OpenSES Cloud

We run the console. Your AWS still sends the email.

Cloud is the hosted version of the same open-source code. You connect your AWS account through a cross-account IAM role with an External ID, so we never hold your credentials and you can revoke us by deleting one CloudFormation stack. Your domains, quotas, reputation and bill stay yours.

Start free trial See plans

no keys storedexternal id per workspaceall SES regions

cloudformation · openses-role.yaml

Resources:
  OpenSESRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::OPENSES:root
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: ws_2f9c…e1
      Policies: [ openses-least-privilege ]

# External ID is unique per workspace.
# Delete the stack: access ends instantly.

How connecting works

Three clicks, zero secrets

This is the AWS-recommended way for a third party to act in your account (Well-Architected SEC03-BP09). It is what Datadog, Vercel and Vanta do too.

Open the quick-create link

OpenSES generates a CloudFormation link pre-filled with your workspace's External ID and the least-privilege policy. You review it in your own AWS console.

Paste the role ARN

The stack outputs a role ARN. Paste it, pick regions, and OpenSES assumes the role to list identities, read quotas and create its configuration set and SNS topic.

Send

Every API call from then on is a short-lived STS session, never a stored key. Rotate the External ID or delete the stack at any time.

Prefer access keys? Supported, encrypted at rest with a per-workspace key, never returned by the API.

What Cloud adds

Everything in self-host, plus someone on call

Zero ops

Upgrades, backups, monitoring and the SNS endpoint are ours to run. You get a changelog, not a maintenance window.

Every SES region

Connect one account across us-east-1, eu-central-1, ap-southeast-1 and the rest. Route sends by region per domain.

Teams and roles

Owners, admins and members per workspace. Invite by email, enforce 2FA, SSO on Team.

Audit log

Who created a key, changed a webhook or deleted a domain, with IP and time. Exportable.

Privacy controls

Metadata-only mode stores no bodies. Per-workspace encryption keys. Delete a workspace and it is gone within 24 hours.

Support

Email on Pro, a shared Slack channel on Team. We have debugged a lot of DKIM records and production-access denials.

Who is responsible for what

You, through your AWS account

· Recipient consent, content and compliance (CAN-SPAM, GDPR)
· SES sandbox, production access and sending quotas
· Bounce and complaint rates, and your sender reputation
· The AWS bill for SES

OpenSES Cloud

· Hosting, availability and upgrades of the console
· Storing your logs, keys and settings securely
· Keeping the suppression list and List-Unsubscribe headers correct
· Acting as your data processor under a DPA

Under the AWS Service Terms the AWS customer, not AWS and not OpenSES, is the sender of record. We will suspend workspaces that violate our Acceptable Use Policy, but your reputation lives with your account either way.

Fourteen days of Pro, free

Every feature, all regions, no card. Pick a plan when the trial ends, or move to self-host with an export.

Create a workspace Or self-host