How newsletter platforms get reviewed here, from evidence grades to update triggers

A review should identify a product or service precisely enough that another reviewer can repeat the work. The subject is not "email software". Record the supplier, contracting entity, product, edition, configuration, evidence cut-off and proposed England use case.

What to take away

Disclose this review

uk editorial research team. Research closed on 6 September 2026. The work reviewed public documents and designed a repeatable method. It did not create accounts, buy services, send email, process money, contact support, migrate data or use assistive technology. Suppliers did not pay for this work, and the article contains no affiliate links.

The byline will be assigned no later than 14 September 2026. The named editor will be the Newsletter Stack reviews editor, with at least three years editing software reviews for paying subscribers.

Each specialist reviewer must hold a current practitioner credential in the field they cover, such as data protection, accessibility testing or payment operations. The final record lists their names and any candidate relationship.

Supplier-supplied and reader-submitted material is a pointer, not proof. The reviewer asks for the original file, its date and its account, then checks it against a current first-party record. Untraceable material stays at Grade D.

Define evidence grades

Grade A is direct evidence from the proposed contract, configured test and reproducible output. Grade B is a current first-party product, technical, legal or support record for the exact edition. Grade C is relevant independent evidence whose method, population and date can be inspected. Grade D is an unverified claim, testimonial or missing answer.

Supplier material proves only that the supplier made the statement. Ghost's export guide, for example, documents specific export formats. It does not prove that an operator's complete migration will succeed. That requires a controlled export, field check and restore.

Worked example: Ghost. A configured export and restore on a test site, repeated by a second reviewer, is Grade A. The supplier's own export guide is Grade B, as a current first-party record for the exact edition.

An independent migration write-up that names its method, population and date is Grade C. A supplier marketing claim that a move between platforms is easy, with no method published, is Grade D.

Set the criteria before opening candidates

Use the same fields for every option: publishing and correction, audience permission and suppression, paid access, payment states, refund and dispute handling, advertising and affiliate records, portability, accessibility, security, support, contract and exit. Write a required evidence grade and failure rule for each.

Privacy is not a feature score. The ICO's controller and processor contract guidance lists subject matter, instructions, security, subprocessors, assistance, deletion or return, and audits among contract concerns. The page is under review after the Data (Use and Access) Act, so qualified review and a publication-day check are required.

Security needs evidence proportionate to the data and dependency. NCSC supplier assurance guidance warns that box ticking can create false confidence and says evidence depth should reflect supplier criticality and risk.

Separate desk checks from tests

Desk review can establish documented editions, public terms, stated data roles and claimed functions. A safe hands-on plan uses synthetic content, invented addresses and a payment sandbox where available. It should exercise approval, suppression, accessible signup and reading, payment state, entitlement, cancellation, refund, incident, export, restore and deletion.

Record environment, steps, expected result, actual result, evidence file, reviewer and date. If the supplier does not provide a sandbox, do not charge a real customer merely to complete a review. Mark the payment path untested or agree a lawful controlled test.

Score only comparable evidence

If scoring helps the decision, publish weights before research and use the same rule throughout. The weights below are the published set for this method, and any change is dated and logged before research opens.

Unknown is not failure and should not be converted to zero.

Each criterion is marked 0 to 5 from the best evidence grade held, with A scored as 5, B as 4 and C as 3. A criterion at Grade D, or one with no answer, is left out of the total and listed as unresolved.

For each scored criterion, divide the mark by 5 and multiply by its weight. Add those figures, then divide by the total weight of the scored criteria and multiply by 100.

A critical privacy, consumer, security or accessibility defect is a hold even if a weighted total looks high.

CAP's misleading advertising rules require substantiation for objective marketing claims. A review score is not evidence for promising revenue, deliverability or performance. Apply separate advertising review to any published comparison claim.

Finish with a verdict of reject, hold, controlled test or select for the defined case. State unresolved evidence, decision owner, expiry date and triggers for reopening the work.

Reopen when the supplier changes its published price, terms, data roles or export format, or when a cited regulator or code source is updated. Reopen too when a scored criterion fails in use, or 12 months after the evidence cut-off.

The cut-off is 6 September 2026, so the 12-month point is 6 September 2027. A check of the cited ICO page runs on publication day.

The current draft verdict is hold until named reviewers and hands-on gates are completed.

Before you act

Common questions

What evidence grades are used in this review method?

Grades run from A, direct evidence from a configured test, through B and C, to D, an unverified claim or missing answer. The definitions and the Ghost worked example sit in the evidence grades section above.

What should a hands-on test plan include?

Desk checks and hands-on tests are kept apart in the section above. The test plan uses synthetic content, invented addresses and a sandbox where one exists, and it never charges a real customer to complete a review.

How should privacy and security be treated in the review?

Privacy is not a feature score. The ICO contract concerns listed above stay a qualified check, and security needs evidence proportionate to the data and dependency. The NCSC warning about box ticking creating false confidence still applies.