/ Fork 02 — Enterprise infrastructure
Enterprise email delivery is not a bigger plan. It is a different contract.
The thing an enterprise buyer needs is not more send volume — it is accountability their risk, legal, and security teams can hold us to. Uptime and delivery-time SLAs with service credits, SOC 2 and ISO 27001 posture, GDPR and a signed DPA, data residency, and a named team with a defined escalation path. The honest map of what enterprise-grade delivery actually means.
/ Quick answer
Enterprise email delivery is defined by the contract, not the volume. What separates it from a bigger plan is accountability: uptime and delivery-time SLAs with service credits when missed, a documented compliance posture covering SOC 2, ISO 27001, GDPR, and a signed DPA, data residency options, a named operations team with defined escalation rather than a ticket queue, and a procurement process built to pass security and legal review. Note that enterprise email delivery is distinct from enterprise email security — gateways like threat protection and DLP solve a different problem. This is about getting your legitimate mail to the inbox, reliably, under terms your risk teams can enforce.
-
99.9%+
Platform uptime SLA on API and SMTP endpoints, backed by service credits when missed in a billing period.
-
SOC 2
Type II plus ISO 27001, GDPR alignment, and a signed DPA — handed to your security team up front.
-
Named team
Specific people who know your account, with a defined escalation path and committed response windows.
-
Residency
Data residency and regional sending configured in the agreement and documented in the contract.
/ 01 — Definition
What makes delivery enterprise-grade, and what it is not?
The word enterprise gets attached to email products to mean little more than expensive, which obscures the real distinction. Enterprise-grade delivery is not a tier with more messages in it. It is a relationship governed by a contract that gives your organization commitments it can enforce — and that distinction matters because the people who sign off on an enterprise purchase are not the engineers who will integrate it. They are risk officers, legal counsel, and security reviewers, and what they need is clear, durable accountability written down, in language their own frameworks recognize, that survives a change of personnel on either side of the contract.
That accountability has a specific shape. It is an uptime number you can hold us to, with money owed when we miss it. It is a delivery-time commitment measured and reported, not asserted. It is a compliance posture your auditors recognize and your customers' contracts require. It is a security review that passes your vendor assessment instead of stalling in it. And it is a human escalation path with names and response times, so that when something breaks, the resolution does not depend on which support agent happens to pick up the ticket. None of these is exotic; what is rare is finding them written into one agreement, enforceable together, from a provider that treats them as the baseline rather than as premium add-ons negotiated one painful clause at a time.
There is one clarification worth making up front, because the market muddies it. Enterprise email delivery is not the same as enterprise email security. Security gateways — threat protection, data loss prevention, anti-phishing, archiving — guard the mail arriving at your organization. Delivery is the opposite direction: getting your legitimate outbound mail to your customers' inboxes reliably. Both are enterprise concerns; they are different products solving different problems, and conflating them leads to buying the wrong thing.
Why does the contract matter more than the feature list at this level? Because at enterprise scale the failure modes are organizational, not technical. The risk is not that the platform cannot send fast enough; modern infrastructure handles volume without difficulty. The risk is that when something goes wrong — a deliverability incident, a compliance audit, a data-handling question from a customer — your organization has no enforceable recourse and no documented commitment to point to. The contract is what converts a good service into one your company can depend on under scrutiny, and it is precisely the thing a self-serve plan, however capable, does not and cannot ever provide on its own, no matter how polished the dashboard.
/ 02 — SLA structure
What should an email delivery SLA actually guarantee?
A real SLA separates distinct commitments, specifies how each is measured, names what is excluded, and defines the remedy as a concrete service credit. Anything softer is marketing wearing an SLA's clothes. The single most important test of an SLA is whether it states a remedy: if missing the target costs the provider nothing, the number is a hope, not a guarantee. The exclusions matter just as much, because an honest SLA is specific about what it does not cover — receiver-side throttling, your own DNS misconfiguration, force majeure — rather than quietly carving out so much that the commitment is hollow. Here is the structure.
| Commitment | What we guarantee | Measured | Remedy |
|---|---|---|---|
| Platform uptime | 99.9%+ availability of API and SMTP endpoints | Per billing month | Service credit when missed |
| Delivery-time | Message exits toward receiver within committed minutes | Monthly average, fastest 95% | Service credit when missed |
| Incident response | Named on-call response within committed window | Per incident, by severity | Defined escalation path |
| Support response | First response within tiered SLA by priority | Per ticket | Escalation on breach |
The shape of a credit clause, in plain terms, looks like this — concrete percentages tied to the missed target, not a discretionary gesture.
# Illustrative service-credit structure (uptime)
Monthly uptime >= 99.9% -> no credit (target met)
Monthly uptime 99.0 - 99.9% -> 10% credit of monthly fee
Monthly uptime 95.0 - 99.0% -> 25% credit of monthly fee
Monthly uptime < 95.0% -> 50% credit of monthly fee
# Exclusions are named explicitly:
# receiver-side throttling, customer DNS/config errors,
# force majeure, scheduled maintenance windows. One detail that separates a serious SLA from a token one is how the delivery-time figure is measured. A provider can quote an impressive average by including only the easy sends and quietly excluding the slow tail, so the honest version specifies the methodology: the fastest ninety-five percent of test messages, measured continuously, with the slow long tail counted rather than hidden. When you review an SLA, the measurement clause tells you more about the provider's confidence than the headline number does, because anyone can promise a good average — only a provider that trusts its infrastructure will commit to how the average is computed and what fraction of sends it covers.
/ 03 — Compliance
The compliance certifications procurement asks for.
The ones your auditors and your customers' contracts require. The right provider hands these to your security team proactively, under NDA, rather than making you pry them loose during a stalled review.
SOC 2 Type II
Security controls operating effectively over time. The certification most enterprise procurement treats as table stakes.
ISO 27001
A formal information security management system, externally audited.
GDPR + DPA
Alignment for EU and UK data, with a signed data processing agreement covering how message data is handled.
Data residency
Commitment that data is stored and processed within a specified region, documented in the contract.
Certifications are necessary but not sufficient. A SOC 2 report tells your auditor the controls exist and operate; it does not by itself tell you the provider will pick up the phone at 2 a.m. The compliance posture and the operational posture are separate questions, and an enterprise agreement has to satisfy both. A provider strong on paper but weak on response is a procurement pass and an operational failure waiting to happen. The reverse is also true: a provider with a brilliant on-call team but no formal certifications will stall in your security review no matter how good the engineering is. Enterprise readiness lives at the intersection, where the paperwork your auditors need and the people your operations need both exist in the same vendor.
/ 04 — Accountability
The accountability stack, from contract to on-call.
Enterprise delivery is a stack of commitments, each resting on the one below. The contract sets the terms, the SLAs make them measurable, the compliance posture proves the controls, and the named team turns all of it into a human who answers when it matters.
/ 05 — The team
What a named operations team changes.
It changes who answers, and how fast, when something is wrong. Standard support is a queue: you file a ticket and wait for whoever picks it up, explaining your setup from scratch each time. A named team means specific people who already know your account, your sending patterns, and your history, reachable through a defined escalation path with committed response times by severity. The context does not reset with every incident, because the people do not change.
The value of that becomes obvious during an incident. When a major receiver starts deferring your mail in the middle of the night, the question is how long your mail sits undelivered before someone who can act is engaged. A ticket queue measures that in hours. A named on-call engineer who already holds postmaster contacts at the major receivers measures it in minutes. For transactional mail that gates a customer's ability to log in, reset a password, or complete a purchase, those minutes are the difference between an incident and an outage.
The team also closes the loop after an incident. Enterprise agreements include post-incident reports with root-cause analysis, because a risk team needs to know not just that the problem was fixed but why it happened and what prevents a recurrence. That reporting discipline — live status during an incident, a written analysis after — is part of what the named-team model delivers that a queue structurally cannot. Accountability is not only fast response; it is the paper trail that lets your organization trust the response was real.
There is a compounding effect to the relationship that a queue can never build. Over months, a named team learns the shape of your sending — which campaigns spike volume, which receivers are sensitive to your content, where your deliverability has historically been fragile. That accumulated knowledge means problems are caught earlier and often prevented entirely, because the team recognizes the early signature of an issue they have seen on your account before. A ticket queue starts from zero every time; a named team starts from everything it already knows about you. The longer the relationship runs, the wider that gap grows, and it is a large part of why enterprise senders value continuity of team over raw responsiveness.
/ 06 — Procurement
Built to pass security review, not to dodge it.
The friction in enterprise procurement usually comes from a provider that was built for self-serve signup and treats every legal and security requirement as an exception. The enterprise track is built the other way: the documentation your team needs is ready before you ask. The difference shows up in the timeline. A provider that has run the enterprise gauntlet before moves through a security questionnaire in days because the answers are already written; one that has not turns every question into a research project, and a procurement cycle that should take weeks stretches into months. Readiness is not a feature you can see on a pricing page, but it is the thing that determines whether the contract closes this quarter or next.
Security documentation
SOC 2 and ISO 27001 reports under NDA, completed security questionnaires, penetration test summaries, and architecture documentation — provided up front.
Legal agreements
A master services agreement and a signed data processing agreement, with the SLA remedies and data-handling commitments your legal team requires negotiated in.
Vendor assessment
A process designed to move through your vendor risk assessment cleanly, rather than stalling because the provider has never seen an enterprise questionnaire before.
Data residency
Written commitments on where message data is stored and processed, configured to satisfy regional regulatory obligations.
Audit rights
Defined log retention, export rights, and the ability to request evidence of compliance on a set cadence, written into the agreement.
Onboarding
A migration plan with dedicated IPs warmed on a schedule matched to your send curve, so the transition does not put deliverability at risk.
/ 07 — Which tier
Enterprise or managed — which one does your sending actually need?
Managed delivery and enterprise delivery overlap, and the distinction is worth drawing clearly so you do not over-buy or under-buy. Managed is about who operates your deliverability; enterprise adds the contractual and compliance framework on top. Many senders need one without the other.
Managed is enough when
- → You want a team operating your deliverability and IPs
- → Your procurement does not require formal SLAs or audits
- → A strong working relationship matters more than contractual remedies
- → You do not have data-residency or certification mandates
You need enterprise when
- → Legal requires an MSA with negotiated SLA remedies
- → Security review demands SOC 2, ISO 27001, and a DPA
- → You have data-residency or regional sending obligations
- → Audit rights and post-incident reporting are contractual
In practice the enterprise tier is managed delivery with the contractual and compliance layer wrapped around it. Every enterprise customer gets the managed operations — the named team, the dedicated IPs, the daily monitoring — plus the SLAs, certifications, and procurement support that turn an operational relationship into one your risk and legal teams can sign off on. If you need the operations but not the paperwork, managed delivery is the right starting point, and you can move up to enterprise when a contract or a compliance mandate makes it necessary. The path between them is deliberately smooth: moving from managed to enterprise adds the legal and compliance scaffolding without changing anything about how your mail is sent or who operates it, so the upgrade is a procurement exercise rather than a technical migration.
/ Common questions
What enterprise buyers ask.
What makes email delivery enterprise-grade rather than just a bigger plan?
Enterprise-grade is defined by the contract, not the message volume. A bigger plan gives you more sending capacity; an enterprise agreement gives you commitments you can hold the provider to. That means uptime and delivery-time SLAs with service credits when they are missed, a documented compliance posture covering SOC 2 and ISO 27001, GDPR and a signed data processing agreement, data residency options for where your data is handled, a named operations team rather than a ticket queue, and a procurement process built to pass your security and legal review. You can send a million messages a month on a self-serve plan; what you cannot get there is the accountability framework that an enterprise buyer's risk, legal, and security teams require.
What should an email delivery SLA actually guarantee?
Two distinct things, and good SLAs separate them. The first is platform uptime — the percentage of time the sending API and SMTP endpoints are available, commonly committed at 99.9% or higher, with service credits owed when the figure is missed in a billing period. The second is delivery-time performance — how quickly a message accepted into the platform exits toward the receiver, measured over the month and often committed in minutes. Both should specify what is excluded, such as receiver-side throttling outside the provider's control, and both should define the remedy as a concrete service credit rather than a vague promise. An SLA without a defined remedy is marketing, not a guarantee.
Which compliance certifications matter for enterprise email delivery?
The ones your own auditors and customers ask about. SOC 2 Type II demonstrates that security controls operate effectively over a sustained period, audited rather than self-asserted, and it is the certification most enterprise procurement teams treat as table stakes. ISO 27001 shows a formal information security management system. For any sending that touches the data of people in the EU or UK, GDPR alignment and a signed data processing agreement are mandatory, along with clarity on where data is stored and processed. Depending on your industry, you may also need to confirm data residency in a specific region. The right provider hands these to your security team proactively rather than making you extract them.
What does a named operations team change versus standard support?
It changes who answers and how fast when something is wrong. Standard support is a queue: you file a ticket and wait for whoever picks it up. A named team means specific people who know your account, your sending patterns, and your history, reachable through a defined escalation path with committed response times. When a receiver starts deferring your mail at 2 a.m., the difference between a queue and a named on-call engineer who already holds postmaster contacts is measured in how long your mail sits undelivered. For mail that carries real business weight, that response model is often the entire reason to move to an enterprise agreement.
Can you support data residency and regional sending requirements?
Yes, and it is a common enterprise requirement that smaller plans cannot meet. Data residency means committing that your message data is stored and processed within a specific region — the EU, for instance — to satisfy regulatory or contractual obligations. Regional sending means originating your mail from infrastructure in a chosen geography, which can matter both for compliance and for deliverability with regional receivers. Both are configured as part of the enterprise agreement and documented in the contract, so your compliance team has a written commitment rather than a verbal assurance.
How does the procurement and security review process work?
It is built to pass enterprise vetting rather than to avoid it. We provide the security documentation your team needs up front: SOC 2 and ISO 27001 reports under NDA, completed security questionnaires, the data processing agreement, penetration test summaries, and architecture documentation. We sign a master services agreement and negotiate the terms your legal team requires, including the SLA remedies and data handling commitments. The goal is to move through your vendor assessment without the friction of a provider that was built only for self-serve signup and treats every enterprise requirement as an exception.
Bring the questionnaire. We have the answers ready.
Talk to enterprise sales about SLAs, compliance documentation, and a migration plan. We move through security review at the pace your procurement team sets — with the SOC 2, the DPA, and the SLA remedies on the table from the first call.
Book infrastructure reviewRelated capabilities