Delivery and deliverability (e-mail channel)

Reputation is built here, IP by IP

E-mail is the first channel the platform opened, and it serves it end to end. With no provider to carry it, it manages its own sending reputation: that is a constraint — it has to be built — and a guarantee, since no message, no address and no content ever passes through a third party.

Built-in delivery

Messages are handed directly to the recipients’ mail servers, from the platform’s own IP addresses.

No third-party sender: the content of a message does not cross an outside platform.
Opportunistic encryption of the exchange with the recipient server, and an explicit, recorded fallback when it is not available.
The message body is composed at delivery time and never kept once it has gone.
Nothing is sent from within an HTTP request: it all goes through the queue, with spaced retries and deferral rather than failure.
A space’s sending windows and quotas are honoured message by message.

Sending domains

An unverified domain sends nothing. Verification is a condition, not a recommendation.

Declare a domain, publish the DNS records returned — SPF, DKIM, DMARC — and it is verified before the first send.
DKIM signing per domain, with keys kept encrypted and never returned.
An aligned bounce domain per sending domain, so that DMARC alignment is satisfied.
A tracking domain per space for images, public pages and rewritten links — served with no cookie and no external resource.
Removing a domain is checked: it does not break sends in flight.

What you publish in your DNS zone

A sending authorisation for the platform’s IP addresses (SPF).
A public signing key per domain (DKIM), whose private key stays encrypted inside the perimeter.
A policy for unaligned messages (DMARC), and the address to receive its reports.
A record for the aligned bounce domain, which makes alignment possible.
A record for the space’s tracking domain: images, public pages and rewritten links.

Reputation and warm-up

A new IP address does not send like an established one.

Progressive warm-up per IP address and per sending domain: daily caps that grow with reputation.
When a cap is reached, the message is deferred, not lost.
Health monitoring per recipient family: large mailbox providers do not react the same way.
Automatic pause when bounce or complaint rates cross a space’s thresholds: we stop before being blocked.
Reputation signals collected from mailbox providers are aggregates about our own IP addresses and domains — never about a person.

Bounces, complaints and suppression

What comes back is handled, and what must stop, stops.

Hard bounces and complaints go straight to the suppression list: that address is not written to again.
Soft bounces are retried on a decreasing schedule, then abandoned cleanly.
The suppression list is held as fingerprints, outlives the anonymisation of a record, and is never purged.
A one-click unsubscribe takes effect immediately, with no intermediate page and no confirmation.
Inactive-contact handling is based solely on the exempt deliverability signal: stopping writing to someone who no longer opens does not require their consent to be measured.

What puts an address on the suppression list

A hard bounce: no such mailbox, invalid domain, outright refusal by the recipient server.
A spam complaint, reported by the mailbox provider.
An unsubscribe, which applies to the purpose concerned and, if the person asks, to all of them.
An objection recorded by the data controller.
A suppression entry does not lift by itself: it outlives the anonymisation of the record.

Signals and statistics

Numbers that say what they measure, and who they refer to.

Sent, delivered, bounced — hard and soft kept apart —, complaints, unsubscribes: delivery signals are independent of any consent to measurement.
Open and click rates are reported against the consenting population, published next to the result.
Breakdown per sending domain, per journey, per campaign and per step.
Exports on demand or scheduled, with no personal data.
Counters served to platform operation roles are masked below the display threshold.

GET /v1/stats/overview?from=2026-09-01&to=2026-09-07

{
  "sent": 48210, "delivered": 47655,
  "bounced_hard": 212, "bounced_soft": 343,
  "complained": 9, "unsubscribed": 127,
  "performance": {
    "consented_population": 12480,
    "opened": 5311, "clicked": 842,
    "open_rate": 0.4256, "click_rate": 0.0675
  }
}

# Rates are computed on the consenting
# population — never on sends.