Amazon SES vs SendLayer

Amazon SES 89

IAM with policies per action and identity, condition keys such as ses:FromAddress, temporary credentials and rotation (30). Policies can allow only SendEmail from one identity, and AWS has a read-only managed policy. No confirmation step, which IAM leaves to the caller (16). The API doesn't return third-party content. Inbound mail goes to S3, SNS or Lambda rather than through SES calls (10). CloudTrail records SES API calls and configuration sets publish per-message events (15). SES is in scope for SOC 1, 2 and 3 (page updated 11 August 2026, re-read on 1 November), AWS runs a vulnerability disclosure programme on HackerOne with a safe-harbour policy and publishes security bulletins, none of the 39 in the feed on 1 November naming SES. The aws.amazon.com security.txt is valid to 16 October 2027. The disclosure policy names no bug bounty, so 2 points stay held back, as on the other AWS listings (18). 30 + 16 + 10 + 15 + 18 = 89.

SendLayer 38

Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.

Amazon SES 85

The SES v2 model last changed on 8 October 2026 (CreateExportJob documentation, commit 11f19c6), still the newest SES or SES v2 change in aws/api-models-aws on 1 November (repository head 30 October), 24 days earlier (30). SES v2 model changes on 20 August, 1, 17 and 29 September and 8 October, five in the 90 days from 3 August (20). Closed service with dated SDK changelogs and AWS re:Post. Direct support is a paid plan (10). Official SDKs released daily, aws-sdk-js-v3 v3.1161.0 tagged on 30 October (15). The JavaScript SDK repository releases from CI every working day (10). 30 + 20 + 10 + 15 + 10 = 85. The recency line drops to 20 after 7 November unless the SES models change again.

SendLayer 40

The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.

Amazon SES 87

Closed service under the AWS Customer Agreement, with Apache-2.0 SDKs (20). The AWS privacy notice (Last Updated 18 May 2026) and customer agreement cover SES, and AWS's sub-processor page, re-read on 1 November and now last updated 30 October 2026, ties sub-processors to the AWS Data Processing Addendum and names the entities that sell and provide SES. SES encrypts stored data at rest and uses opportunistic TLS by default. The data protection page, re-read on 1 November, links a page on deleting personal data but states no SES-specific retention period (18). The move of new accounts to the Essentials plan carries a dated notice (21 July 2026) on the pricing page, and AWS dates API changes in the SDK changelogs (15). Data stays in the Region the customer picks, quotas, plans and sandbox status are per Region, and the sub-processor list is public with 30 days' notice of new ones (20). 20 + 18 + 15 + 20 = 73.

SendLayer 49

Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.

Amazon SES 75

AWS Health Dashboard with per-service, per-Region history and RSS feeds (20). AWS's dashboard history file, re-read on 1 November, lists Amazon Simple Email Service in the Middle East (UAE) me-central-1 and Middle East (Bahrain) me-south-1 multi-service events, open since 1 and 2 March 2026 at disruption status. On 15 September 2026, inside the 90-day window, AWS said it can't restore resources and data hosted only in me-south-1 or in the mec1-az2 zone. No update or new SES event since then, and the SES us-east-1 feed is empty on 1 November. One major event, read as the S3, Secrets Manager and Polly re-checks read it (10). The 15 September update leaves the window after 14 December. Sandbox quotas (200 messages in 24 hours, 1 a second), per-account send rate and daily quota after production access, and 1 request a second for API actions other than SendEmail and SendBulkEmail, re-read on 1 November (15). ThrottlingException with 'Maximum sending rate exceeded' or 'Daily message quota exceeded' and advice to wait up to 10 minutes and retry, re-read on 1 November. SES drops over-quota messages rather than queueing them, and SendEmail has no idempotency token (10). SES is covered by the Amazon User Engagement SLA with Pinpoint and End User Messaging, re-read on 1 November (10). GA (10). 20 + 10 + 15 + 10 + 10 + 10 = 75.

SendLayer 48

Graded with the hosted lines. A Cronitor status page at status.sendlayer.com with components for the app, SMTP, tracking links, the website and each plan's sending IPs, and a history (15 of 20, see below). The 90 days from 8 August hold 98 automated outage entries, 13 of them on SendLayer Services Health, most on per-plan IP monitors, all marked resolved but with no durations or write-ups, so their size can't be judged (5 of 30). Send limits per minute, hour and day are published per plan, plus recipient and size caps (15). 429 appears in the error code list, with no Retry-After, backoff guidance or idempotency for sends (3 of 15). No SLA found (0). The API is at v1 with no beta label (10). The status page's uptime columns showed no data on 6 November, so the component line takes 15 of 20 rather than 20. Total 48.

Amazon SES 85

No OpenAPI, but the SES v2 Smithy model is published in aws/api-models-aws with types, required members and enums (25). llms.txt for the developer guide with Markdown pages, 228 links on 1 November (10). The API reference explains each action, rarely when not to use one (12). Typed inputs from the model, with enums and length limits (14). Each action lists its errors, and the guide has examples (12). Versioned API (2019-09-27). The document history looped on 1 October, redirected to the guide's front page on 6 and 17 October and answered 404 as Markdown on 1 November, so we lean on the model's dated changes, the newest on 8 October 2026 (12). 25 + 10 + 12 + 14 + 12 + 12 = 85.

SendLayer 68

OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.

Amazon SES 30

No x402, MPP or L402 (0). Per-1,000 prices for a la carte and the three plans published without login, re-read on 1 November (20). No SES free allowance. New AWS customers get up to $200 in Free Tier credits on a free plan of up to 6 months, and the Free Tier FAQ says most new customers don't need a payment method, but AWS's account docs read on 1 November say AWS might request payment information and holds USD $1 to verify, so half, as on the S3, Secrets Manager and Polly re-checks (10). A person signs up and has to request production access, so no autonomous route (0). 0 + 20 + 10 + 0 = 30.

SendLayer 20

No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.