One record per email, in each language you send it in, holding the approved words, the subject, the sender and the version. The letter to your list goes out from here through the brand's own connection, carrying a signed unsubscribe on every message and writing down every address it deliberately did not mail, and why. Whatever your product sends from its own code carries on sending it. This is where the words are decided.
Email, close up
Goes into it
Runs through
Comes out as
What is travelling those lines
This is the same map as the one on the front of Solutions, zoomed into one surface. Words come in from the left, the record in the middle is the thing people argue about and approve, and what leaves on the right leaves one address at a time.
What it does
Each email is kept under its own name, in its own language, for one brand. Translations of the same message are linked as siblings, so an Arabic welcome and an English one sit beside each other and share the details that should not drift while the subject and the words stay their own.
The HTML lives in the brand's own storage under a key built from the brand, the name and the language, so uploading again replaces it in place. There is one answer to what this email renders to, so a preview, a test and a real send are all reading the same body.
Anything that could run is stripped out, the file is capped, and images that a mail client will refuse to load are named at upload rather than discovered by a reader. The preview renders boxed in, with nothing inside it allowed to run.
A test goes through the same substitution and carries the same one-click unsubscribe header as a real send, from the brand's own connection, so what lands in your inbox is placed the way theirs will be. It goes to an address you type, and it is the one send not weighed against the blocked list.
Mail leaves through the brand's own outgoing connection, its password held encrypted and unlocked only at the moment of sending. There is deliberately no fallback that sends on the brand's behalf from an address your readers have never heard of, because that costs the brand its own deliverability.
A letter is not one blast. It becomes one durable instruction per address, each with its own state, its own attempts, its own last error and its own written outcome, and each one weighed on its own before it goes anywhere.
Every gated send carries a one-click unsubscribe header and a link in the body, both pointing at a signed token naming the workspace, the brand and the address. Nothing is stored and nothing is guessable, so no one can remove a stranger by typing their address.
A letter that was entirely blocked reads as nothing delivered, not as a full success. What counts as delivered is the message the connection actually took, so the campaign record cannot flatter itself.
One address at a time
Pressing send on a letter does not hand a list to a machine and hope. It writes one durable instruction per address, and each one is weighed on its own before it goes anywhere near your connection. Five things can happen to any single instruction, and all five are written down.
Somebody on that address left, and the block was written against the address itself rather than against their subscription, so it outlived the record. The send completes as a skip carrying its reason, nothing reaches the connection, and nothing is written onto their history.
On the recordskipped, reason: blocked
The same email already went to that same address inside the window, so it does not go twice. This is the check that makes it impossible for a loop gone wrong to mail one person a thousand times.
On the recordskipped, reason: already sent
There is a limit on how much one brand can put out in a rolling window, and it counts the instructions already waiting as well as the ones already delivered. Read it as a ceiling on how big a list this is right for, rather than as a queue that will always drain. Welcomes going out in the same window count toward the same ceiling.
On the recordnot delivered, waiting to try again
No outgoing connection on the brand, or none with a usable from address. That is a fault to fix rather than a person to skip, so the instruction waits, tries again with a widening gap, and is given up on after a few attempts instead of sitting in the queue for ever.
On the recordfailed, with the setup message on the record
The connection took it and handed back a receipt. That receipt is the only thing that counts as sent, and it is what writes the line onto the recipient's history: the subject, the time, and who caused it.
On the recorddelivered, with its receipt
Count those up and a letter reads honestly afterwards: delivered, skipped and failed stay three separate numbers on the campaign record, so one that reached nobody cannot present itself as a success. Most of this category can tell you how many messages it sent. This one can tell you which people it deliberately did not mail, and why.
Where this sits
This surface touches the parts of the workspace that know who your people are and what your product does. Each of them has a page of its own.
A named moment your product will report can be linked to the email written for it, readable from either side. That link is documentation: it records that this moment will need a message, so the writing is prioritised and reviewed before the code that reports it ships.
Read EventsOpen the part of the product that reports a moment and you get the moments attached to it, with the emails written for each one listed underneath. The words and the code they belong to are two clicks apart rather than in two different tools.
Read ProductEveryone on your list is also a person in that brand, so a real delivery lands on their history with the subject and the time, beside everything else you know about them.
An agent drafts, revises and files these records with their links wired, under your permissions and your brand limits. It is not given a way to send one.
Read Your agentYours to keep
Every one of these we would choose again.
Your mail goes out as you, from your own connection, or it does not go. Nothing here sends on your behalf from an address that would confuse your readers and cost you your standing with mailbox providers.
Suppressed, duplicate, over the ceiling, nowhere to send through: each one is recorded against the address and the email, and counted apart from a delivery. You can be told which people you deliberately did not mail, and why.
One-click unsubscribe straight from the mailbox, a signed link in the body, and a block kept against the address so it survives the record being deleted.
It can write the words, revise them and file them with their links. Reaching a real person stays a thing a person does.
Nothing is measured after a message leaves. What you get instead is an honest picture of the audience: growth against churn, the consent split, and how long a welcome actually takes to land.
The approved copy sits in a record your developer or your agent can read straight out, with its name, its language and its version. No one has to hunt for the current wording across a document, a template tool and a string in the code.
Questions
Keep reading
The moments these messages are written for.
Where those moments hang off the thing your product actually does.
The other surface where a draft goes through a person before it is public.
What an agent is allowed to do with all of it.
Open the workspace, do one real piece of work in it, and the joins will show you the rest.