SendLayer vs Zoho CPaaS (formerly ZeptoMail)

SendLayer 38

Plain revocable API keys per domain, several allowed, sent in a header; no scopes, expiry or rotation feature beyond creating and deleting keys (20 of 30). No read-only key or approval step (0 of 20). The API returns event data, not received mail (10 of 15). Email logs kept 3, 15 or 30 days by plan, and no log of API calls was found (8 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). Total 38.

Zoho CPaaS (formerly ZeptoMail) 78

Send keys are per Agent and per channel, can be created, listed and deleted by API, and can only send and upload attachments. Management calls use Zoho OAuth 2.0 with READ, CREATE, UPDATE and DELETE scopes per resource and one-hour access tokens. That earns 30, less 10 because the OAuth guide documents the client secret and refresh token in the token URL's query string (20). Read-only scopes, send-only keys, sandbox Agents and IP allow lists for sending, the REST API and the web console. No approval step for deletes (15). No inbound mail, so responses hold only the account's own logs and settings (10). Activity logs per user kept one year with export, and email logs for 60 days that show the triggering IP (13). security.txt valid until 30 June 2028 naming security@zohocorp.com and Zoho's bug bounty, and SOC 2 Type II and ISO/IEC 27001 on Zoho's compliance page, the same evidence zoho-crm, zoho-desk and zoho-books score 20 on. The 2 points held back on 8 October for no advisory feed aren't a checklist condition the other Zoho listings apply (20).

SendLayer 49

Closed service with terms naming SendLayer, LLC under Florida law (15 of 30). The privacy policy is undated, says data is kept as long as the account is active or as needed, and names no retention periods, DPA or processors; only the pricing page gives log retention per plan (8 of 30). No deprecation policy or dated notices (0). No sub-processors or data locations disclosed (0). Total 23.

Zoho CPaaS (formerly ZeptoMail) 82

Closed service with its own published terms of use, and an MIT Node SDK (20). Zoho's privacy policy of 22 December 2025 covers service data, and the CPaaS pages say content is stored only on opt-in for 60 days and logs for 60 days. The pages disagree on deletion. The GDPR page says account data is deleted within 24 hours of a 48-hour grace period, the privacy policy says a clean-up every six months with backups three months later, and the April 2026 changelog entry says content can be kept up to 50 days (18). The terms commit to a six-month deprecation period after a service announcement, with no dated notices to check it against (16). Six data centre regions are named with their hosts, and Zoho publishes a sub-processor directory by service that loads by script and that we couldn't read (15).

SendLayer 68

OpenAPI file at developers.sendlayer.com/api-reference/sendlayer.json (version 1.0.1) covering four paths, send, events and webhooks (25). llms.txt and Markdown copies of every developer page (10). Operation summaries say what each call does; nothing says when not to use one, and the hosted MCP server's tool definitions aren't public (10 of 20). Parameters are typed but without enums or limits, and the event filter is a free string (7 of 15). Code samples in five languages and a table of 35 error codes, but the spec documents only 200 responses (11 of 15). Version in the path and in the spec, with no public changelog (5 of 15). Total 68.

Zoho CPaaS (formerly ZeptoMail) 78

One public OpenAPI 3.0.3 file with 42 operations, linked from the docs without a login (25). llms.txt at zoho.com/cpaas/llms.txt and a second for the help centre, with a Markdown copy of each page (10). Every operation has a description, most of them one sentence, with nothing on when not to use it (10). Request bodies name required fields and length caps, with 9 enums across the file, but log filters take dates as free strings and responses are typed as a bare JSON object (10). Sample requests and responses on every page and an error-code table of 24 rows with remedies. The 401 body we got from the live endpoint has a different shape from the documented sample (11). Version 1.1 in the path and a What's New page dated by month only (12). The OpenAPI file was not re-read on 2 November (a permission check refused the request); the line rests on the 8 October reading.

SendLayer 20

No x402, MPP or L402 (0). Plan prices are public but only as annual plans, with no per-email overage price; accounts are upgraded automatically at the limit (10 of 20). A free trial of 200 emails is offered through checkout; whether it needs a card couldn't be read, since robots.txt disallows the add-to-cart URLs (10 of 20). A person signs up and authorises a domain in a browser (0). Total 20.

Zoho CPaaS (formerly ZeptoMail) 30

No x402, MPP or L402 (0). The pricing page and its Markdown copy state per-unit email pricing without a login (10,000 emails per credit, valid six months, counted per recipient, a dedicated IP priced by the month), but the figures are filled in by script from a data file. The 8 October price figures came from that file, a script data feed this run doesn't call, so they are struck and the amounts are unchecked. The same page renders worked prices for two other channels of the API without a script (WhatsApp, an authentication message to the US at US$0.0374 with credits at US$2, and voice credits at US$1), so pricing is public in part, with the email amount unread (10 of 20, as pirate-weather's partly public pricing). "First credit is free" on the pricing page, and the documented signup asks for a phone verification and no payment details (20). Signup is a browser form with phone verification, and Zoho staff review each new account, so there is no autonomous route (0). 0 + 10 + 20 + 0 = 30.

SendLayer 48

Graded with the hosted lines. A Cronitor status page at status.sendlayer.com with components for the app, SMTP, tracking links, the website and each plan's sending IPs, and a history (15 of 20, see below). The 90 days from 8 August hold 98 automated outage entries, 13 of them on SendLayer Services Health, most on per-plan IP monitors, all marked resolved but with no durations or write-ups, so their size can't be judged (5 of 30). Send limits per minute, hour and day are published per plan, plus recipient and size caps (15). 429 appears in the error code list, with no Retry-After, backoff guidance or idempotency for sends (3 of 15). No SLA found (0). The API is at v1 with no beta label (10). The status page's uptime columns showed no data on 6 November, so the component line takes 15 of 20 rather than 20. Total 48.

Zoho CPaaS (formerly ZeptoMail) 41

Graded on the hosted email API with the hosted lines. Zoho's status site at us.zohostatus.com listed three Zepto Mail components with status and incident history sections on 8 October, and status.zoho.com points there; the line is kept as for zoho-desk and zoho-crm (20). On 2 November the host answered robots.txt with a 404 carrying an error page ("We have encountered a problem while executing your request"), read as blocked as for the other Zoho listings, so nothing else was requested. The 8 October RSS reading (last status change 29 July 2026) is struck, and no history in the window was read (5). No request rate limit was found. The docs give payload caps (500 addresses a field, 60 attachments, 15 MB each), a per-day sending limit error (SMI_115) and the sandbox allowance of 10,000 emails a day (6). No 429 handling, Retry-After or idempotency key found in the docs or the error-code table (0). No SLA found (0). The email channel is generally available, while SMS, WhatsApp and voice are marked beta (10).

SendLayer 62

Small responses and five MCP tools (18 of 25). Events filter by start and end date, event type and message ID, with an offset and a count (15 of 20). Errors are JSON with a numbered code and message per field, and documented (14 of 20). No idempotency key on sends, and the MCP annotations can't be read (0 of 20). A send needs from, to, subject, content type and content; official SDKs for Node, Python, PHP, Ruby and Go (15). Total 62.

Zoho CPaaS (formerly ZeptoMail) 55

Send responses are small, and the logs endpoint takes offset and limit, with no field selection (15). Thirteen filters on email logs, among them recipient, subject, date range, client_reference and bounce or delivery state (16). Errors carry a code, a sub-code and a message, and the docs pair each with a fix (16). No idempotency key and no guidance on retrying a send (0). A send needs only from, to and subject. The one official SDK found is for Node, and managing the account needs a second credential type (8).