Pricing for regulated industries
Built for organisations where AI agents need to handle email under an auditable boundary — regulated financial services, legal, health, public sector, and others with formal accreditation or audit requirements.
Developer sandbox — free
Spin up a mailbox on mbag.ai, exercise the JMAP API, policy gate and webhook flow end to end. For technical evaluation by the engineer who will integrate.
Regulated industries Business from £2,000 per month | Enterprise Custom | |
|---|---|---|
| Mailboxes | 100 | Unlimited |
| Inbound emails / month | 500,000 | Custom |
| Custom domain | ✓ | ✓ |
| Per-sender capability scoping | ✓ | ✓ |
| Content guards | ✓ | ✓ |
| Tamper-evident audit log | ✓ | ✓ |
| Audit log SIEM export | ✓ | ✓ |
| Audit log retention | 7 years | Custom |
| EU/UK data residency | ✓ | ✓ |
| Multi-region (Frankfurt + UK) | ✓ | ✓ |
| SSO (SAML/OIDC) | ✓ | ✓ |
| DPA | Standard | Custom |
| SLA | 99.9% | Custom |
| Named CSM | ✓ | ✓ |
| Dedicated sending pool | Optional | ✓ |
| On-prem / VPC deployment | — | ✓ |
| ISO 27001 / SOC 2 evidence | — | ✓ |
| Book a 20-min scoping call | Book a 20-min scoping call |
What counts as an inbound email? Any message that reaches the policy gate, accepted or rejected.
Overage policy. Soft cap. We email you at 80% and again at the limit. Messages above the cap bounce; we do not auto-charge.
FAQ
- How does the audit log work as compliance evidence?
- Every inbound message, policy decision, and outbound reply is recorded in a hash-chained log with body hashes, decision provenance, and signed timestamps. The export format is designed for auditors and accreditation bodies as evidence of process control under standards like ISO 27001, SOC 2, and sector-specific accreditation schemes.
- Do you run a pilot before annual commitment?
- Yes. The standard first engagement is a 6-week paid pilot scoped to one specific email workflow with written success criteria. Renew and expand into adjacent workflows after.
- Where does our data live?
- EU/UK only. Primary in the UK with Frankfurt as the multi-region secondary. Inbound bodies are retained only as long as the policy's retentionDays. We do not train any model on your data.
- What happens at the inbound limit?
- Soft cap. We email you at 80% of the quota and again at the limit. Messages above the cap are queued briefly, then bounced. We do not auto-charge for overages.