MailPace vs Twilio SendGrid

MailPace 50

Per-domain server tokens that can only send from and read status for their domain, and an organisation token that creates, renames and revokes domain tokens through the Domains API. Tokens travel in headers only. The authentication page still tells users to contact support to regenerate a leaked token (25 of 30). No read-only token. A domain token can't touch other domains, and the unpublished MCP server has an optional recipient allowlist. No approval step on the hosted API (8 of 20). Inbound mail reaches the customer's webhook as untrusted content, and Email Status returns bounce text. The MCP README warns about prompt injection and suggests the allowlist (9 of 15). The dashboard keeps sent mail for 30 days; no log of API calls was found (6 of 15). No security.txt (404 on mailpace.com and app.mailpace.com), no disclosure policy, bug bounty, SOC 2 or ISO 27001. WebAuthn-only two-factor sign-in and Ed25519-signed webhooks are documented (2 of 20). Total 50.

Twilio SendGrid 81

Bearer keys with full, restricted or billing access, restricted keys carry per-endpoint scopes, subusers get their own keys, and IP access management limits where keys work (30). A key can hold only mail.send, and read-only scopes exist (18). The API doesn't return third-party content. Inbound Parse posts to your own URL (10). Email Activity keeps 3 or 7 days of message events by plan. We found no audit log of key use (8). Twilio holds SOC 2 Type II and ISO 27001, 27017 and 27018, though it says not every credential covers every product, and runs a HackerOne bug bounty and a disclosure programme. www.twilio.com/.well-known/security.txt returned 404 and sendgrid.com's returned 403 on 17 October. Key scopes, IP access management and certifications are per the 1 October check (15).

MailPace 54

No OpenAPI or other machine-readable contract for the HTTPS API. The MCP server's 12 tools have typed zod inputs and output schemas, but that server isn't published yet, so partial credit (8 of 25). llms.txt answers 404 on mailpace.com and docs.mailpace.com, and no Markdown copies are served (0). The reference states what each endpoint does, and the introduction says when not to use it (transactional only, no batch, no static IPs) (12 of 20). Field tables give type, examples and required or optional, with enums for status, sort and direction and the 50-recipient cap in text (9 of 15). Examples in curl and six languages and a full table of error responses with messages, though several listed messages have a broken quote ({"error:"...) and the send reference says 30 MB where the home page says 25 MB (12 of 15). Version in the path with a promise that an old version runs until a published end-of-life date, and dated changelog posts (13 of 15). Total 54.

Twilio SendGrid 79

OpenAPI 3.1 specs for the whole v3 API in 46 JSON files at twilio/sendgrid-oai, regenerated on 28 October 2026 and tagged 1.0.0.-rc.14, still a release candidate (25). Twilio's docs-wide llms.txt now has a Twilio SendGrid section linking SendGrid pages as Markdown, and the pages answer at a .md URL as text/markdown (10). The reference describes each endpoint but not when to avoid one (10). Typed from OpenAPI (12). Examples in the reference, and the spec documents an ErrorResponse with field and help on mail/send (12). v3 API and a CHANGELOG in the spec repository. Twilio's changelog can be filtered by product, but SendGrid entries sit under three product names (10).

MailPace 71

Responses are small, the send returns an id and status and Email Status returns one email (18 of 25). Only the domains list takes limit, offset, sort and direction; there is no endpoint to list or search sent mail (8 of 20). Errors are JSON with a human message and an HTTP status for each case in the documented table, with no stable error codes (14 of 20). Idempotency-Key on sends, kept 24 hours per token, and failed validations are not stored so they can be retried. The MCP server marks send as not idempotent and revoke as destructive (18 of 20). A send needs from, to, a subject and a body; official libraries for Node, Rails, Go and PHP transports and an SMTP route (13 of 15). Total 71.

Twilio SendGrid 60

No official MCP that sends. POST /v3/mail/send returns 202 with no body, and Email Activity takes a query and a limit (12). limit and offset on suppressions and other lists (15). Error bodies name the field and link to help (15). No idempotency key on mail/send, so a retried send can go out twice. mail_settings.sandbox_mode validates without delivering (6). SDKs in seven languages, but personalizations make the simplest send a nested object (12).

MailPace 75

Closed hosted service under terms that name OhMySMTP Ltd with its company number. The MCP server, SDKs, landing site and status page are MIT (18 of 30). The privacy policy (30 August 2026), the pricing page and the DPA agree on retention, 30 days in the dashboard and 7 more in backups, 37 days at most (25 of 30). The API reference promises an old version runs until a published end-of-life date, and the terms list dated changes. The terms also say changes apply immediately (8 of 20). Sub-processors listed with purpose and location, Freethought hosting in the EU, Hetzner backups in Germany, AppSignal in Amsterdam, Paddle in the UK and Tutanota in Germany (18 of 20). Total 69.

Twilio SendGrid 82

Closed service under Twilio's terms, with MIT SDKs (20). The privacy notice (9 April 2026) and the DPA (9 April 2026) agree, per the 2 October check, not re-read on 17 October. Customer content is deleted 30 days after termination and from backups after 60 days, or one year for SendGrid backups, Email Activity keeps 3 or 7 days of events by plan, and SendGrid tracks opens and clicks with web beacons, which the notice discloses. Account data is kept "as long as needed" with no number (25 of 30). Dated deprecation notices exist but with short notice. The removal of legacy SendGrid IP addresses for the API and SMTP was posted on 19 August 2026 for temporary disablement from 24 August and permanent removal on 31 August, and the Domain Authentication change was announced effective the same day, 3 August. Below the 12 given to Twilio for a seven-day notice (10). Twilio's subprocessor page, updated September 2026, lists AWS for email routing in the USA and EU and AWS and Snowflake for Marketing Campaigns in the USA, and the DPA promises 10 days' notice of a new subprocessor and 30 for an infrastructure provider, per the 1 October check (18).

MailPace 70

Graded with the hosted lines. A public Upptime status page at status.mailpace.com, driven by the mailpace/status repository, with monitors for the application, SMTP, docs, blog and landing page and GitHub issues as incident reports (20). The 90 days from 8 August hold two incidents, an application outage on 22 September 2026 that the operator put down to an upstream provider returning 5xx (issue open for two minutes), and SMTP down on 2 November 2026 for about 35 minutes, which leaves SMTP at 99.65% for the week. Minor incidents only (20). No rate limit numbers are published; the docs say limits vary by organisation age, plan and history (0). A documented 429 with its message, no Retry-After or backoff guidance, and an Idempotency-Key on sends with written retry rules (10 of 15). The terms guarantee 99% monthly availability of the API and dashboard with a 5% credit per 30 minutes (10). The API is at v1 with no beta label (10). Total 70.

Twilio SendGrid 76

SendGrid components (Mail Sending with API v3, SMTP and API v2, Webhooks with Event Webhooks and Parse API, the SendGrid API, Marketing Campaigns, Statistics, Email Activity and more) sit on status.twilio.com (20). The history pages, re-read on 1 November, carry the incident data without a script. From 3 August to 1 November 2026 the incidents on SendGrid were minor, marked no impact or announced maintenance. Block-list suppressions updated late on the API from 31 August to 1 September (minor). Link Branding creation with automatic SSL failed with HTTP 500 on 24 September, 09:22 to 11:26 PDT (minor). A small subset of Event Webhook events was delayed on 24 September, 13:40 to 19:24 PDT (minor). Suppression changes weren't applied from 24 to 29 September, so a very small amount of mail went undelivered and some unsubscribes weren't saved, posted on 15 October with no impact marked. A subset of customers saw email deferrals on 1 and 2 October (no impact). SendGrid users on Azure Marketplace couldn't complete setup or plan changes on 24 October from 09:36 to 15:54 PDT (minor, SendGrid Partners only). The 28 October maintenance that delayed some delivery and account changes was announced on 23 October. We read none of these as an hour of a core API down or wide errors, so minor only (20). Per-endpoint limits come back in X-RateLimit headers, but the docs, last modified 2 July 2026, give no numbers, per the 17 October check (8). 429 with X-RateLimit-Reset, and no backoff or idempotency guidance (8). The Twilio APIs SLA, updated 9 April 2026, names the SendGrid Mail Send API among its Services APIs at 99.95 per cent, or 99.99 per cent with Enterprise Edition or a premium email package, with a 10 per cent service credit, per the 2 October check (10). GA (10).

MailPace 25

No x402, MPP or L402 (0). $10 a month for 10,000 emails and $1 per 1,000 after, loaded from Paddle on the pricing page and stated in the comparison pages' tables without login (20). A free plan of up to 100 emails a month is available only by emailing support, so it isn't self-serve (5 of 20). Signup, DKIM verification and payment happen in a browser (0). Total 25.

Twilio SendGrid 30

No x402, MPP or L402 (0). Plan prices are public, but overage rates per 1,000 aren't (10). A 60-day trial at 100 emails a day with no card (20). Browser signup and sender verification, no autonomous route (0).