipline graded in this index and two of its mechanisms are contractual rather than optional, which is what separates it from every competitor. A mandatory account ramp is written into the terms of service: sending volume is limited during the early life of an account and rises with account age toward the plan ceiling over a stated 90 days, and no tier lets a buyer skip it.

An abuse clause commits the vendor to act on negative signals from receiving providers by restricting sending to that specific provider for a period stated as ranging from one hour to 30 days according to impact, which is a documented, graduated, per provider response to feedback rather than a promise to monitor.

Around those two sit warmup included without limit at every tier, list validation with published allowances, an assessment of copy for spam characteristics, a suppression list, unsubscribe automation, published daily and monthly ceilings per tier, and a standalone address ramp scheduler offered publicly at no cost. The tier structure reinforces the discipline rather than undermining it, since senders are unlimited while total volume is capped, so adding mailboxes cannot raise throughput.

Off nothing material for the band, though three additions would make it unimpeachable: a numeric complaint rate threshold, published authentication guidance for an attached mailbox, and a stated blocklist monitoring practice.

Each tier names its buyer directly and the ladder has genuine shape, from solo founders and consultants at the entry point, through in house sales teams and small agencies, to agencies and high volume teams at the top, with volume, contact capacity, validation and campaign counts all scaling together.

The strongest element is a published exclusion carried in the contract rather than the marketing: use is restricted to business to business outreach and consumer outreach is stated as unsupported, which tells a whole class of prospective buyers not to bother. Two gaps hold it off the top band. Region coverage, size band and any ceiling above the top published tier are all absent.

And the vendor's own supplied description on an independent software directory lists real estate, doctors and consumer commerce among its target segments, which sits directly against the contractual restriction in its terms.