Beware. They track password emails.

Hey Bruno — I can certainly appreciate your concern for security involving SMTP emails. Responding to your comment above, while Sendinblue uses redirect links in our SMTP emails that enable our users to track email engagement, we do not store the final URL on our servers. This is standard practice for all email marketing providers.

To give you a bit more detail: the redirect URL is set up to ping our servers when a recipient clicks on this link so that we can inform our user that someone clicked their email link. After, the clicker is redirected to the proper final URL, which is encrypted in the original redirect link and decrypted during the redirect process to send the clicker to the proper final destination.

First, thanks for the answer.

I understand how tracking in email marketing service works, but I can’t agree with that. As you said, it’s not stored on your servers, but once user clicks on the URL it will go first to your server, and only then to the proper website.

There is simply no reason to do any kind of track in URLs that should be completely private. A simple rule to avoid any URL related to password would fix that.

At minimum, your plugin should let users know that when using the SMTP feature, administrative links with private information will pass through SendinBlue servers.

I am very concerned about this too. “We don’t store passwords” statement is not enough for me. I was about to use your service. Good point @cantuaria thanks for making it!

Hi @cantuaria

Link encryption feature can be toggled if you don’t want to track clicks. It will then directly route to website. If you want to keep original links, please request us, we will disable tracking.

• This reply was modified 5 years, 2 months ago by Brevo.

In my opinion, not enough, because it’s not the default behavior and your plugin do not warn users that tracking clicks may lead to potential breaches.

Yet, the solution is as simple as detecting when an email is related to Password or sensitive information, and do not track them.

Hey Bruno @cantuaria,

Unfortunately, it is not possible to provide this solution to our client “by default” for many reasons. One of the most important is phishing, we want to keep full control of links send in our messages and be able to cut them if we detected after sending this is phishing (or another form of abuse). But we noticed its an important topic for you and @bjordanov, so we will raise your point to the product and technical team.

Actually, this is a concern not only for them but for every user, so a clear solution will be welcome.