Mailchimp Transactional (Mandrill) vs SendLayer

Mailchimp Transactional (Mandrill) 68

API keys are created and revoked in the web app, several to an account, and each can be limited to chosen endpoints and to IP addresses. Keys do not expire and no rotation tooling was found. A new key has full account access by default. The key travels in the JSON body or a Bearer header, not the URL (26). Per-endpoint key permissions, IP limits, test keys that send nothing and subaccounts that can be paused. No approval step for sends or deletes (15). The API and the MCP server return inbound mail and stored message content, which is untrusted text. No guidance on prompt injection was found in the MCP guide or the docs (3). The Account Security page lists the IP addresses that used the account and whether each came by API, SMTP or web, and searches can filter by API key (10). A responsible disclosure programme with no rewards, a security.txt with a contact and no Expires field, SOC 2 reports and ISO 27001 per the security page, and regular penetration tests. No public advisory feed found (14).

SendLayer 38

Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.

Mailchimp Transactional (Mandrill) 70

Graded on the hosted Transactional API with the hosted lines. status.mailchimp.com lists Mailchimp Transactional as its own component and keeps event history by month (20). In the 90 days from 6 August 2026 it shows three Transactional incidents, all sending delays, on 1 September (16:19 to 20:27 UTC, "select" accounts), 15 September (13:36 to 18:02 UTC, "a subset of customers") and 17 September (23:31 to 00:09 UTC, "a subset of customers"). Each hit part of the accounts and none is described as the API being down, so minor only (20). Published numbers cover /messages/search at 20 calls a minute, test mode at 10,000 messages a day and the demo at 25 emails an hour. The hourly sending quota is set from reputation with no figure, and no general request limit was found (10). The search endpoint returns 429 and the release notes say to retry 60 seconds after the first of the 20 calls. Mail over the hourly quota is queued in a backlog and not refused. No idempotency key for sends was found, so this is retry-wait guidance alone (10). No SLA found, and the additional terms supply the service as-is (0). Generally available (10). 20+20+10+10+0+10 = 70.

SendLayer 48

Graded with the hosted lines. A Cronitor status page at status.sendlayer.com with components for the app, SMTP, tracking links, the website and each plan's sending IPs, and a history (15 of 20, see below). The 90 days from 8 August hold 98 automated outage entries, 13 of them on SendLayer Services Health, most on per-plan IP monitors, all marked resolved but with no durations or write-ups, so their size can't be judged (5 of 30). Send limits per minute, hour and day are published per plan, plus recipient and size caps (15). 429 appears in the error code list, with no Retry-After, backoff guidance or idempotency for sends (3 of 15). No SLA found (0). The API is at v1 with no beta label (10). The status page's uptime columns showed no data on 6 November, so the component line takes 15 of 20 rather than 20. Total 48.

Mailchimp Transactional (Mandrill) 71

Closed service with published terms and a named contracting entity. The client libraries are source-available under Mailchimp's own licence agreement, which is not an OSI licence (15). The additional terms and the docs agree that sent message content is kept 30 days, the docs add 90 days for bounce details and 48 hours for the backlog, and a data processing addendum dated 26 September 2024 covers deletion. The terms add that retention is not guaranteed (24). No deprecation policy was found, and the API Use Policy says the APIs can change by a posting or an email. Past notices carried dates, such as the TLS 1.0 and 1.1 retirement announced on 5 June 2023 for 18 July 2023 (10). A sub-processor list with locations is public but was last updated on 29 February 2024, and the security page places Mailchimp's own servers in United States data centres (15).

SendLayer 49

Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.

Mailchimp Transactional (Mandrill) 35

No x402, MPP or L402 (0). Block prices are public without a login, $20 per 25,000 emails falling to $10, and $29.95 a month for a dedicated IP. Full use also needs a Standard or Premium marketing plan, whose price is on a separate page (20). The demo gives 500 emails once on any Mailchimp account, free plan included. We take 5 off because it sends only to the account's own verified domain and we could not confirm that signup asks for no card (15). A person signs up in a browser, enables the add-on, creates a key and sets DNS records, so there is no autonomous route (0).

SendLayer 20

No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.

Mailchimp Transactional (Mandrill) 28

The newest dated Transactional release is specification 1.4.1 on 24 March 2026 (commit a996b63 in the generator repository), with the Node and Python libraries at 1.4.1, 225 days before this check (0). No dated Transactional release or changelog entry in the 90 days from 6 August. The newest Transactional release-notes entry is 19 August 2025 (0). A public changelog, a support contact and an API help address in the specification. We saw no public issue replies (6). The Node and Python libraries are both at 1.4.1 and match the current API version (15). The generator repository has workflows that validate the specification and build and test each library, and the Node library was updated in February 2024 for an Axios advisory. The test workflow needs a secret key, so we could not see results (7). 0+0+6+15+7 = 28.

SendLayer 40

The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.

Mailchimp Transactional (Mandrill) 79

An OpenAPI 3.1 file with all 99 operations is public at mailchimp.com/developer/openapi/api-reference-2.json, and a Swagger 2.0 copy sits in the client library repository. The link to it in the Transactional llms.txt returns 404 (25). llms.txt for the developer site and for Transactional, and a Markdown copy of every page at the URL plus .md (10). Each operation has a summary and a description averaging about 120 characters. They say what a call does and seldom when not to use it (11). Request bodies carry 36 enums, required fields, date patterns and minimum and maximum values. Headers, metadata and merge variables are free-form objects (11). Reference pages show request and response samples with code in eight languages, and each operation lists typed error bodies. The OpenAPI file itself has no examples (13). The version is in the path, but the docs use 1.0, 1.3 and 1.4 in different places, and the public changelog has nothing newer than 19 August 2025, so the move to 1.4 in March 2026 is not in it (9).

SendLayer 68

OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.