MailPace

The SaaS Developer

The API and SMTP relay are both documented with hard limits (port 587 with required TLS, 25MB message size, up to 50 recipients per send), there are vendor SDKs naming PHP and the Laravel framework directly, idempotency keys work via a request header, and inbound email converts to JSON webhooks with unlimited catch-all domains. What holds it back for a team like mine: the docs state batch emails are not supported, and we found no public information on stored templates with variables, a sandbox or test mode, scheduled sending, or rate limits. 1 2 3 5 6 11 12

Report an error

The Platform Engineer

A documented REST send endpoint with token auth, an SMTP relay on port 587, integrations for Rails, Laravel, Django, Node, Java, Wordpress and Magento, attachments with virus scanning, inbound email parsed to webhooks, and idempotency keys — which is precisely what I want under an OTP retry storm. The documented ceiling is fifty recipients in the To field, with batch sending explicitly unsupported, and we found no public information on stored templates, a sandbox mode, or stated rate limits. 1 3 4 5 6 11 12

Report an error

The Shop Operator

There is a documented REST send API with token authentication and an SMTP relay on port 587 with TLS required, plus SDKs and framework guides for Rails, Laravel, Django, WordPress and Magento — though Shopware, which my shop runs on, is not among the named platforms. Idempotency keys and inbound email converted to JSON webhooks are included, but batch sending is explicitly not supported and we found no public information on stored templates, rate limits or a test mode. 1 3 4 6 11 12

Report an error

The Data Protection Officer

A documented REST send endpoint with server-token authentication and an SMTP relay on port 587 with required TLS, official libraries for Node.js, Ruby, Python, PHP, Go and Elixir with guides for Rails, Symfony, Laravel and more, whitelisted virus-scanned attachments, idempotency keys and inbound email forwarded to webhooks. Batch sending is stated as not supported beyond fifty comma-separated recipients, and we found no public information on stored templates, rate limits, a test or sandbox mode, scheduled sending or a full endpoint and error-code reference. 1 3 6 11 12

Report an error

The Agency Lead

A documented HTTPS API with one send endpoint and token authentication, an SMTP relay on port 587 with TLS required, official libraries for Node.js, Ruby, Python, PHP, Go and Elixir, and framework examples for Laravel, Django, Wordpress and Magento cover the essentials, and idempotency keys plus inbound email converted to JSON webhooks go further. For our per-client setups the domain API is genuinely useful — domains and per-domain API tokens can be provisioned over HTTP from an organisation token. The documentation states batch emails are not supported beyond 50 comma-separated recipients in the To field, and we found no public information on stored templates, rate limits, or a test or sandbox mode. 1 2 3 6 11 12

Report an error

The Skeptic

The documented core is real: a REST send endpoint with a server-token header, SMTP on port 587 with TLS required, SDKs for Node, Ruby, Python, PHP, Go and Elixir with Rails, Symfony and Laravel guides, idempotency keys, virus-scanned attachments with an extension whitelist, and inbound email forwarded to a webhook on every account. But batch sending is stated as not supported beyond 50 comma-separated recipients, and I found no public information on stored templates, scheduled sending, a sandbox mode, or stated rate limits — so a team cannot know its ceiling before it hits it. 1 3 4 6 11 12

Report an error

The SaaS Developer

DKIM is signed by default and domain ownership is enforced, SPF passes out of the box via the return path, DMARC can be enabled, feedback loops are registered, greylisting and 4xx retries are handled for up to three days, and time-to-inbox is published with real-time measurement (1.19 seconds Gmail average). The shared pool is actively policed through manual account review, no free plan and a spam filter on every outgoing email, though the vendor states it offers no dedicated IPs, and we found no public information on blocklist or DMARC monitoring or a statement on the Gmail and Yahoo bulk-sender rules. Anyone sending digests should note the terms permit transactional email only and prohibit bulk newsletters outright. 1 5 6 8

Report an error

The Platform Engineer

DKIM-enforced domain ownership, SPF passing out of the box via the return path, optional DMARC, manual account review, warmed shared IPs, registered feedback loops and a spam filter on every outgoing message make a coherent reputation story, and they publish a Gmail average of 1.19 seconds plus time-to-inbox for the three main providers — the latency figure I live on for login codes. The deliverability page itself states no dedicated IPs are offered, arguing shared warmed IPs serve senders better, and we found no public information on DMARC reports or blocklist monitoring. 1 5 6 8

Report an error

The Shop Operator

DKIM verification is required before anything can be sent, SPF passes out of the box through their return path, and DMARC can be enabled in the verification section — a set-up my non-specialist staff could follow. Bounce reports are parsed and acted on, feedback loops are registered, shared IPs are pre-warmed, new accounts are manually reviewed with marketing mail prohibited outright, and Gmail delivery time is published on the landing page. Dedicated IPs are deliberately not offered, which at my roughly ten thousand order mails a month I would not need anyway, and the 1:1 sending support that reviews outgoing spam scores is exactly the person I would ask when Gmail starts refusing. 1 5 6 8

Report an error

The Data Protection Officer

All mail is DKIM-signed by default with enforced domain verification, SPF passes via the return path, DMARC is available, shared IPs are warmed with manual review of new accounts and active disabling of suspected spammers, feedback loops are registered, bounce reports are parsed and acted on, and retries run up to three days with real-time Gmail delivery-time metrics published. Dedicated IP addresses are not offered, and we found no public information on DMARC reports, blocklist monitoring for customers or stated compliance with the Gmail and Yahoo sender requirements. 1 5 6

Report an error

The Agency Lead

SPF passes out of the box via a managed return path, DKIM verification is required before any sending, DMARC is available through advanced verification, shared pools are warmed, new accounts are manually reviewed, feedback loops are registered, bounce reports are parsed and acted on, and a Gmail average delivery time is published. The deliverability page itself states dedicated IP addresses are not offered and explains why shared IPs suit most senders. We found no public information on DMARC reports, blocklist monitoring detail, or a statement of compliance with the Gmail and Yahoo bulk-sender requirements. 1 5 6

Report an error

The Skeptic

The deliverability material is unusually candid: domain ownership enforced through DKIM verification before any send, SPF passed via the return path with optional DMARC, parsed bounce reports with action taken on behalf of users, registered feedback loops, greylisting and 4xx retries handled transparently for up to three days, manual review of every new account, warmed shared IPs, a spam filter on all outgoing mail, and time-to-inbox published on the landing page with real-time metrics. Dedicated IPs are explicitly not offered, and I found no public information on DMARC reporting or a statement on the Gmail and Yahoo bulk-sender requirements, which keeps this short of the top band. 1 5 6

Report an error

The SaaS Developer

Webhooks cover queued, delivered, bounced and spam events and can be enabled per domain with multiple endpoints, and sent emails are viewable in the dashboard for 30 days with a stated 37-day maximum including backups. But we found no public information on a searchable message log, an events API, statistics per tag or domain, or webhook signatures and retry behaviour — unsigned bounce webhooks are a hole I would not ship — and open and click events are absent by design because the vendor never tracks them. 1 4 9 10

Report an error

The Platform Engineer

Webhooks fire on queued, delivered, bounced and spam events with per-domain endpoints, and sent emails are viewable in the dashboard for thirty days before permanent deletion, which covers the basics of delivery tracing for a one-time-code pipeline. But we found no public information on a searchable message log, an events API, statistics per domain, alerts on bounce or complaint spikes, or retention I could extend while an incident runs long. 4 5 9 10

Report an error

The Shop Operator

Every message can be viewed in the dashboard for 30 days, with everything gone from backups after 37 days, and webhooks report queued, delivered, bounced and spam events per domain — that covers the basics my support inbox needs. We found no public information on searching the log by recipient, subject or message ID, statistics per tag or domain, an events API, signed webhooks, or alerts on bounce spikes. 4 9 10 5

Report an error

The Data Protection Officer

Sent emails can be viewed in the dashboard for thirty days, retention is documented to a hard maximum of thirty-seven days including backups, and per-domain webhooks fire on queued, delivered, bounced and spam events. For a support team handling patient-facing mail we found no public information on a searchable log by recipient or message ID, per-message event history with the server's answer, an events API, webhook signatures or retry schedules, statistics per tag or domain, alerts, or read-only access roles. 1 4 9 10

Report an error

The Agency Lead

Per-domain webhooks fire on queued, delivered, bounced and marked-as-spam events, and every sent email is viewable in the dashboard with retention stated precisely — 30 days in the dashboard, removed from backups seven days later. Open and click events are deliberately absent because the service states it never tracks opens or clicks. We found no public information on searchable per-message logs with the remote server's bounce reason, statistics per tag or domain, an events API, webhook signatures and retry behaviour, or alerts on bounce spikes. 1 4 9 10

Report an error

The Skeptic

Retention is stated with unusual precision — emails viewable in the dashboard for 30 days, everything gone at 37 including backups — and webhooks fire on queued, delivered, bounced and spam with per-domain endpoints. But I found no public information on a searchable log, an events API, statistics per domain or tag, alerts on bounce spikes, or whether webhooks are signed and retried; open and click events do not exist by design since tracking never happens. 4 5 9 10

Report an error

The SaaS Developer

What is stored is documented (message contents and related metadata), retention is fixed and published at 30 days in the dashboard and 37 days overall, deleting an account or domain permanently deletes the mail immediately, open and click tracking is never done, TLS 1.2+ is enforced, encryption at rest is stated, and the DPA is public and accepted automatically with organisation- and domain-level tokens available. We found no public information on two-factor authentication, SSO, an audit log, or security certifications with their scope. 1 2 5 9 10

Report an error

The Platform Engineer

What is stored is stated plainly — full email contents kept thirty days in the dashboard, gone from backups seven days later, permanently deleted the moment I remove a domain or organisation — and open and click tracking is never performed, which suits a login-code service handling recipient data. Encryption at rest and in transit are stated, tokens exist at organisation and domain level, and the data processing agreement is public. We found no public information on two-factor authentication, SSO, an audit log, or ISO 27001 or SOC 2 certifications. 1 2 9 10

Report an error

The Shop Operator

Opens and clicks are never tracked at all, message content is kept only 30 days and permanently deleted when a domain or the account is deleted, TLS 1.2 or better is required in transit, encryption at rest is stated, and a public DPA confirms the customer owns the transactional email data. We found no public information on two-factor authentication, scoped API keys, IP allow-listing, an audit log, or ISO 27001 or SOC 2 certifications. 1 9 10 5

Report an error

The Data Protection Officer

The data processing agreement is public and unusually specific for a sending vendor: controller and processor roles, Article 9 special-category data on documented instructions, DPIA assistance, forwarding of data-subject requests, customer ownership of message data, and immediate permanent deletion on removal of the account or domain; opens and clicks are never tracked, delivery requires TLS 1.2+, encryption at rest and offsite encrypted backups are stated, and message retention is fixed at thirty days with a documented end. Retention is not documented as configurable or reducible to metadata only, and we found no public information on two-factor authentication, SSO, audit logs, IP allow-listing, deletion of an individual recipient's data by API, or ISO 27001 and SOC 2 audits with their scope. 1 5 9 10

Report an error

The Agency Lead

What is stored is documented — contents and metadata of transactional emails — retention is fixed and stated at 37 days maximum, deletion is immediate, permanent and self-service on account or domain deletion, open and click tracking does not exist at all, and encryption at rest plus TLS 1.2+ in transit are stated in the DPA. Per-domain API tokens generated from an organisation token give workable key scoping per client. We found no public information on two-factor authentication, SSO, IP allow-listing, an audit log, or certifications such as ISO 27001 or SOC 2. 1 2 5 9 10

Report an error

The Skeptic

The data processing agreement names exactly what is processed — contents and metadata of transactional emails — with fixed 30-day retention, immediate and unrecoverable deletion when an account, domain or organisation is deleted, encryption at rest, TLS 1.2 or better for delivery, no open or click tracking ever, GDPR-trained staff, and customer ownership of the data. Retention is not configurable, API tokens exist at organisation and domain level but no finer scopes are described, and I found no public information on two-factor authentication, SSO, IP allow-listing, an audit log, a vulnerability disclosure programme, or any certification with its scope. 1 5 9 10

Report an error

The SaaS Developer

A published 99% uptime SLA with credits of 5% of the monthly fee per 30 minutes of downtime is stronger than most at this price, failed sends are retried for up to three days, and there is email support plus proactive one-to-one sending help, with SMTP guides for Laravel, WordPress, Magento and other named platforms. We found no public information on a public status page with incident history, team roles, or response times per plan; organisations separate domains with their own API tokens, and domain provisioning is automatable over HTTP. 2 3 5 8

Report an error

The Platform Engineer

The terms give me the paperwork I ask for first: 99% uptime on the API and dashboard with a written credit of 5% of the monthly fee per thirty minutes of downtime, up to 100% of monthly fees, claimable by email within thirty days, plus retry behaviour described — 4xx responses retried for up to three days and greylisting handled transparently. Domain provisioning is automatable over HTTP and platform integrations include Wordpress and Magento, but we found no public information on a public status page or incident history, team roles, or support response times, and the terms state delivery itself is not guaranteed. 2 3 5 8 10

Report an error

The Shop Operator

A 99% monthly uptime guarantee is published with service credits of 5% of the monthly fee per 30 minutes of unavailability, claimsable within 30 days, and support runs by email including 1:1 sending help — but there are no published response times per plan. We found no public information on a public status page with incident history, team roles, or sub-accounts, and while framework guides cover WordPress and Magento, there is no Shopware plugin in the captured pages. 3 5 8 10

Report an error

The Data Protection Officer

A 99% monthly uptime guarantee covers the API and dashboard with service credits of 5% of the monthly fee per thirty minutes of unavailability, claimable by email within thirty days, and there is monitoring with anomaly detection, support by email, organisations and domains with their own API tokens as separation, and guides for Rails, Laravel, Django, WordPress and Magento. We found no public information on a public status page or incident history, team member roles, support response times, failover across data centres, or queueing and retry of mail during incidents. 3 5 6 8

Report an error

The Agency Lead

The terms publish a 99% uptime commitment with service credits of 5% of the monthly fee per 30 minutes of unavailability, mail meeting 4xx errors is retried for up to three days, guides exist for Wordpress, Magento, Laravel, Django and Rails, and support runs by email with proactive 1:1 sending help. The domain-per-application structure with per-domain tokens comes close to what we need for sub-accounts, and the DPA explicitly covers a reseller scenario where the customer acts as processor for its own client. We found no public information on a public status page with incident history, team members with roles, or support response times per plan. 2 3 5 8 10

Report an error

The Skeptic

A published 99% monthly uptime guarantee with 5% credits per 30 minutes, claimable by email within 30 days, is more than most providers this size offer, and Rails, Node, Laravel, Django, Java, Wordpress and Magento setup examples exist alongside email support and 1:1 sending help with proactive spam-score review. But I found no public information on a public status page or incident history, redundancy across data centres, team roles, or support response times per plan, and the terms state plainly that delivery itself is not guaranteed. 3 5 8

Report an error

The SaaS Developer

The contracting entity is a UK company (OhMySMTP Ltd, England and Wales) under UK governing law, and while all stored email data sits in France on EU-owned infrastructure, sending itself runs through SMTP servers in the UK and two subprocessors — infrastructure hosting and payments — are UK-based, with Standard Contractual Clauses stated as the safeguard. Subprocessors are listed with their locations, the DPA is public, and we found no public information on security certifications. 8 9 10

Report an error

The Platform Engineer

All stored data sits in France on EU-owned cloud infrastructure, six subprocessors are named with their locations, and a public data processing agreement with standard contractual clauses is published — more transparency than most. But the contracting entity is OhMySMTP Ltd of England and Wales under UK governing law, and the privacy notice states each email is sent via SMTP servers based in the UK, so the sending chain itself leaves the EU; we found no public information on security certifications. 8 9 10

Report an error

The Shop Operator

Storage is stated to be in France on EU-owned cloud infrastructure with backups in two locations in Germany, and the subprocessors are listed with their locations — including UK providers for hosting, merchant-of-record payment and the SMTP servers that actually send each email — under a published DPA with Standard Contractual Clauses. The contracting entity is OhMySMTP Ltd in England and Wales under UK governing law, so for my German-Austrian shop the chain is European but not end-to-end EU. 8 9 10

Report an error

The Data Protection Officer

Transaction email data is stated to be stored and processed in France on Clever Cloud with subprocessors named and located — Hetzner in Germany for seven-day backups, Tutanota in Germany for support — under a published data processing agreement that includes controller-processor Standard Contractual Clauses signed with each vendor and objection rights. The contracting entity is OhMySMTP Ltd incorporated in England and Wales rather than an EU entity, actual sending runs through SMTP servers based in the UK alongside UK hosting and a UK merchant of record for payment, and we found no public information on security certifications or an EU representative. 8 9 10

Report an error

The Agency Lead

Stored transactional email, logs and account data are hosted in France on EU infrastructure, every subprocessor is named with its location — Clever Cloud in the EU, Hetzner in Germany for backups, AppSignal in Amsterdam, Tutanota in Germany, Freethought and Paddle in the UK — and a published DPA with Standard Contractual Clauses per vendor is offered. Sending itself runs through SMTP servers based in the UK, the contracting entity is OhMySMTP Ltd in England and Wales, and claims are governed by UK law, so for our German clients this is a documented, SCC-backed chain rather than an EU-clean one. We found no public information on security certifications with their scope. 8 9 10

Report an error

The Skeptic

Storage is documented as hosted in France on Clever Cloud, subprocessors are listed by name and location — Hetzner in Germany for backups, Tutanota for support email, AppSignal in Amsterdam — and standard contractual clauses are signed with each, with a public data processing agreement. But the contracting entity is OhMySMTP Ltd of England and Wales under United Kingdom governing law, sending itself runs through SMTP servers based in the UK, and two listed subprocessors (Freethought for infrastructure hosting and Paddle as merchant of record) are UK-based, so the "European company" framing covers stored data but not the whole sending chain; I found no public information on ISO 27001 or SOC 2 certification. 8 9 10

Report an error

The SaaS Developer

A starting price of under $4/month for 1,000 emails and scaling plans from $10/month at 10,000+ emails are public, and the pricing page names volume tiers up to a million emails per month, but we found no public information on the price of those higher tiers, overage rates per thousand, minimum term, or VAT treatment. The captured pages also give different figures for the free tier — the homepage shows a free tier of 100 emails per month while the deliverability page says there is no free plan because every sender is a paying user. 1 5 7 8

Report an error

The Platform Engineer

The homepage quotes 'Under $4/month 1000 emails/month' and 'Scaling plans from $10/month (10,000+ emails)', and tier volumes up to 1,000,000 emails per month are listed, but the prices for the larger tiers, the overage rate per thousand, and any add-ons are not shown, so I cannot compute an annual cost for my volumes; a $100 reinstatement fee appears in the terms. The captured pages also give different statements on a free tier — the homepage shows 'Free Tier 100/mo' while the deliverability page says there is no free plan. 1 5 7 8

Report an error

The Shop Operator

The starting price is stated as under $4/month for 1,000 emails with scaling plans from $10/month at 10,000+ emails, and volume tiers are named up to 1,000,000 — but the price of each tier above the starting points, overage rates, minimum term and VAT treatment are not shown, so I cannot compute my annual cost. The captured pages also give different figures on a free tier: the homepage shows 100 emails a month free while another page states there is no free plan. 1 5 7 8

Report an error

The Data Protection Officer

Public pages show a starting price of under $4/month for 1000 emails, scaling plans from $10/month at 10,000+ emails, volume tiers listed up to 1,000,000 monthly messages, and a $100 reinstatement fee. The captured pages give different figures on the free tier, and we found no public information on the price of each tier, the cost per additional thousand messages, add-ons, minimum term or VAT treatment, so a real annual cost cannot be computed from public pages alone. 1 5 7 8

Report an error

The Agency Lead

The starting price of under $4/month for 1,000 emails and scaling plans from $10/month (10,000+ emails) are public, tier volumes are listed up to 1,000,000 emails a month, and the terms state a $100 reinstatement fee. The captured pages give different figures for the free tier: the homepage shows a free tier of 100/month, while the deliverability page states there is no free plan because everyone sending is a paying user. We found no public information on prices for the higher tiers, overage rates per additional thousand emails, minimum term, or VAT treatment. 1 5 7 8

Report an error

The Skeptic

The starting price is stated as under $4/month for 1,000 emails with scaling from $10/month at 10,000, the volume tiers of 10,000 up to 1,000,000 are public, and a $100 reinstatement fee appears in the terms. But the captured pages give different figures on a free tier — the homepage lists one at 100 emails a month while the deliverability page says there is no free plan — and I found no public information on per-tier prices above 10,000, overage rates per thousand, minimum term, or VAT treatment, so an annual cost cannot be computed from public pages alone. 1 5 7 8

Report an error