MailerSend vs SendLayer

MailerSend 95

Graded on the hosted REST API. Status page at status.mailersend.com (incident.io) with ten components and per-component uptime (20). The status feed, re-read on 1 November, lists two completed maintenance windows inside 90 days (a five-minute sending maintenance on 21 September and database maintenance on 11 October) and no incident (30). Rate limits published per endpoint, 120 requests a minute on POST /v1/email, with daily quotas by plan (15). A 429 carries retry-after, x-ratelimit and x-apiquota headers, and the docs say to wait the stated seconds. No idempotency key for sends (10 of 15). A 99.5 per cent monthly uptime SLA with service credits from Starter (10). GA (10).

SendLayer 48

Graded with the hosted lines. A Cronitor status page at status.sendlayer.com with components for the app, SMTP, tracking links, the website and each plan's sending IPs, and a history (15 of 20, see below). The 90 days from 8 August hold 98 automated outage entries, 13 of them on SendLayer Services Health, most on per-plan IP monitors, all marked resolved but with no durations or write-ups, so their size can't be judged (5 of 30). Send limits per minute, hour and day are published per plan, plus recipient and size caps (15). 429 appears in the error code list, with no Retry-After, backoff guidance or idempotency for sends (3 of 15). No SLA found (0). The API is at v1 with no beta label (10). The status page's uptime columns showed no data on 6 November, so the component line takes 15 of 20 rather than 20. Total 48.

MailerSend 85

Node.js SDK v3.7.0 on 28 October 2026 and the changelog's isolated domain reputation entry on 27 October (30). In the last 90 days the Node.js SDK tagged seven releases (10 August to 28 October), the Python SDK four (1 September to 26 October) and the CLI one, and the changelog has eight dated entries (20). The SDK repositories merge pull requests weekly and the CLI took two in October. We couldn't read issue replies (GitHub refuses our reader), and the product changelog is public and dated, with a help centre and support team we didn't test (12 of 15). Current official SDKs in seven languages, Node.js, Python, PHP, Go, Java, Ruby and the Laravel driver, all but the Laravel driver tagged in October (15). Renovate and a test matrix on Node 20, 22 and 24 in the Node.js SDK. The Python SDK has tests but only a publish workflow, and on 8 October npm's latest was 3.4.1 while the repository had tagged 3.5.0 on 23 September, not re-read on 1 November (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

SendLayer 40

The Node and Python SDKs were last released as 1.1.0 on 21 August 2026, 77 days before this check (20). One SDK release in the 90 days and no dated changelog (0 of 20). A closed service with a support form and docs updated through 2026, but no public changelog (5 of 15). Not in the official MCP registry (search for sendlayer returned nothing on 6 November). Official SDKs in five languages (10 of 15). The SDK repositories exist on GitHub under sendlayer; their CI wasn't read (5 of 10). Total 40.

MailerSend 63

API tokens with any of 30 scopes, read or full by area, optionally tied to one sending domain, and pausable or deletable through the API. OAuth with PKCE and dynamic client registration on the MCP server and the CLI (30). Read scopes, token pause and IP allowlisting from Starter. No confirmation step documented for deletes or sends (13 of 20). Inbound mail and activity data carry untrusted content. The terms place responsibility for a connected agent on the customer, and no injection guidance was found in the docs (3 of 15). Email activity logs on every plan for 1 to 30 days, API request logs only on Professional (7 days) and Enterprise (14 days) (9 of 15). The Responsible Disclosure Program (last updated 20 May 2024), read on 1 November after a bot check on 8 October, takes reports at security@mailersend.com and pays a bounty, at MailerSend's discretion, for severe bugs. No security.txt and no public advisories. The security statement cites ISO 27001 for Google's data centre and names no SOC 2 or ISO 27001 of MailerSend's own. A guide covers leaked credentials. That's a disclosure route with rewards paid at MailerSend's discretion and no certification of its own, the same as contactsplus (8, a disclosure policy and discretionary bounties, no SOC 2 or ISO 27001), below ahasend and brevo (12 each, ISO 27001 and a disclosure route) and above postmark (5, neither) (8 of 20). 30 + 13 + 3 + 9 + 8 = 63.

SendLayer 38

Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.

MailerSend 68

Closed service with published terms (last updated 5 October 2026) and MIT SDKs. The terms allow changes to the service and the terms without notice and account closure without cause (17 of 30). The privacy policy (last updated 15 October 2026) gives deletion within 30 days of a request, removal of accounts inactive for two years, and EU data centres, and the Data Processing Addendum (last updated 31 August 2026), read on 1 November, adds deletion on request after termination and standard contractual clauses. Activity retention by plan is on the pricing page. The terms grant a licence to use the inputs and outputs of AI functions to improve AI models, and the two documents don't name the same processors (below), so the line holds (18 of 30). No deprecation policy found in the docs, and the terms reserve change without notice (0). The DPA's Annex 4 lists five sub-processors with addresses (Google Cloud EMEA with a data centre in Belgium, MailerLite Limited, MailerLite, Inc., Vercom S.A. and Bandwidth) and promises 10 days' notice of changes, but the privacy policy also names OpenAI and Meta, which the list leaves out (14 of 20). 17 + 18 + 0 + 14 = 49.

SendLayer 49

Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.

MailerSend 80

OpenAPI 3.1 on SwaggerHub with 59 paths and 97 operations, but no WhatsApp, DMARC or blocklist monitoring paths and no error responses, per the 8 October check (20 of 25). llms.txt on the docs site, now indexing the WhatsApp messages, items, activities, inbound, recipients, templates and webhooks pages, and every page served as Markdown at <path>.md (10). The OpenAPI file has one-line summaries only, while the reference pages state limits and plan conditions per endpoint. The MCP tool definitions can't be read without an account (10 of 20). Parameter tables give type, required and limits, such as 50 To recipients and the nine template languages. The spec has 6 enums (11 of 15). Request examples in up to seven languages and 52 MS error codes with explanations (14). /v1 in the path and a dated public changelog at /whats-new, read on 1 November after a bot check on 8 October, with eight entries between 4 August and 27 October 2026 (15).

SendLayer 68

OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.

MailerSend 30

No x402, MPP or L402 (0). Plan prices and overage per 1,000 emails are public for every plan, $1.50 on Hobby and $1.30 on Starter at 50,000, per the 8 October check; on 1 November the page's figures render by script and the FAQ still gives $1.30 per 1,000 on Starter (20). The 14-day trial starts at signup with 500 emails and 100 API requests a day, but the pricing FAQ says the Free plan asks for card details "to prevent abuse". Whether the trial needs a card wasn't established, so half (10 of 20). Browser signup and an account approval step before full sending (0).

SendLayer 20

No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.