Templates, kits and public pages

Composing an e-mail, and everything it carries

An e-mail is not just content: it carries images, an online version, an unsubscribe link and a preference page. All of it is produced within the platform’s perimeter, with no external resource and no code execution.

What was sent stays readable without any message body having been kept.

Template editor

A declarative syntax, checked on save, never at send time.

Search and replace in the source, assisted insertion of the available variables, live preview with a real or fictitious contact.
No code execution: variables, filters, blocks and includes, and nothing else. Whatever the engine does not know is refused.
An error is rejected on save, with line and column. A template that ships is a template that compiles.
Reusable fragments – header, footer, legal notices – shared across a space’s templates.
Content reads the latest event of each type received by the contact: the amount of the last order, the date of the next appointment, the contents of a basket. The message is written from what has just happened, with no extra request.
A marketing template without an unsubscribe link is refused; so is an unverified sending domain.
A text version is produced alongside the HTML, and the unsubscribe headers are set by the platform, not by the author.
No contact data in a URL (link, image, stylesheet): a template or fragment that places any there is refused on save, with the offending position. An image whose loading depends on a condition on the contact must be hosted on a domain of the space or in its file library.

What a variable cannot be

Attributes of a sensitive class are not available at render time: they are not inserted into a message. Differentiation comes from the choice of journey, never through a merge variable – an e-mail in transit is the most exposed copy of the most sensitive data.

Engagement variables – opened, clicked – are only served for contacts whose tracking consent is valid at render time. For the others they stay empty, and the message stays correct.

HTML kit import

A file or an archive delivered by an agency becomes a draft, ready to be corrected.

Images from the archive are moved into the space’s library and relative references are rewritten.
Local stylesheets are inlined into the document; scripts, frames, forms and event handlers are removed.
No remote resource is ever fetched: external addresses are listed in the report, for you to upload yourself.
Nothing is saved as a template until you have reviewed it: the import produces a draft and a report of what is left to do.
Image formats are recognised from their byte signature, and metadata – including a photograph’s location – is stripped.

File library

Images hosted within the perimeter, served with no cookie and no external dependency.

Organised in folders, searchable, reusable from one template to another and in public pages.
Served from the space’s domain, with a media type set by the server, a long cache and no cookie.
Raster formats only – formats that can carry a script are refused.
Content addressing: the same file uploaded twice is stored once, and the space’s quota applies.
Files stay within the perimeter: no external object storage, no third-party content delivery network.

Branded public pages

You do the styling, the platform generates the form, the tokens and the states.

An unsubscribe page and a preference page per space, with your logo, your colours and your wording, per language.
The preference page lets people choose their subscriptions, choose what may be measured, or unsubscribe from everything. Every change writes a consent act with its exact wording.
The form, the tokens and the states are produced by the platform: a space never supplies a whole page – no phishing on our domain, no token leakage.
No external resource and no script: logo served from the same host, inline styles, a strict content security policy.
One-click unsubscribe (RFC 8058) and the matching headers accompany every marketing e-mail – immediate effect, with no intermediate page. The link placed in the message body leads instead to a confirmation page with a single button, whose wording is customised along with the other public pages.

What a space never supplies itself

The whole page: the form, the tokens and the states are generated by the platform, so that no page hosted on its domain can be used for phishing.
A script, a frame or an event handler: they are refused on save and stripped at render time.
A remote resource: the logo comes from the library and is served from the same host.
The wording of the unsubscribe link in a marketing e-mail, whose presence is checked before sending.

Frozen versions and the online version

What was sent must be readable as it was, without keeping a copy of the message.

Every send freezes the version of the template and of its fragments: changing a footer tomorrow does not rewrite what went out yesterday.

The online version of an e-mail is rendered on demand from that frozen version and the contact’s data at the time of the request. No rendered message body is ever kept: the most exposed copy of the most sensitive data does not exist. That page inserts no pixel.