SMS APIs

GatewayAPI

SMS API from a Danish-owned group

DenmarkEUEU hostedEU controlledHigh non-EU dependency
Visit website gatewayapi.com

Operational dependency warning

Relies heavily on non-European providers

Current public evidence shows 7 non-European infrastructure or email dependencies across 3 providers: Google, HubSpot, Zendesk. The reviewed operational path is therefore not entirely European.

Review dependencies ↓

GatewayAPI, operated by ONLINECITY.IO ApS in Denmark, provides APIs for sending and receiving SMS, delivery reports, number lookups and virtual numbers. It supports notifications, verification codes and two-way messaging; RCS and email are additional channels.

The separate GatewayAPI.eu setup uses Hetzner in Germany and Finland. GatewayAPI.com uses Google Cloud in EU regions and has a different support and subprocessor schedule. Select the EU setup when registering or arrange a migration if European infrastructure ownership matters to your application.

ONLINECITY’s 2026 report describes its group as Danish-owned and ONLINECITY.IO ApS as wholly owned. GatewayAPI names Thomas Hofmann, Birol Altinok and Martin Pløger as co-owners. Together these primary disclosures support European control; the report is not a shareholder audit.

Pricing

Usage-based SMS prices vary by destination and volume. Account creation is free, but sending, virtual numbers, shortcodes and other extras can incur charges. A free account is not a recurring free messaging plan.

External verification

EU verification badge

eu-alt.eu independently verified this service's European ownership. Choose a badge style and link it back to the dated evidence on this page.

Evidence last checked:

Horizontal · Blue

Download SVG
GatewayAPI: EU ownership independently verified by eu-alt.eu
Embed code

Horizontal · Black

Download SVG
GatewayAPI: EU ownership independently verified by eu-alt.eu
Embed code

Horizontal · White

Download SVG
GatewayAPI: EU ownership independently verified by eu-alt.eu
Embed code

Compact · Blue

Download SVG
GatewayAPI: EU ownership independently verified by eu-alt.eu
Embed code

Compact · Black

Download SVG
GatewayAPI: EU ownership independently verified by eu-alt.eu
Embed code

Compact · White

Download SVG
GatewayAPI: EU ownership independently verified by eu-alt.eu
Embed code

Data and operations

Infrastructure and email path

Verified operational dependencies, shown separately from ownership and from the service's core data hosting.

Core service hosting

Google Cloud

Non-European provider
Location
Belgium; redundancy in Ireland, Denmark, Netherlands and Finland
Observed
GatewayAPI.com setup only. The DPA identifies a Belgian primary communication database and other EU redundancy locations under Google control.

Why this matters

Reviewed evidence places Google Cloud in the core service path, so customer data may be processed under non-European control. Check the cited source for the documented region and scope.

Message delivery channel

Google / RCS Business Messaging

Non-European provider
Location
EU; third-country transfers permitted
Observed
Optional RCS under Appendix D of the .com DPA. Google and its subprocessors can process data outside the EU/EEA; this does not describe the separate .eu SMS setup.

Why this matters

The service documents Google / RCS Business Messaging for message delivery. When this channel is used, message content and recipient details can pass through this non-European provider. The cited source describes the channel and any location limits.

Public website

Google Cloud

Non-European provider
Observed
A 34.22.164.93 · AS396982

Why this matters

Public DNS routes website visits through Google Cloud. Visitor IP addresses and request metadata can reach this non-European provider; this does not identify the core service's data location.

Incoming business email

Google Workspace

Non-European provider
Observed
MX 1 aspmx.l.google.com · 5 alt1.aspmx.l.google.com · 5 alt2.aspmx.l.google.com · 10 aspmx2.googlemail.com · 10 aspmx3.googlemail.com

Why this matters

Published MX records route incoming business email through Google Workspace. Correspondent details and message content can therefore enter this non-European provider's systems; MX does not reveal the configured storage region.

Authorised outbound email

Google Workspace

Non-European provider
Observed
Business-domain gatewayapi.com SPF _spf.google.com; authorization does not prove customer SMS or WhatsApp messages use this provider.

Why this matters

This domain authorises Google Workspace to send email. If active, recipient details and message content can be processed by this non-European provider. SPF does not reveal its configured storage region.

Authorised outbound email

stspg-customer.com

Provider control not verified
Observed
Business-domain gatewayapi.com SPF stspg-customer.com; authorization does not prove customer SMS or WhatsApp messages use this provider.

Authorised outbound email

HubSpot

Non-European provider
Observed
Business-domain gatewayapi.com SPF 143597192.spf08.hubspotemail.net; authorization does not prove customer SMS or WhatsApp messages use this provider.

Why this matters

This domain authorises HubSpot to send email. If active, recipient details and message content can be processed by this non-European provider. SPF does not reveal its configured storage region.

Authorised outbound email

send.heysender.com

Provider control not verified
Observed
Business-domain gatewayapi.com SPF send.heysender.com; authorization does not prove customer SMS or WhatsApp messages use this provider.

Authorised outbound email

Zendesk

Non-European provider
Observed
Business-domain gatewayapi.com SPF mail.zendesk.com; authorization does not prove customer SMS or WhatsApp messages use this provider.

Why this matters

This domain authorises Zendesk to send email. If active, recipient details and message content can be processed by this non-European provider. SPF does not reveal its configured storage region.

Public DNS records identify visible providers and routes, not every backend location or private data-region setting.

Infrastructure checked: