Billing Plans & Tenant Rate Limits
Every tenant is independently rate-limited based on their billing plan. Limits apply per-tenant across all applications sharing that tenant.
| Plan | Per Minute | Per Hour | Per Day | Per Month | Price | Best For |
|---|---|---|---|---|---|---|
| Free / Trial | 10 | 100 | 500 | 5,000 | Free | Testing, POC |
| Starter | 30 | 500 | 5,000 | 10,000 | $25/mo | Small apps, low volume |
| Growth | 100 | 2,000 | 20,000 | 50,000 | $75/mo | Growing startups |
| Business | 500 | 10,000 | 100,000 | 300,000 | $125/mo | Mid-size companies |
| Scale | 2,000 | 25,000 | 250,000 | 500,000 | $350/mo | High-volume senders |
| Enterprise | 5,000+ | 100,000+ | 1,000,000+ | Unlimited | $500+/mo | Custom SLA, dedicated IP |
All limits are per-tenant — each tenant is independently rate-limited. Enterprise plans include dedicated IP pools, custom warmup schedules, and guaranteed SLA response times.
Email Provider Limits & Restrictions
Each provider has its own tier structure, rate limits, and restrictions. The platform automatically routes and falls back across providers based on your configuration.
| Tier | Daily Limit | Monthly Limit | Price | Notes |
|---|---|---|---|---|
| Free | 100/day | 100/mo | Free | Single sender verification only |
| Essentials | 100K/day | 100K/mo | $19.95/mo | Domain authentication, basic analytics |
| Pro | 1.5M/day | Varies | $89.95/mo | Dedicated IP, subuser management |
| Premier | Unlimited | Custom | Custom | SLA, dedicated CSM |
Key Restrictions:
- Free tier: single sender identity required, no dedicated IP
- Must verify sender identity (single sender or domain authentication)
- Spam rate must stay below 0.08% — accounts may be suspended above this
- Bounce rate must stay below 5%
- Cold outreach and purchased lists are strictly prohibited
- API rate limit: 10,000 requests/second (Pro+)
| Tier | Daily Limit | Monthly Limit | Price | Notes |
|---|---|---|---|---|
| Free | 300/day | 300/mo | Free | Brevo branding in emails |
| Starter | No daily limit | 20,000/mo | $25/mo | Remove branding |
| Business | No daily limit | 20,000+/mo | $65/mo | Marketing automation, A/B testing |
| Enterprise | Unlimited | Custom | Custom | Dedicated IP, priority support |
Key Restrictions:
- Free tier: 300 emails/day hard cap with mandatory Brevo branding
- Sender domain must be authenticated (DKIM + DMARC recommended)
- Dedicated IP available from Business tier only
- API rate limit: 80 requests/second (transactional endpoint)
| Tier | Daily Limit | Monthly Limit | Price | Notes |
|---|---|---|---|---|
| Flex (Trial) | — | 100 total | Free | 3-month trial, limited features |
| Foundation | — | 50,000/mo | $35/mo | Custom domains, basic analytics |
| Scale | — | 100,000/mo | $90/mo | Dedicated IP, advanced analytics |
| Enterprise | Unlimited | Custom | Custom | SLA, deliverability consulting |
Key Restrictions:
- Trial: limited to 100 emails total, verified recipients only
- Domain must be verified with DNS records (SPF + DKIM)
- Burst rate: 300 messages/minute (Foundation), higher on Scale+
- Bounce suppression is automatic — repeated bounces are permanently blocked
- EU region available at
api.eu.mailgun.net
| Tier | Daily Limit | Monthly Limit | Price | Notes |
|---|---|---|---|---|
| Block of 25K | — | 25,000 | $20/mo | Per-block pricing |
| Block of 50K | — | 50,000 | $40/mo | Volume discount |
| Block of 100K+ | — | Custom | Custom | Dedicated IP included |
Key Restrictions:
- Requires a Mailchimp account at Standard plan or higher — no standalone signup
- Sending domain must be verified (SPF + DKIM)
- Automatic spam/bounce monitoring — high complaint rates trigger suspension
- API rate limit: 50 requests/second
| Tier | Daily Limit | Monthly Limit | Price | Notes |
|---|---|---|---|---|
| Sandbox | 200/day | Free | Free | Verified recipients only |
| Production | 50,000/day (soft) | Unlimited | $0.10/1,000 | Request production access |
| High Volume | Unlimited (request) | Unlimited | $0.10/1,000 | Dedicated IPs at $24.95/mo each |
Key Restrictions:
- Sandbox mode: can only send to verified email addresses — must request production access
- Production access takes 24–48 hours to approve via AWS support case
- Bounce rate must stay below 5%
- Complaint rate must stay below 0.1%
- Default sending rate: 14 emails/second — increasable via AWS support
- Region-specific — deploy in the AWS region closest to your user base
| Tier | Daily Limit | Monthly Limit | Price | Notes |
|---|---|---|---|---|
| Gmail SMTP | 500/day | — | Free | App password required — testing only |
| Zoho Mail | 1,500/day | — | Free tier | Production use with domain verification |
| Microsoft 365 | 10,000/day | — | $6/user/mo | Enterprise SMTP relay |
| Self-hosted (Postfix) | Unlimited | — | Server cost | Full control, manage IP reputation yourself |
Key Restrictions:
- Gmail: 500/day limit — not suitable for production bulk sending
- Zoho: requires domain verification; rate limit varies by plan
- Port 587 (STARTTLS) or 465 (SSL) — platform auto-detects the correct port
- IP reputation is your responsibility on self-hosted setups
- No built-in analytics from provider — rely on Kodefast platform tracking
| Tier | Daily Limit | Monthly Limit | Price | Notes |
|---|---|---|---|---|
| Free (personal) | 500/day | — | Free | OAuth consent screen required |
| Google Workspace | 2,000/day | — | $6/user/mo | Higher limits, admin controls |
| Workspace Enterprise | 10,000+/day | — | Custom | Per-user sending limits |
Key Restrictions:
- Requires OAuth 2.0 setup: Client ID + Secret + Refresh Token
- Personal accounts: 500 recipients/day hard limit
- Workspace: 2,000 recipients/day per user account
- Rate limit: 250 quota units/second across all Gmail API calls
- Best for low-volume transactional mail from a personal or company Gmail account
Email Attachment Limits
All email send requests support optional file attachments. These limits apply consistently across every supported provider.
| Constraint | Limit | Reason |
|---|---|---|
| Max attachments per email | 10 files | Validation enforced at the API layer |
| Total attachment size (all files) | 10 MB decoded | AWS SES hard limit — applies to all providers for consistency |
| Single file size | Counted towards 10 MB total | No per-file limit beyond the total |
| Encoding required | Base64 string in content field | Decoded before forwarding to provider |
The 10 MB limit covers the decoded file size. Base64 encoding adds approximately 33% overhead in transit, but validation is enforced on the decoded bytes.
{
"attachments": [
{
"filename": "report.pdf",
"contentType": "application/pdf",
"content": ""
}
]
} | Provider | Supports Attachments | Implementation |
|---|---|---|
| SendGrid | ✅ Yes | Native attachments API field |
| SMTP | ✅ Yes | Nodemailer multipart/mixed |
| Brevo | ✅ Yes | Native attachment API field |
| Mailgun | ✅ Yes | FormData multipart (auto-switched) |
| Mailchimp (Mandrill) | ✅ Yes | Native attachments API field |
| AWS SES | ✅ Yes | Raw MIME via SendRawEmail action |
Disaster Recovery: Attachment data is stored as JSON in the attachments_json database column. If the server crashes after the DB write but before the queue enqueue, the message sweeper fully reconstructs and re-enqueues the email — including all attachments — within 2 minutes. No S3 or external storage required.
Platform Restrictions
Every tenant has a continuous reputation score (0–100) computed from delivery event data. Sending restrictions automatically apply based on the score.
| Score Range | Status | Sending Behaviour |
|---|---|---|
| 85–100 | HEALTHY | Full sending — no restrictions |
| 70–84 | WARNING | Admin alerted; enhanced monitoring; no send restriction |
| 50–69 | RESTRICTED | Daily limit reduced to 20% of configured limit |
| 0–49 | SUSPENDED | All sending blocked — requires platform admin review |
Reputation Score Factors:
| Factor | Weight | Threshold |
|---|---|---|
| Bounce rate | 35% | 0 penalty at <2%; full deduction at >10% |
| Complaint / spam rate | 30% | 0 penalty at <0.05%; full deduction at >0.3% |
| Blacklist status | 15% | Full deduction if on any major blacklist (Spamhaus, etc.) |
| DKIM failure rate | 10% | Full deduction if failure rate >5% |
| Volume spike | 5% | Full deduction if 24h volume > 3× 7-day average |
| Domain age | 5% | Full deduction for domains less than 30 days old |
| Rule | Policy |
|---|---|
| Cold outreach | Not permitted on shared infrastructure — violations trigger suspension |
| Sending from kodefast.com | Prohibited — tenants must use their own verified domain |
| Global suppression | Addresses on the platform blocklist are silently dropped — never retried |
| Tenant suppression | Bounced/unsubscribed recipients are automatically blocked for that tenant |
| Domain warmup | New domains start at 100/day and ramp to full limit over 14 days automatically |
| API key scope | Keys are restricted to specific categories (OTP, TRANSACTIONAL, MARKETING) — cross-scope sends are rejected |
| Webhook signatures | Ed25519 verification is mandatory — unsigned or invalid events are rejected with 403 |
| Service Type | Primary Provider | Fallback | Notes |
|---|---|---|---|
| OTP | SendGrid | AWS SES — immediate, no retry delay | Zero-delay fallback to protect OTP delivery SLA |
| Transactional | SendGrid | AWS SES — after 2 failed retries | Automatic after consecutive provider failures |
| Marketing | SendGrid | No fallback — retry on same provider | Never falls back to SES to protect OTP/Transactional reputation |
Marketing emails do not fail over to SES or any secondary provider. This is intentional — using the fallback provider for bulk marketing would contaminate its reputation and slow down OTP delivery for all tenants.
Per-Application API Key Restrictions
Each application gets its own API key with a scoped set of allowed email categories. This prevents, for example, an AI chatbot from accidentally triggering marketing sends.
| Application Type | Default Allowed Categories | Rationale |
|---|---|---|
| AI / Chatbot App | OTP, TRANSACTIONAL | AI must not trigger marketing sends |
| Document Signing App | TRANSACTIONAL | Signing confirmations and audit receipts only |
| Student / Portal App | OTP, TRANSACTIONAL | OTPs and enrollment notifications |
| Healthcare App | OTP, TRANSACTIONAL | Appointment reminders and compliance emails |
| Booking / Hospitality App | TRANSACTIONAL | Booking confirmations and guest notifications |
| Marketing Module | MARKETING | Only application permitted to send marketing emails |
Each API key also has:
- Independent daily limit — counted against the tenant total but configurable per key
- Category scope — sends outside allowed categories are rejected with
API_KEY_INVALID - Revocation — a key can be revoked without affecting other keys or applications
- Full audit trail — every email send is logged with the API key that triggered it
Queue Priority
Emails are routed to one of five queues based on service type and urgency. Workers process higher-priority queues first.
| Queue | Use Cases | Priority | Worker Pool |
|---|---|---|---|
otp | Login OTP, password reset, 2FA | 1 — Highest | Dedicated — never shared with other queues |
txn.high | Invoice, payment confirmation, booking | 2 | Shared high-priority pool |
txn.normal | Workflow notifications, approvals, alerts | 3 | Shared pool |
marketing.bulk | Newsletter, promotional campaigns | 5 | Shared pool |
marketing.low | Re-engagement, low-priority lists | 10 — Lowest | Shared pool |
OTP emails run on a dedicated worker pool. Marketing traffic — even at high volume — cannot delay OTP delivery. This is guaranteed at the infrastructure level, not just by configuration.
Performance & Caching
The control plane uses Redis to cache slow-changing tenant data. Under load, this reduces database queries from 9 → 3 per email send — approximately 70% fewer DB hits.
| Cached Data | TTL | Why Cached |
|---|---|---|
| Tenant config (status, limits, defaults) | 5 min | Only changes on admin update |
| Reputation score | 2 min | Refreshed periodically from bounce events |
| Active sending domain | 5 min | Rarely changes once verified |
| Routing rules | 5 min | Changed by admin only |
| Provider credentials | 10 min | Very rarely changed |
| IP allowlist | 5 min | Rarely changed |
| Platform provider config | 10 min | Almost never changed |
Never cached (always live DB):
- Global suppression checks — must be real-time to block bad recipients immediately
- Tenant suppression checks — must be real-time
- Rate window counters (per-minute, per-hour, per-day) — must be real-time
- Warmup daily count — must be real-time
At 500 requests/second, the Redis caching layer prevents approximately 3,000 unnecessary DB queries per second. This is the primary mechanism enabling high throughput on a single database connection pool.
Caches are automatically invalidated whenever the underlying data changes:
| Trigger | Cache Cleared |
|---|---|
| Tenant config updated | Tenant config cache |
| Routing rule created / modified / deleted | Routing rules cache |
| Provider credentials updated | Provider credentials cache |
| Domain settings updated | Active sending domain cache |
| IP allowlist changed | IP allowlist cache |
Data Retention & Compliance
| Setting | Default | Configurable | Minimum |
|---|---|---|---|
| Email data retention | 45 days | Yes (per tenant) | 7 days |
| Audit log retention | 45 days | Yes (per tenant) | 7 days |
| Auto-purge | Enabled | Yes | — |
| Manual purge | Available | Admin / Tenant Admin | — |
| GDPR data export | Supported | On request | — |
| GDPR right to erasure | Supported | On request | — |
| HIPAA compliance mode | Off by default | Per tenant | — |
Recipient email addresses are stored as encrypted + hashed values — PII is never stored in plaintext. All data handling is designed to be HIPAA and GDPR compliant by default.
Manual purge via the API or Dashboard is irreversible. Data older than the retention window is permanently deleted from the database with no backup path. Configure auto-purge carefully and test with a non-production tenant first.