Pricing
Governed email for AI agents, under an auditable boundary. Team suits smaller production deployments; Business is built for regulated financial services, legal, health, and public sector with formal accreditation or audit requirements; Enterprise covers the largest custom estates.
Developer sandbox — free
Spin up a mailbox on mbag.ai, exercise the JMAP API, policy gate and webhook flow end to end. For technical evaluation by the engineer who will integrate.
Smaller deployments Team £149 per month | Regulated industries Business from £2,000 per month | Enterprise Custom | |
|---|---|---|---|
| Mailboxes | 50 | 100 | Unlimited |
| Inbound emails / month | 100,000 | 500,000 | Custom |
| Custom domain | ✓ | ✓ | ✓ |
| Per-sender capability scoping | ✓ | ✓ | ✓ |
| Content guards | ✓ | ✓ | ✓ |
| Audit log | ✓ | ✓ | ✓ |
| Tamper-evident (hash-chained) | — | ✓ | ✓ |
| Audit log SIEM export | — | ✓ | ✓ |
| Audit log retention | 90 days | 7 years | Custom |
| EU/UK data residency | ✓ | ✓ | ✓ |
| Multi-region (Frankfurt + UK) | — | ✓ | ✓ |
| SSO (SAML/OIDC) | — | ✓ | ✓ |
| DPA | Standard | Standard | Custom |
| SLA | — | 99.9% | Custom |
| Named CSM | — | ✓ | ✓ |
| Dedicated sending pool | — | Optional | ✓ |
| On-prem / VPC deployment | — | — | ✓ |
| ISO 27001 / SOC 2 evidence | — | — | ✓ |
| Book a 20-min scoping call | Book a 20-min scoping call |
What counts as an inbound email? Any message that reaches the policy gate, accepted or rejected.
Overage policy. Soft cap. We email you at 80% and again at the limit. Messages above the cap bounce; we do not auto-charge.
FAQ
- How does the audit log work as compliance evidence?
- Every inbound message, policy decision, and outbound reply is recorded in a hash-chained log with body hashes, decision provenance, and signed timestamps. The export format is designed for auditors and accreditation bodies as evidence of process control under standards like ISO 27001, SOC 2, and sector-specific accreditation schemes.
- Do you run a pilot before annual commitment?
- Yes. The standard first engagement is a 6-week paid pilot scoped to one specific email workflow with written success criteria. Renew and expand into adjacent workflows after.
- Where does our data live?
- EU/UK only. Primary in the UK with Frankfurt as the multi-region secondary. Inbound bodies are retained only as long as the policy's retentionDays. We do not train any model on your data.
- What happens at the inbound limit?
- Soft cap. We email you at 80% of the quota and again at the limit. Messages above the cap are queued briefly, then bounced. We do not auto-charge for overages.