Internal email that goes out
from your mailbox, not ours.

Built to brand in a real editor, then handed to your company's own Gmail or Microsoft 365 account to deliver. We are never the sender — which changes the deliverability, the pricing and what the tool is able to know about your staff.

01

This is the whole argument,
and it fits in one screenshot.

A campaign built in SlipperySign, delivered by the sender's own mailbox, as the recipient sees it.

Inbox — all@company.com

Q3 all-hands: what changed, and what's next

AL Anna Lindqvist anna.lindqvist@company.com  ·  to all@company.com

Team — a short summary of where we landed this quarter, and the three things changing in October.

Everything below is also on the intranet, but I wanted you to have it directly.

MB Marco Bianchi Replied to Anna directly — 11 minutes ago
01 / SENDER Anna's name. Anna's address.

No relay address, and no “via” line beside her name. It is her mailbox, so it is simply her email.

02 / REPLIES Answers go back to Anna.

Into her inbox, in the same thread. If IT would rather they landed in a shared mailbox, a Reply-To address sends them there instead.

03 / DELIVERY Your domain's reputation, not a shared IP.

It travels the same path as every other internal mail, so it arrives where internal mail arrives.

04 / RECORD It's in her Sent folder.

Because she sent it. There is no separate system of record to reconcile at audit time.

02

Six things it does that a
marketing tool will not do.

Every one of these exists because the mail leaves your own mailbox instead of ours. That single decision is what the rest of the product is built on.

Identity

It's her email, not a lookalike

No relay address and no “via” line. It is signed by your own domain and follows the same route as every other internal message, so it lands where internal mail lands — not in Promotions.

Replies

Answers go where you decide

By default straight back to the sender's own inbox, in the same thread, where she can actually answer them.

If your IT would rather route them to a shared mailbox — comms@, hr-support@ — set a Reply-To on the campaign and answers land there instead.

Optional · your IT decides

Authoring

A real editor, because the writer isn't a designer

Drag components onto the canvas: text, image, button, section, poll. Mark a section and the table of contents reorders itself. Output is MJML, so it survives Outlook.

Brand control

Locked regions survive fifty authors

Freeze the masthead, the footer, the legal line. Everyone edits around them, and the hundredth campaign still looks like the first one. Brands are managed centrally; the standard brand cannot be edited by a customer, only duplicated.

Governance

Approval that actually blocks

Send stays locked until the named reviewer signs off, and any edit afterwards voids the approval. Share a campaign as viewer or editor, with a check-out lock so nobody overwrites anyone mid-sentence.

Measurement

Counted, never surveilled

Opens and clicks are totals, plus a per-day rollup and a per-link count. There is no recipient column anywhere in the tracking tables, so a per-person report cannot be produced — by us, or by an employer.

03

Components on the left.
The email in the middle.

Properties on the right, including the regions you have locked. Built on MJML, so what you assemble here is what Outlook renders.

04

What we cannot see —
and, openly, what we do store.

The first number is a property of the database schema, not a promise. The second half is the honest half: this tool is not a zero-data tool, and it would be misleading to sell it as one.

0

recipients we can name Across every campaign, every open, every click, for every customer.

No recipient column exists

Opens are one counter per campaign. Clicks are one counter per link. There is a per-day rollup, and that is all. There is no table a per-person report could be built from.

Your staff directory is never uploaded

Campaigns are addressed to the distribution lists and group aliases you already have. Your mail provider expands them at send time — we never see the membership.

No password is ever held

There is no password field and no password store. Google or Microsoft authenticates the person and hands us a verified email address.

What we do store

We would rather you read this here than find it in an audit. This is the complete list of personal data in the system.

The campaign

Subject, content, the From name and address, the Reply-To if you set one, the BCC field if you use it, and the list address it was sent to.

The people who work on it

The email address of the campaign's owner, of anyone it is shared with as viewer or editor, and of whoever granted that access.

Your saved lists and admins

The group addresses you save for reuse, and the email addresses of your company administrators.

An administrative audit log

Who did what, and when — including any occasion a platform administrator acted on behalf of a user.

Not stored: recipients

We store the address you send to. Addressed to a distribution list — which is how the tool is meant to be used — that is one address, not your staff.

Not stored: anything for long

Retention is set per customer. Campaigns and tracking detail delete themselves on that schedule, and residency is EU or US per customer record.

05

The eight questions security
asks before they say yes.

Answered here rather than in a follow-up call, because the answers are short.

Identity
Federated to Google Workspace or Microsoft 365. No credential is seen or stored, and a domain must be registered by us before anyone on it can sign in.
Sending
Gmail API and Microsoft Graph, from the user's own mailbox, under a revocable gmail.send or Mail.Send grant.
Token custody
The send token lives in the browser for the duration of the send. It never reaches our servers.
Recipients
Existing distribution lists and group aliases, resolved by your mail provider at send time. A Reply-To address may be set if you want answers routed elsewhere.
Measurement
Aggregate counters, a per-link click count and a daily rollup. No per-recipient identity is recorded.
Residency
EU or US, set against the customer record rather than the deployment. EU storage carries a jurisdiction restriction.
Retention
Per-customer policy; campaigns and tracking detail delete themselves on schedule.
Audit
Sent campaigns are immutable. Administrative actions, including acting on behalf of a user, are logged.

Send the next one from your own address.

Sign in with the Google or Microsoft account you already have. Nothing to install, and no contact list to upload.

Open the app

SlipperySign Mail — first of a family. Tools for learning experiences follow.