Inboxroad

Netherlands · owned by Independent (Netherlands) · inboxroad.com · 13 vendors

Inboxroad is a Dutch email marketing and deliverability platform that provides businesses with tools to create, send, and track email campaigns via a drag-and-drop email builder, SMTP relay, and Email API. Founded in Amsterdam in 2012, the company focuses on maximising inbox delivery rates, reporting an average deliverability rate of 96.1% across over 130 million emails sent monthly. It serves marketers and developers with features including contact list management, segmentation, dedicated IPs, and campaign analytics.

Resilience scores

Technology vendors

Insights

Last updated 2026-08-10 · revision 3

13 direct vendors, 166 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Inboxroad's migration readiness is moderate, characterized by a balance of facilitating factors and significant challenges. On the positive side, the company's core products are built around modern concepts such as RESTful APIs (v1 and v2) and webhook integration, which are highly conducive to cloud-native architectures and microservices adoption. The use of Astro for API documentation also indicates a modern approach to development infrastructure. The geographic diversity of their vendor base (15 services from 7 unique countries) could potentially mitigate vendor concentration, although the 'Vendor Lock-in Risk' is explicitly stated as 'Unknown.' However, substantial hurdles exist. The most critical is the complete lack of financial data (revenue, growth history), which makes it impossible to determine the company's capacity to fund a potentially costly and complex migration. Furthermore, strict data residency requirements, mandating primary data processing within the European Economic Area (EEA) with Standard Contractual Clauses (SCCs for transfers), will significantly constrain cloud provider and region choices. The ongoing assessment for NIS2 applicability also adds a layer of regulatory complexity that must be managed during any migration. The contradictory data point of 'Total Vendors: 0' alongside detailed vendor geographic information is noted, but the assessment assumes actual vendor relationships based on the latter.

Compliance

8 in-scope frameworks identified; showing 3.

Dutch Telecommunications Act — Partially Compliant

Risk is Medium because: (1) The Dutch Telecommunicatiewet implements the ePrivacy Directive and contains specific anti-spam provisions (Article 11.7) requiring prior consent for commercial electronic communications; (2) Inboxroad's Terms of Service enforce opt-in requirements and anti-spam thresholds, which aligns with these provisions; (3) However, as a platform provider, Inboxroad's compliance depends partly on customer behavior, and the enforcement of opt-in requirements on customers is contractual rather than technically enforced; (4) The ACM (Autoriteit Consument & Markt) actively enforces anti-spam rules in the Netherlands with significant fines.

Evidence: https://inboxroad.com/terms-of-service/, https://www.acm.nl/en/themes/telecommunications/spam, https://wetten.overheid.nl/BWBR0009950/2024-01-01

NIS2 (source) — Assessment Required

NIS2 risk is Medium and requires formal assessment for the following reasons: (1) Inboxroad operates as a digital service provider — specifically an email delivery platform offering SMTP relay, Email API, and cloud-based email marketing infrastructure — which may qualify it as a 'Digital Provider' under NIS2 Annex II (Important Entities), specifically under the subcategory of 'online marketplaces, online search engines, or cloud computing services.' SMTP relay and Email API services could be interpreted as managed ICT services or digital infrastructure. (2) The company was founded in 2012 and sends 130M+ emails per month across 15+ countries, suggesting it may meet or approach the NIS2 size thresholds (50+ employees or €10M+ annual turnover), though exact employee count and revenue are not publicly disclosed. (3) The Netherlands has transposed NIS2 into national law (Cyberbeveiligingswet, effective 2025), making Dutch authorities active enforcers. (4) Non-compliance with NIS2 can result in fines up to €10M or 2% of global annual turnover for Important Entities. (5) The absence of any NIS2 compliance disclosure or cybersecurity framework certification (e.g., ISO 27001) increases uncertainty. A formal legal assessment is required to determine whether Inboxroad's specific services fall within NIS2 scope and whether size thresholds are met.

Evidence: https://inboxroad.com/about-us/, https://inboxroad.com/smtp-relay/, https://inboxroad.com/email-api/, https://www.digitaleoverheid.nl/overzicht-van-alle-onderwerpen/cybersecurity/nis2-richtlijn/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555

Validity Sender Certification Program — Compliant

Risk is Low because Inboxroad has an active partnership with Validity for Sender Certification, demonstrating commitment to email deliverability best practices. This is a voluntary industry program, not a regulatory requirement, so non-compliance carries no legal penalties. The partnership is publicly disclosed and represents a positive compliance indicator for email sending practices.

Evidence: https://inboxroad.com/email-deliverability/unlocking-better-email-performance-at-inboxroad-with-sender-certification/, https://www.validity.com/everest/sender-certification/

Financials

Three-year financials

Financial Resilience Score: 6/10

Inboxroad is a small, founder-led Dutch SaaS company operating in the email deliverability niche since 2012. Its resilience is supported by recurring, usage-based SMTP/API revenue that tends to be sticky due to switching costs (warmed dedicated IPs, API integrations), a lean cost base from a small headcount, and over 12 years of continuous operation with no visible signs of distress. The company appears to be bootstrapped or founder-financed with no institutional venture funding rounds identified, suggesting disciplined capital management. However, the company faces meaningful structural risks. It competes against well-funded giants like SendGrid/Twilio, Mailgun/Sinch, Postmark, Brevo, Mailjet, and Amazon SES, creating pricing pressure. Deliverability businesses are exposed to sudden mailbox-provider policy changes (e.g., 2024 Gmail/Yahoo bulk-sender rules). The origin story suggests possible customer concentration risk from its founding travel agency client, and as a small private B.V., statutory financial figures (revenue, EBIT, equity) are not publicly available, limiting external visibility on cash flow, leverage, and profitability. Key-person risk with the founder and small team also weighs on the score.

Key strengths: Recurring SaaS-style usage-based revenue with high switching costs, Over 12 years of continuous operation since 2012, Lean team with low fixed-cost base, Technical defensibility from deliverability expertise, International customer base spanning 15+ countries, Actively hiring and investing in product (2025 webhook upgrade)

Risk factors: Competition from well-funded giants (SendGrid, Mailgun, Amazon SES, Brevo), Exposure to sudden mailbox-provider policy changes (Gmail/Yahoo bulk-sender rules), Potential customer concentration from founding travel agency client, Financial opacity as small private B.V., Key-person risk with founder-led small team, No institutional funding backstop identified

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report