Where the reviewed products stand
Compare documented control across the named products and routes. Open a review for its plan, region and agreement (this is a selected sample).
0–10 on both axes · Higher and further right means more documented control
Exact scores & review links (13)
| Vendor | Data access & portability | Build & act |
|---|---|---|
| Klaviyo ↗ | 7.7* | 6.0* |
| Mailchimp ↗ | 7.6* | 4.5* |
| Customer.io ↗ | 4.7* | 5.0* |
| ActiveCampaign ↗ | 4.7* | 4.8* |
| Braze ↗ | 4.9* | 4.8* |
| Brevo ↗ | 4.7* | 5.4* |
| Constant Contact ↗ | 6.2* | 4.6* |
| GetResponse ↗ | 7.6* | 5.4* |
| Kit ↗ | 4.7* | 5.3* |
| Loops ↗ | 7.0* | 4.7* |
| MailerLite ↗ | 7.6* | 4.9* |
| Resend ↗ | 7.6* | 4.9* |
| Permute ↗Publisher self-assessment | 8.0* | 7.1* |
Axes average three dimensions each: access, third-party access and exit horizontally; action, continuity and business logic vertically. Fixed 0–10 scale, midlines at 5 (overall grades use separate weights). * Some evidence is unresolved. Marker colors identify companies, not score bands. How to read the map ↗
Permute is included as a reference (it owns this site and is a publisher self-assessment). Its score is excluded from sample averages. Read the Permute review ↗
Contact exports, engagement events and executable automation definitions are separate. Findings do not infer native workflow portability from record access.
Compare the six dimensions
| Overall control | |
|---|---|
| Data access | |
| Third-party accessibility | |
| External action | |
| Continuity | |
| Data exit | |
| Business logic and customization | |
Product scopes, dates & reviews
Klaviyo
Marketing automation · Checked 2026-10-12
Klaviyo / customer private API keys and profile APIs. Marketplace OAuth and Conversations access have separate eligibility requirements.
Read findings and sources ↗Mailchimp
Marketing automation · Checked 2026-10-16
Mailchimp Marketing API audience/member records via OAuth for other customer accounts; Mailchimp Transactional/Mandrill is outside scope.
Read findings and sources ↗| Customer control | Klaviyo ↗ | Mailchimp ↗ | Customer.io ↗ | ActiveCampaign ↗ | Braze ↗ | Brevo ↗ | Constant Contact ↗ | GetResponse ↗ | Kit ↗ | Loops ↗ | MailerLite ↗ | Resend ↗ | Permute ↗ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Category | Marketing automation | Marketing automation | Marketing automation | Marketing automation | Marketing automation | Marketing automation | Marketing automation | Marketing automation | Marketing automation | Marketing automation | Marketing automation | Marketing automation | Databases and data platforms |
| Overall control | |||||||||||||
| Data access | |||||||||||||
| Third-party accessibility | |||||||||||||
| External action | |||||||||||||
| Continuity | |||||||||||||
| Data exit | |||||||||||||
| Business logic and customization | |||||||||||||
| Assessment scope | Klaviyo / customer private API keys and profile APIs. Marketplace OAuth and Conversations access have separate eligibility requirements. | Mailchimp Marketing API audience/member records via OAuth for other customer accounts; Mailchimp Transactional/Mandrill is outside scope. | Customer.io Journeys App API customer export, Track v1 profile writes and Reporting Webhooks; Pipelines and workflow-action webhooks have separate contracts. | ActiveCampaign v3 contact APIs using a customer user API key and contact/campaign webhooks; App Studio marketplace publication is separate. | Braze REST user-profile segment exports and users/track writes using endpoint-scoped workspace keys; Currents and zero-copy sharing are separate unassessed products. | Brevo / v3 contact collection and contact creation; message content, CRM objects, campaigns and complete account migration are excluded. | Constant Contact / v3 contact collection and create-or-update through a publicly usable OAuth application; email content, campaigns and full account migration are excluded. | GetResponse / v3 contact listing and asynchronous contact creation; unconfirmed-contact search, campaigns and complete account migration are excluded. | Kit / v4 OAuth subscriber enumeration and subscriber creation; email content, automations, purchase APIs and complete account migration are excluded. | Loops / manual audience CSV export, single-contact API lookup and contact creation; full workflow definitions, message history and complete account migration are excluded. | MailerLite / current subscriber REST API list and upsert; Classic API, campaign bodies, attachments and full account migration are excluded. | Resend / global contact list and contact creation through a full-access API key; legacy audience-scoped collections, sent email bodies and full account migration are excluded. | Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed. |
| Assessment checked | 2026-10-12 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-12 |
| Read the findings | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ |
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
Who can connect?
Yes No- Unknown
A check means the column applies to that route (customer credentials can still require provider approval). Report exports use the customer account without separate API credentials. Open a connection method for its authentication, requirements and last review date.
What each review covers
Klaviyo ↗
Klaviyo supports customer-controlled profile extraction and mutations. Marketplace distribution and downstream reuse remain separate questions.
Klaviyo / customer private API keys and profile APIs. Marketplace OAuth and Conversations access have separate eligibility requirements.
Mailchimp ↗
Mailchimp Marketing exposes audience data and member writes through its API. OAuth connects other customers’ accounts, while audience webhooks provide updates with a bounded retry period.
Mailchimp Marketing API audience/member records via OAuth for other customer accounts; Mailchimp Transactional/Mandrill is outside scope.
Customer.io ↗
Customer.io separates bearer-authenticated customer exports from Basic-authenticated Track writes. Reporting Webhooks can notify external systems of customer/message events and retry delivery for up to seven days.
Customer.io Journeys App API customer export, Track v1 profile writes and Reporting Webhooks; Pipelines and workflow-action webhooks have separate contracts.
ActiveCampaign ↗
ActiveCampaign exposes contact search, date filters and create operations through its v3 API. Webhooks support change notifications, but the published guide states that they are never retried.
ActiveCampaign v3 contact APIs using a customer user API key and contact/campaign webhooks; App Studio marketplace publication is separate.
Braze ↗
Braze exports user profiles as JSON files and accepts profile/event writes through scoped REST keys. Export filters can select recently changed profiles, while historical event fields have a 90-day boundary.
Braze REST user-profile segment exports and users/track writes using endpoint-scoped workspace keys; Currents and zero-copy sharing are separate unassessed products.
Brevo ↗
Brevo returns contact IDs, attributes and list membership through its contact collection.
Brevo / v3 contact collection and contact creation; message content, CRM objects, campaigns and complete account migration are excluded.
Constant Contact ↗
Constant Contact exposes contact fields and list memberships through v3. Contact selection and optional includes affect exported coverage.
Constant Contact / v3 contact collection and create-or-update through a publicly usable OAuth application; email content, campaigns and full account migration are excluded.
GetResponse ↗
GetResponse returns contact records through v3. Unconfirmed double-opt-in contacts are not returned by the ordinary contact collection.
GetResponse / v3 contact listing and asynchronous contact creation; unconfirmed-contact search, campaigns and complete account migration are excluded.
Kit ↗
Kit v4 returns subscriber records with status and optional fields. Results are eventually consistent and can lag recent changes.
Kit / v4 OAuth subscriber enumeration and subscriber creation; email content, automations, purchase APIs and complete account migration are excluded.
Loops ↗
Loops provides contact lookup by email or user ID, plus a manual CSV export of the entire audience or a filtered subset.
Loops / manual audience CSV export, single-contact API lookup and contact creation; full workflow definitions, message history and complete account migration are excluded.
MailerLite ↗
MailerLite returns subscriber fields, status and subscription timestamps through its current REST API.
MailerLite / current subscriber REST API list and upsert; Classic API, campaign bodies, attachments and full account migration are excluded.
Resend ↗
Resend lists contact records globally. This assessment uses the current /contacts route rather than legacy audience-scoped operations.
Resend / global contact list and contact creation through a full-access API key; legacy audience-scoped collections, sent email bodies and full account migration are excluded.
Permute ↗
Scoped APIs expose SQL reads, managed records and customer-authored operation code. Customer-built apps are supported, while complete workspace recovery, outbound CDC and minimum-plan access terms remain unresolved.
Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed.