Team roles and account security

Roles

• Owner: everything, including billing and deleting the workspace.
• Admin: domains, webhooks, team, suppressions.
• Developer: API keys, templates, contacts and campaigns.
• Read-only: can view, cannot change.

Roles are enforced on the server for every request.

Keep keys safe

• Store keys in environment variables or a secrets manager, never in code or the browser.
• Use separate keys per system and the smallest scopes.
• Revoke a key the moment it might have leaked; revoking takes effect immediately.

Audit log

Every key, domain, role, webhook, campaign and sending action is recorded under Audit log.