Roadmap

What works today, and what comes next.

Nothing is listed as available until it runs. Items on the right have no date until they ship.

Business email

Mailboxes on your own domain
Personal and role addresses on a domain you own, managed together in one workspace.
Guided DNS setup
We issue the MX, SPF, DKIM and DMARC records for your domain, then check what is actually published. The DKIM key is compared with the one we sign with, not just looked up.
Webmail in the browser
Read, write and organise mail with labels, smart folders, snooze and signatures. Nothing to install.
Workspaces and roles
Each company or team is its own workspace, with its own members, admins and mailboxes.
Single sign-on
SAML 2.0 single sign-on, configured by a workspace admin.
Phishing-resistant sign-in
Passkeys (WebAuthn) for sign-in. Passwords, where used, are hashed with Argon2id.

One send endpoint
POST /v1/messages with text, HTML or a stored template plus variables. Inputs are validated at the edge, and a bad request names the exact field and reason.
Safe retries
Send an Idempotency-Key and a retried request replays the original response for 24 hours instead of sending twice.
Signed webhooks
HMAC-SHA256 over timestamp and body, 10 attempts over about 24 hours, and every attempt listed per endpoint. A short outage never switches your endpoint off.
An events API
Queued, sent, delivered, deferred, bounced, complained, opened, clicked, unsubscribed and received events, cursor-paginated.
Domains you can verify
Publish the DKIM, SPF and DMARC records we issue, and we check the published key against the one we sign with.
Suppression and a typed SDK
Hard bounces, complaints and unsubscribes suppress future sends, scoped to your account. A TypeScript client and webhook verifier ship as @alecrae/sdk.

No ads
We are paid by the businesses that use us. There is no advertising in the product, and there never will be.
No analytics or ad scripts
This site and the app load no third-party analytics, advertising or tracking scripts.
Your mail is not for sale
We do not sell your data, and we do not mine your mail to profile you.
Encryption where it is real
TLS on every web and API connection. Connected-account tokens and DKIM signing keys are encrypted at rest with AES-256-GCM.
AI is opt-in and metered
Background AI processing is off unless it is switched on, and every AI call goes through one metered path with a spending limit.
Sent is not delivered
A message is marked sent when our relay accepts it, and delivered only when the receiving server's acceptance is reported back. When we don't know, we say so.

Tell us what you would use it for: email us.