SendGrid

Last updated: Sep 23, 2026

---

Rationale

SendGrid is the service we use for sending transactional email from our platform: every notification, digest, report and onboarding message a user receives by email goes through it.

The main reasons why we chose it over other alternatives are:

• It is SaaS oriented. Deliverability, sender reputation and scaling are handled by the provider.
• It provides a Python library that lets our backend build and send messages with attachments and per-recipient personalization.
• It supports custom arguments on each message, which we use to tag every email with its template and subject.
• It provides an Event Webhook with signed events, so we can record when an email is opened, clicked, reported as spam or unsubscribed from.
• It supports domain authentication with DKIM, whose DNS records we manage as code in Cloudflare.
• It is a supported email provider for Auth0, which we configure as code, so the messages of Platform authentication are sent from the same domain as the rest of the platform.

Alternatives

Below is the alternative we used before choosing SendGrid.

Mailchimp Transactional

Mailchimp Transactional, formerly Mandrill, was the service the platform sent its email with.

• SendGrid was acquired while implementing one-time passwords for login, which left two services performing the same task.
• We consolidated on SendGrid so a single provider sends every platform email, and retired the analytics pipelines that read from Mandrill.

Usage

We use SendGrid for:

• Sending the platform's transactional email, such as vulnerability and event notifications, consulting digests, report deliveries, environment connectivity alerts and free trial onboarding, rendered from templates maintained in the platform's backend.
• Sending the verification and password emails of Platform authentication through Auth0.
• Recording email engagement as audit events (see Platform audit logs), by receiving the signed Event Webhook in our audit logging service.

We do not use SendGrid for:

• Marketing campaigns and newsletters.
• Alerting the engineering team about infrastructure, which we do with SNS and Datadog.