Give every person and service the right access, and keep a record of every change.
AI reviews permissions and audit logs and flags access that looks unusual.
Owner full access, billing, ownership transfer Admin domains, keys, team, settings Developer API keys, SMTP accounts, webhooks Marketer templates and reports Billing invoices and plans Read-only view reports and logs
Separate brands, products or clients with their own keys and domains.
Least-privilege roles for people and services.
Use your identity provider for sign-in and provisioning.
See who changed what, and when.
Restrict access to trusted networks.
Limit what each key can do.
One per brand, environment or client.
Assign roles as you add people.
Enforce sign-in through your identity provider.
Switch between stages to see what you control at each step. Illustrative interface with sample data.
Everything that changes your sending setup is recorded and attributable.
Create one workspace per client with separate domains, keys and reporting. Staff get access only to the clients they serve, and client data never mixes.
Give developers API keys and webhooks, marketers templates and reports, and finance billing only. Each person sees what they need and cannot change sending infrastructure by accident.
When your security team asks who changed a DKIM record or created a key, the audit log answers with a user and a timestamp, and can be exported.
Remove the person, rotate any keys they handled, and check the audit log for recent changes. With SSO, disabling them in your identity provider also removes access.
The copilot scans roles and keys for excess access, such as unused admin accounts or keys with broad scopes, and suggests tighter settings. Administrators approve every change.
Anomaly detection flags sign-ins from new locations or unusual hours, and sudden key creation. It notifies admins, and enforcement actions such as forced logout stay under your control.
Ask who changed our sending domain last week and get matching entries with links. The answer cites log lines, so you can verify them. Answers link to the log entries.
When AI agents use the API through an MCP server, they get their own scoped keys that show up in the audit log, can be revoked instantly and can require approval.
AI features are assistive: they review and flag, and your administrators approve every change to roles, keys and access. [Confirm which AI features are available at launch.]
Give each person the narrowest role that lets them work, and widen it on request. Removing access nobody noticed is harder than adding it.
Split by client, brand or environment. Clean boundaries simplify reporting, billing and incident response. It also keeps reports tidy and accountable.
Set expiry on keys for contractors and short-lived projects, and rotate production keys on a schedule so forgotten ones stop working.
Central sign-in means offboarding in one place and consistent password and multi-factor policy. Keep a break-glass owner account documented.
Skim changes to domains, keys and webhooks each week. Routine review turns the log from a forensic tool into early warning.
A workspace is a separate space within your account with its own domains, keys, templates and reporting. Use one per brand, environment or client so that settings and data stay isolated and access can be granted precisely. Each can hold its own settings, keys and domains.
Invite each person and assign a role, such as Admin, Developer, Marketer, Billing or Read-only. Each role limits access to the relevant areas. [Confirm whether custom roles are available.] Roles are listed in the team settings, and each role page explains what it can see and change, so you can compare them before sending any invitation to a colleague.
Yes. Use one workspace per client with separate keys, domains and reporting. Staff access can be limited to specific workspaces, which keeps client data and reputations apart. Reporting stays separate by workspace, and you can give clients read-only access to their own results if you want them to self-serve their numbers.
[List supported SSO protocols and providers.] SSO is offered on enterprise plans. See the pricing page for plan details. We support single sign-on for enterprise plans, and the list of supported protocols and identity providers will be confirmed before launch. Contact us if your organisation needs a specific provider, so we can check compatibility early.
[Confirm retention.] The log is searchable and exportable, so you can keep your own copy for compliance requirements. Retention may differ by plan, so check your plan details. Because the log is exportable, you can store your own copy for as long as your compliance policy requires, in your own archive or SIEM tool.
SSO is available on enterprise plans. Other plans use email and password sign-in, with IP allowlists and scoped keys available for tighter control. See the pricing page for the current breakdown. Contact sales for enterprise needs. See the pricing page for the full comparison. Contact sales for enterprise needs.
A role defines what a person can do in the dashboard. A key scope defines what a program can do through the API. Use roles for people and scoped keys for services, so each has only the access it needs.
AI can review permissions, flag unusual sign-ins and key activity, answer audit questions in plain language and give AI agents their own scoped identities. It recommends, and your administrators decide. [Confirm which AI features are available at launch.] Human review is part of every step.
Yes. Use one workspace per client with separate reporting.
Create an account, add your domain and send your first email.