Security and compliance

Outbound is fail-closed.

No single UI toggle can bypass the controls required for a real send.

Readiness gates

Global enablement, live campaign mode, entitlement, verified country, verified domain, verified sender reputation, approvals, suppression checks, and capacity must all pass.

Tenant and role boundaries

All application data is accessed by a server-only role. Owners control configuration and sends; members are read-only by default. Data lives in EU Postgres, and booking runs on our own EU-hosted scheduler, so prospect details never route through US calendar tooling.

Event integrity

AgentMail events use Svix verification, replay tolerance, event-ID deduplication, and provider identifiers for routing.

Automatic containment

Complaints quarantine the mailbox and domain and pause the campaign. Hard bounces enter suppression immediately.