Transactional
Receipts, password resets, confirmations, notifications.
Sent over SMTP or API the instant your app calls. Webhooks for every event, templates, and real-time delivery logs.
- SMTP & API
- Webhooks
- Templates
- Delivery logs
Transactional & marketing email
Transactional and marketing email, hosted in the EU.
Epostix sends your product email and your campaigns from the same place — one API, one dashboard, one set of sending domains. Servers are in the EU, and a data processing agreement comes as standard.
- EU-hosted
- Transactional + marketing
- REST API & SMTP
Free plan, no card required.
Sending for iGaming or other high-volume verticals?
Compliance and data residency,
included as standard.
- EU-Hosted
- GDPR-Compliant
- DPA included
- EU data residency
One platform
Both kinds of email in one place
Most providers do either transactional or marketing email, so teams end up running two services with two bills and two sending reputations to watch. Epostix handles both. Receipts, password resets and notifications go out over the API or SMTP; campaigns, segments and reporting run from the same dashboard, on the same domains.
Marketing
Campaigns, audience segmentation, engagement scoring.
Run from the same dashboard, on the same domains and sending reputation as your transactional email.
- Campaigns
- Segments
- Engagement tiers
- Reporting
Context
Why email delivery is harder than it looks.
Three things shape whether an email actually arrives. Each is easier to ignore than to handle correctly. The sections below describe how Epostix handles them.
01
Providers aren’t the same
Gmail, Microsoft, Yahoo, and Apple each throttle, bounce, and filter differently. A delivery system that treats them identically hits limits it doesn’t understand.
02
Reputation compounds
Sender reputation isn’t per-email — it’s per-domain, accumulated over time. A bounce spike today can affect future placement. Most dashboards don’t surface this trajectory.
03
Authentication is exacting
SPF, DKIM and reverse DNS have to line up for every sending domain. When they don’t, mailbox providers quietly treat your mail as suspect — a common, hard-to-spot cause of spam-foldering.
The platform
How Epostix addresses this.
Deliverability
How sending actually works here
Mailbox providers don’t behave the same way. Gmail, Outlook and Yahoo each apply their own rate limits and filtering, so Epostix adjusts how it sends to each one rather than treating them as one queue. Every bounce is classified by type and cause, hard bounces are suppressed automatically, and sending pauses on its own if complaint or bounce rates climb past a threshold you can set.
Provider-specific sending
Different mailbox providers have different rules. The delivery engine handles each one separately.
- Gmail — rate limit detection with automatic cooldown
- Microsoft — concurrency management
- Yahoo — adjusted retry intervals
- Apple, Proton, Zoho, GMX — provider-tuned handling
- Automatic queue pause when a provider signals overload
Sending safeguards
Problems with email sends tend to escalate fast. These safeguards catch them early.
- Campaign circuit breaker. Automatically pauses sending if bounce or complaint rates spike.
- Pre-send health checks. Validates content, unsubscribe links, spam risk, template variables, and recipient count — pass / warning / fail before any email goes out.
- Duplicate detection. Blocks accidental repeat sends to the same recipient within a short window.
- API idempotency. Safe to retry requests without creating duplicates.
Default thresholds: 2% hard-bounce, 0.3% complaint, 3× spike over 24h baseline. Configurable per workspace.
Bounce classification
When an email bounces, the reason matters as much as the fact. The system classifies every bounce by type, cause, and provider.
- Hard bounces — permanent failures, auto-suppressed
- Soft bounces — temporary issues, retried with provider-aware timing
- Spam complaints — suppressed, source identified
- Infrastructure issues — SPF/DKIM/DMARC problems flagged separately from recipient issues
- Progressive suppression — contacts move through hold stages based on bounce patterns rather than a single-strike removal
Authentication and IPs
Sender authentication is set up for each domain, and dedicated IPs are available when you want to manage your own reputation.
- SPF, DKIM and reverse DNS (FCrDNS) configured for every sending domain
- Per-domain DKIM signing, managed for you
- Dedicated IPs with a warm-up schedule when you need them
- Open and click tracking, on or off per email type
Transactional
Transactional email.
Send password resets, receipts, confirmations, and notifications with per-email delivery tracking and automatic retry.
api.epostix.com / v1 / emails
curl https://api.epostix.com/v1/emails \
-H "Authorization: Bearer $EPX_API_KEY" \
-H "Idempotency-Key: order_4821_welcome" \
-H "Content-Type: application/json" \
-d '{
"from": "[email protected]",
"to": "[email protected]",
"subject": "Welcome to Acme",
"html": "<h1>Welcome</h1><p>You're in.</p>",
"tags": ["welcome", "tier:pro"]
}'201 · createdid: 745ffb9c-f8b1-4306-9a2c-55dcd39fd1c3queued
Sending
- REST API and SMTP relay
- Template engine with variable substitution
- Custom DKIM signing per domain
- Open and click tracking, toggleable per email type
- Webhook notifications — delivered, bounced, opened, clicked, complained
- Official SDKs — TypeScript, Python, Go
Reliability
- Automatic retry with exponential backoff — up to 10 attempts, 1-hour window
- Idempotency keys — safe to retry API requests without duplicates
- Duplicate detection — blocks accidental repeat sends within a short window
- Dedicated IP with warming schedule
Security
- API key auth with IP whitelisting and expiration tracking
- Two-factor authentication (TOTP)
- Role-based access — owner, admin, user
Per-email traceability
Every email has a detail page — sender, recipient, subject, send timestamp, current delivery status, and the rendered content as the recipient saw it.
Marketing
Marketing email.
Run campaigns with pre-send validation, automatic safeguards, and engagement tracking across your full audience.
Audience · 37,858 contactsAuto-tiered
Engaged23,481 · 62%
At-risk6,802 · 18%
Inactive5,303 · 14%
Cold2,272 · 6%
Contacts move between tiers based on opens, clicks, and recency. Cold and inactive contacts can be throttled or excluded automatically.
Pre-send health · April newsletterReady to send
- Domain authenticationSPF, DKIM, DMARC validated for send.acme.eu
- Audience health37,858 contacts · 2.1% expected bounce rate
- Content & spam scanRspamd score 0.4 · 14 links checked
- Template variables100/100 sample contacts · 100% coverage
- Unsubscribe & list-unsubscribeOne-click and footer link both present
- !Circuit breaker armedPause on bounce or complaint rate spikes
Campaign management
- Full lifecycle — draft, schedule, send, pause, resume, cancel
- Performance reporting with engagement timeline
- 48-hour retry window for persistent delivery
Safeguards
- Pre-send health checks — content, unsubscribe link, spam score, template variables, recipient estimate, with pass / warning / fail
- Campaign circuit breaker — automatic pause on bounce or complaint rate spikes
Audience
- Tag-based targeting with auto-tagging rules
- Engagement tier scoring — engaged, at-risk, inactive, cold
- Visual segment builder with real-time audience count
- CSV import / export
- Reusable template components with versioning
Architecture
Built and operated in-house.
The delivery engine, bounce classifier, provider handling rules, and circuit breaker logic are developed and maintained by the Epostix team.
When provider behavior changes, the rules are updated by the people who wrote them.
Data location
Where your data lives
Email content, logs, analytics and contact data stay on servers in the EU. We include a data processing agreement by default and list our subprocessors publicly. If you have data-residency requirements, this keeps everything in one jurisdiction, so you’re not relying on transfer mechanisms like Standard Contractual Clauses or the EU–US Data Privacy Framework to move data abroad.
Data locationEuropean Union
Stored and processed in the EU
Email content, logs, analytics and contacts sit on servers in the European Union.
DPA included as standard
A data processing agreement is part of every plan, not just enterprise.
Subprocessors listed publicly
All subprocessors are EU-based and published, with notice before any change.
For developers
Built on a documented API
A REST API and standard SMTP, with an OpenAPI spec you can generate clients from. Idempotency keys so retries don’t create duplicates. Per-key permissions and IP allowlists. A sandbox for testing without spending quota, and webhooks for delivery, bounce, open, click and complaint events.
OpenAPI 3.0 specification
Generate clients in any language from the public spec.
API key auth + IP allowlist
Per-key permissions, per-key IP allowlists, rotate without downtime.
Idempotency built in
Safe to retry every send endpoint — duplicates are caught at the API layer.
Sandbox environment
Test sends without burning quota. Inspect every request and response.
Official SDKs
TypeScript, Python, and Go — generated from the spec.
Webhook events
Real-time delivery, bounce, open, click, and complaint notifications.
Pricing
Priced by what you send.
Every plan carries the same provider-specific sending, the same safeguards and the same bounce handling. The tier only sets the volume.
Rate card
10,000emails / month
1K2M+
Free
StarterBest fit
Growth
Included on every plan
- SMTP & REST API access
- Idempotency and duplicate detection
- Real-time analytics
- Webhook notifications
- Template engine
- Custom DKIM
- Smart retry with exponential backoff
- Official SDKs
Free plan, no card requiredDomain verification before sendingCancel anytime
The free plan is fully functional — same sending, same safeguards. Domain verification typically completes within minutes.
Sending for iGaming or need dedicated IPs and managed warmup? See dedicated plans →
Scope
What to expect.
01
Inbox placement depends on many factors beyond any sending platform’s control. Epostix provides sending controls, bounce data, and reputation signals — placement decisions are made by receiving providers.
02
Domain verification is required before sending. The platform reviews sending patterns to maintain infrastructure quality.
03
Delivery data and safeguards help senders make better decisions. List hygiene, content quality, and audience management remain the sender’s responsibility.
Security
Security.
API and SMTP traffic runs over TLS. Email content is encrypted at rest, and backups are encrypted too. Accounts support two-factor authentication and role-based access, and public endpoints are rate-limited.
01
TLS 1.2+ enforced
All API and SMTP traffic over modern TLS. Forward secrecy on every connection.
02
Two-factor authentication
TOTP-based 2FA on every account. Recovery codes. Session revocation across devices.
03
API key controls
IP whitelisting, expiration dates, and last-used tracking. Tokens hashed at rest — never stored in plain text.
04
Role-based access
Owner, admin, and user roles. Per-domain access controls. Team invitations only.
05
Encrypted storage
Email content stored encrypted at rest. Database backups encrypted.
06
Rate limiting & bot protection
Rate limiting on every public endpoint. Turnstile on login, signup, and password reset.
Data protection
Compliance.
End users can request their data or have it deleted, and deletion cascades through audiences, history and engagement records. Consent — method, date and source — is recorded per contact. Every campaign includes one-click unsubscribe. A standard DPA is available on every plan, not just enterprise.
01
GDPR data erasure
End users can request complete deletion. Cascades across audiences, history, and engagement records.
02
GDPR data export
Full contact data export on demand in machine-readable format. No support ticket required.
03
Consent tracking
Opt-in method, date, and source recorded per contact. Audit trail available for every subscriber.
04
List-Unsubscribe headers
One-click unsubscribe (RFC 8058) on every campaign email — compliant with current sender requirements.
05
EU subprocessors
All subprocessors EU-based and listed publicly. Updates ship with 30-day notice.
06
DPA on request
Standard Data Processing Agreement available for every workspace, no enterprise tier required.
Try it on your own domain
Sign up, verify a domain, and send a test in a few minutes. The free plan doesn’t need a card, and there’s no sales call to get started.
Free plan · no card required