SaaS Platforms

Provide your customers with reliable, isolated email infrastructure without building and maintaining your own email layer. ApexMail’s subaccount model gives each of your tenants independent domains, API keys, suppression lists, and event streams.

Audience

SaaS platforms that send email on behalf of their customers: CRMs sending campaign email, e-commerce platforms sending receipts, analytics tools sending reports, security platforms sending alerts.

Business Context

Platforms that send email for customers inherit every customer’s reputation risk. A single spam complaint on a shared IP can degrade delivery for all tenants. Without isolation, platforms cannot attribute delivery problems to specific customers or offer per-tenant compliance controls.

Core Problem

Shared IP reputation risk across all platform tenants.
Inability to isolate billing, usage quotas, and delivery analytics per customer.
Compliance requirements vary by customer (one needs HIPAA, another needs GDPR only).
Customers demand visible deliverability metrics and domain-level authentication status.

ApexMail Solution

Subaccounts — Each tenant gets an independent subaccount with its own API keys, domains, webhooks, suppression lists, dedicated IPs, and event streams.
Domain Isolation — Per-subaccount domain verification and authentication (SPF, DKIM, DMARC) prevents reputation cross-contamination.
Custom RBAC — Platform-level admin, tenant-level admin, and read-only roles. SCIM provisioning on Enterprise.
SSO — SAML 2.0 for platform operators and tenant administrators.
Usage Quotas — Hard and soft limits per subaccount for volume, rate, and concurrency.
White-Label — Remove ApexMail branding from dashboards, email footers, and notification templates.

Technical Implementation

Create a master account for your platform.
Provision subaccounts via the API or dashboard for each customer tenant.
Each tenant verifies their sending domain(s) independently.
Assign dedicated IPs to tenants requiring reputation isolation.
Configure per-tenant webhook endpoints for delivery events.
Monitor platform-wide delivery health via aggregate analytics.

Relevant API Endpoints

Endpoint	Description
`POST /v1/subaccounts`	Create a subaccount
`GET /v1/subaccounts`	List subaccounts
`GET /v1/subaccounts/:id`	Retrieve subaccount details
`PATCH /v1/subaccounts/:id`	Update subaccount settings
`DELETE /v1/subaccounts/:id`	Deactivate a subaccount
`POST /v1/subaccounts/:id/api-keys`	Create subaccount API key

Required Plan

Subaccounts are available from the Growth plan (5 subaccounts) upward. Enterprise plans support 50 subaccounts. Dedicated Tenant and BYOC plans support unlimited subaccounts subject to infrastructure capacity.

Security Considerations

Platform operators cannot read tenant email content by default. Content access requires explicit tenant authorization.
Subaccount API keys are scoped to their subaccount only. Cross-tenant access is prevented at the authorization layer.
Webhook endpoints are configured per subaccount. HMAC signatures are per-subaccount secret.
Audit logs record all subaccount creation, deletion, and permission changes.

Compliance Considerations

Each subaccount maintains independent suppression lists, domain authentication, and event retention.
DPA coverage for subaccounts requires the platform’s DPA with ApexMail. Contractual flow-down to tenants is the platform’s responsibility.
Data residency applies at the platform level. All subaccount data resides in the same EEA region.
Platform operators are responsible for their tenants’ acceptable use compliance.

Known Limitations

Subaccount isolation is logical, not physical, on Shared Cloud plans. Dedicated Tenant provides physical data isolation.
Cross-subaccount analytics require the platform to aggregate subaccount event data externally.
White-label branding is available on Business plans and above.

Recommended Next Action

Contact sales for a subaccount architecture review and volume pricing for multi-tenant deployment.