Domain authentication
SPF, DKIM and DMARC per sending domain, with verification visible in the portal. Unauthenticated mail is filtered mail.
Deliverability & consent
Permission you can prove. Mail that arrives.
Deliverability isn't a spam-word checker. It's consent hygiene, list hygiene, authentication and traffic separation — and it's built into the sending path rather than offered as advice.
The consent model
Four rules, and no way around them.
-
01
The ledger is append-only
Consent events are written, never updated or deleted. Each carries the identifier, the purpose, the state, where it came from and when it happened. The state you act on is a projection of that history, recalculated on every entry.
-
02
Most restrictive wins
Where signals conflict, the most restrictive one holds. A later opt-out beats an earlier opt-in for the same identifier and purpose — regardless of which system it arrived from.
-
03
Connectors revoke, never grant
An opt_in arriving through an import or a CRM sync is recorded as unverified evidence. It cannot create permission that didn't exist. Under PECR this is the difference between a defensible list and an expensive one.
-
04
The gate runs twice
Consent is checked when a send is created and again when it fires. A message scheduled for next Tuesday against someone who unsubscribes on Monday does not go out.
Traffic separation
A receipt and a promotion are not the same thing.
Every message carries a class. Transactional messages — password resets, invoices, booking confirmations — bypass the marketing consent gate because they're service communications, but they still respect hard suppression, and they ride their own queues.
Fails safe
An unclassified message is treated as marketing, so an omission never accidentally bypasses consent.
Can't be gamed
A marketing template can't be sent as transactional. The class is derived from the template type, not asserted by the caller.
Counted separately
Marketing and transactional volumes are tracked apart, so a tenant quietly reclassifying promotional blasts shows up.
Isolated queues
A million-recipient campaign can't delay a password reset, because they never share a lane.
Unsubscribe is not optional. A marketing email whose body contains no unsubscribe link is rejected when the send is created — a 422, at the API, before anything is queued. It isn't a warning in a review screen that somebody can click past.
Reputation
The things that decide whether you reach the inbox.
Suppression that holds
Hard bounces and complaints suppress across the workspace automatically. Removing an address from the suppression list is deliberate, confirmed and audited.
Feedback processed, not ignored
Delivery, bounce and complaint notifications are consumed and applied — the list cleans itself as you send.
Daily reconciliation
A scheduled job compares our record of every send against what the providers report, so drift is found rather than discovered.
Automation guard rails
Loop detection, chain-depth limits and per-workspace fire quotas stop a misconfigured rule from mailing the same person forty times.
Content checksIn build
A pre-send review of clipping size, image-to-text ratio, link hygiene and unsubscribe presence — findings and fixes, never a score pretending to be a prediction.
What we won't do: quote you an inbox-placement percentage. Nobody can predict a mailbox provider's decision, and a number that looks precise is worse than no number at all. Where we show a figure, it's something we measured or counted — not something we estimated.
Data protection
Built for UK and EU obligations.
The platform is designed around the assumption that somebody will eventually ask you to evidence a decision — and that you should be able to.
UK region
Processing and storage in AWS eu-west-2 (London).
Tenant isolation
Row-level isolation enforced on every read; cross-tenant access returns a 404.
Audit trail
Consent overrides, rule activations, mapping changes and secret rotations are recorded against a named user.
Redacted error reports
Import error files redact identifiers, so debugging a bad CSV doesn't spill personal data into a download.
Data processing agreement and sub-processor list available on request.
See it against your own data.
A 30-minute walkthrough: connect a sample list, build one journey, and look at what the consent ledger records. No slideware.