Most providers do either transactional or marketing email, so teams end up running two services with two bills and two sending reputations to watch. Epostix handles both. Receipts, password resets and notifications go out over the API or SMTP; campaigns, segments and reporting run from the same dashboard, on the same domains.
Sent over SMTP or API the instant your app calls. Webhooks for every event, templates, and real-time delivery logs.
Run from the same dashboard, on the same domains and sending reputation as your transactional email.
Three things shape whether an email actually arrives. Each is easier to ignore than to handle correctly. The sections below describe how Epostix handles them.
Gmail, Microsoft, Yahoo, and Apple each throttle, bounce, and filter differently. A delivery system that treats them identically hits limits it doesn’t understand.
Sender reputation isn’t per-email — it’s per-domain, accumulated over time. A bounce spike today can affect future placement. Most dashboards don’t surface this trajectory.
SPF, DKIM and reverse DNS have to line up for every sending domain. When they don’t, mailbox providers quietly treat your mail as suspect — a common, hard-to-spot cause of spam-foldering.
Mailbox providers don’t behave the same way. Gmail, Outlook and Yahoo each apply their own rate limits and filtering, so Epostix adjusts how it sends to each one rather than treating them as one queue. Every bounce is classified by type and cause, hard bounces are suppressed automatically, and sending pauses on its own if complaint or bounce rates climb past a threshold you can set.
Send password resets, receipts, confirmations, and notifications with per-email delivery tracking and automatic retry.
Every email has a detail page — sender, recipient, subject, send timestamp, current delivery status, and the rendered content as the recipient saw it.
Run campaigns with pre-send validation, automatic safeguards, and engagement tracking across your full audience.
The delivery engine, bounce classifier, provider handling rules, and circuit breaker logic are developed and maintained by the Epostix team.
When provider behavior changes, the rules are updated by the people who wrote them.
Email content, logs, analytics and contact data stay on servers in the EU. We include a data processing agreement by default and list our subprocessors publicly. If you have data-residency requirements, this keeps everything in one jurisdiction, so you’re not relying on transfer mechanisms like Standard Contractual Clauses or the EU–US Data Privacy Framework to move data abroad.
Email content, logs, analytics and contacts sit on servers in the European Union.
A data processing agreement is part of every plan, not just enterprise.
All subprocessors are EU-based and published, with notice before any change.
A REST API and standard SMTP, with an OpenAPI spec you can generate clients from. Idempotency keys so retries don’t create duplicates. Per-key permissions and IP allowlists. A sandbox for testing without spending quota, and webhooks for delivery, bounce, open, click and complaint events.
Generate clients in any language from the public spec.
Per-key permissions, per-key IP allowlists, rotate without downtime.
Safe to retry every send endpoint — duplicates are caught at the API layer.
Test sends without burning quota. Inspect every request and response.
TypeScript, Python, and Go — generated from the spec.
Real-time delivery, bounce, open, click, and complaint notifications.
Plans are based on how much you send and how many contacts you keep. Every plan includes the same provider-specific sending, safeguards and bounce handling. Move the slider to see what fits.
The free plan is fully functional — same sending, same safeguards. Domain verification typically completes within minutes.
Inbox placement depends on many factors beyond any sending platform’s control. Epostix provides sending controls, bounce data, and reputation signals — placement decisions are made by receiving providers.
Domain verification is required before sending. The platform reviews sending patterns to maintain infrastructure quality.
Delivery data and safeguards help senders make better decisions. List hygiene, content quality, and audience management remain the sender’s responsibility.
API and SMTP traffic runs over TLS. Email content is encrypted at rest, and backups are encrypted too. Accounts support two-factor authentication and role-based access, and public endpoints are rate-limited.
All API and SMTP traffic over modern TLS. Forward secrecy on every connection.
TOTP-based 2FA on every account. Recovery codes. Session revocation across devices.
IP whitelisting, expiration dates, and last-used tracking. Tokens hashed at rest — never stored in plain text.
Owner, admin, and user roles. Per-domain access controls. Team invitations only.
Email content stored encrypted at rest. Database backups encrypted.
Rate limiting on every public endpoint. Turnstile on login, signup, and password reset.
End users can request their data or have it deleted, and deletion cascades through audiences, history and engagement records. Consent — method, date and source — is recorded per contact. Every campaign includes one-click unsubscribe. A standard DPA is available on every plan, not just enterprise.
End users can request complete deletion. Cascades across audiences, history, and engagement records.
Full contact data export on demand in machine-readable format. No support ticket required.
Opt-in method, date, and source recorded per contact. Audit trail available for every subscriber.
One-click unsubscribe (RFC 8058) on every campaign email — compliant with current sender requirements.
All subprocessors EU-based and listed publicly. Updates ship with 30-day notice.
Standard Data Processing Agreement available for every workspace, no enterprise tier required.