Sendora
Email marketing platform you run for clients — Mailchimp's category, your codebase, your billing rules.
Sendora is an email marketing product. An account collects contacts, organises them into lists and segments, composes campaigns in a block editor, sends them, and reads a report. It also runs automated sequences, hosts subscription forms with double opt-in, and manages unsubscribes and suppression.
Every mailable address can be traced to the moment someone agreed to it.
A list is an asset right up until nobody can say where it came from. Addresses arrive from a form, an import, a spreadsheet from a colleague, an event badge scan — and six months later there is no way to distinguish the people who asked to hear from the business from the ones who were added. That mixture is what produces complaints, and complaints are what get a sending domain in trouble. By the time delivery starts failing, cleaning the list means deleting most of it.
- Subscription forms and double opt-in
- Unsubscribe, preferences and suppression
The report leads with what someone did, not with what a mail client loaded.
Open rates became decorative when mail clients started pre-fetching images. Teams still report them, still compare them week over week, and still make decisions about subject lines and send times using a number that mostly measures which mail providers their recipients use. The damage is not the wrong metric — it is the confidence. A campaign with a healthy open rate and no clicks reads as a success in the weekly update, and nobody investigates the thing that is actually not working.
- Campaign metrics
- Open tracking
Your first campaign goes out today, not after a DNS argument.
Domain authentication is where most email tools lose the customer. Setting it up correctly means DNS records, a registrar login somebody else controls, and terminology the person trying to send a newsletter has never encountered. So the account is created, the first campaign is drafted, and it never goes out — the tool gets remembered as the one that asked for something impossible before it did anything useful.
- Sending domains
- Campaigns
You receive this. It ships behind a feature flag and sits on the Growth+ tier as configured, so it is revenue you can reserve for your own paying customers.
The editor at /campaigns/[id] is block-based. Blocks render to email-safe HTML — table layout with fully inline styles and the conditional markup Outlook needs — so what the preview shows is what a mail client receives. The editor offers an iframe preview and a test send to a single address before anything goes to a real audience.
That is a deliberate position, not a missing feature. A meaningful share of recorded opens is machine-generated by privacy proxies that fetch tracking pixels before a human sees the message; no vendor publishes a reliable way to tell those apart, and the platform does not pretend to know the split. An open rate is not a reliably measurable signal — a number that cannot be trusted is worse than no number, because it gets used to make decisions. Clicks and conversions carry the decisions instead.
Open tracking is off by default and can be switched on per account. When it is on, the figures appear with a caveat attached and machine-classified opens are counted separately. The toggle exists for accounts that need continuity with a previous product; the caveat travels with the number wherever it is shown.
Counters are exact. Every campaign counter moves through a single increment path, and events are deduplicated at two independent layers — once when the incoming notification is claimed, and once on the event's own identifier. Email providers deliver webhooks at least once and in no guaranteed order, so a replayed or out-of-order notification is expected. It cannot double-count.
The per-campaign event timeline is paginated separately from the summary, because on a large send the event stream is orders of magnitude bigger than the totals.
/settings/sending-domain walks an account through it: add the domain, publish the SPF, DKIM and DMARC records it prints, and verification polls until the records propagate. While they are still spreading it reports that state rather than failing, because DNS propagation is normal and looks identical to a mistake for the first few minutes.
Bringing a custom domain is available on Starter and above. The platform side of the same picture is /admin/sending-domains: every account's domain, its verification state, reputation flags, and the ability to force a re-verification or revoke a domain.
You receive this. It ships behind a feature flag and sits on the Starter+ tier as configured, so it is revenue you can reserve for your own paying customers.
That is a deliberate position, not a missing feature. A meaningful share of recorded opens is machine-generated by privacy proxies that fetch tracking pixels before a human sees the message; no vendor publishes a reliable way to tell those apart, and the platform does not pretend to know the split. An open rate is not a reliably measurable signal — a number that cannot be trusted is worse than no number, because it gets used to make decisions. Clicks and conversions carry the decisions instead.
Open tracking is off by default and can be switched on per account. When it is on, the figures appear with a caveat attached and machine-classified opens are counted separately. The toggle exists for accounts that need continuity with a previous product; the caveat travels with the number wherever it is shown.
Counters are exact. Every campaign counter moves through a single increment path, and events are deduplicated at two independent layers — once when the incoming notification is claimed, and once on the event's own identifier. Email providers deliver webhooks at least once and in no guaranteed order, so a replayed or out-of-order notification is expected. It cannot double-count.
The per-campaign event timeline is paginated separately from the summary, because on a large send the event stream is orders of magnitude bigger than the totals.
You receive this. It ships behind a feature flag and sits on the any tier as configured, so it is revenue you can reserve for your own paying customers.
Double opt-in is the default. A submission creates the contact as pending and sends a confirmation email. The contact becomes active only when they follow the tokenized link, at which point they join the target list and the confirmation is recorded as consent.
Double opt-in is never gated behind a plan. It is a compliance surface, and gating it would make the cheapest plan the least lawful one.
If the confirmation email failed to send, the contact stays pending with no send timestamp recorded, and following an expired link triggers a fresh confirmation rather than dead-ending a real subscriber.
Suppression is checked twice on every send: once when the recipient set is built, and again per contact inside the batch that does the sending. A contact who unsubscribes between those two moments is still not mailed.
Suppression has two scopes, and the difference matters:
The account's own suppression list at /suppression shows unsubscribes, bounces and complaints, and supports import and export — so a list moved in from another product arrives with its opt-outs intact.
Consent timestamp and source are recorded on every contact from the moment it is created, and can be exported as proof of consent when someone asks.
Two controls that are often confused, and they behave differently on purpose:
Sequences are available on Growth and above.
You receive this. It ships behind a feature flag and sits on the Growth+ tier as configured, so it is revenue you can reserve for your own paying customers.
The platform underneath the product — counted in this product's own source, not claimed from a template. Where a row carries a list, open it to read the names behind the number.
Coinbase
dLocal
Flutterwave
Komoju
Mollie
NOWPayments
Opn
Paystack
ActiveCampaign
Customer.io
Segment
Canny
Amplitude
Custom Head Scripts
Pushover
Twilio SMS
Crisp
Tawk.to
Monday.com
fal.ai
Axiom
hCaptcha
Freshsales
Pipedrive
Pabbly Connect
AWS S3
MuxHover a table to isolate what it touches; click one to read its relationships. The big nodes are what everything else hangs off. organizations is referenced by 61 tables because every single record in this product belongs to an organization, and that is what makes tenant isolation a property of the database rather than something the application has to remember on every query.
all 74 tables, as text
active_boosts · admin_notifications · analytics_daily · analytics_events · analytics_funnels · announcement_dismissals · announcements · api_key_logs · api_keys · assistant_actions · assistant_conversations · assistant_messages · assistant_usage · audit_logs · automation_log · automation_templates · campaign_events · campaign_metrics · campaigns · contact_custom_field_defs · contact_list_members · contact_lists · contact_tokens · contacts · credit_balances · credit_transactions · currencies · data_exports · data_imports · email_send_queue · email_templates · faq_categories · faq_items · feature_flags · form_submissions · inbound_webhook_events · inbound_webhooks · languages · marketing_audience_members · marketing_audiences · notification_log · notification_rules · notifications · org_deliverability_status · organization_limit_overrides · organizations · plans · platform_secrets · platform_settings · product_purchases · products · provider_prices · push_devices · report_templates · roles · scheduled_tasks · segments · sending_domains · seo_meta · sequence_enrollments · sequence_step_executions · sequence_steps · sequences · subscription_forms · subscriptions · suppression_entries · theme_page_sections · theme_section_library · theme_sections · translations · user_sessions · users · webhook_logs · webhooks
The chassis, and anything particular to this product. 2 required, 1 optional.
The chassis. Next 16 on any Node host, with Postgres, auth and storage coming from Supabase.
Eight jobs ship declared for Vercel, including the send queue itself. On another host they are a cron configuration you wire by hand, and a campaign scheduled for Tuesday simply waits.
An account can send from the platform's shared subdomain immediately, so nothing blocks the first campaign. Authenticating a sender's own domain is the upgrade, and it is DNS work at a registrar rather than a service you buy.
Already built — plug and play
Every provider integration in this list ships wired into the product. You bring your own keys, connect them in the admin, and go live — there is no integration code to write. Nothing is resold through us: the ongoing cost is whatever these providers charge you. Capabilities marked plan-gated elsewhere on this page unlock by plan, not by extra code.
What exactly do I receive after purchase?
The complete source repository behind the live demo — 165,260 lines across the application and its database, 74 tables defined by 100 migrations that the shipped scripts apply for you, plus the seed data, the demo accounts and the setup documentation. Not a subset and not a scaffold: the same code that runs the demo you just used.
Is the live demo the same product whose source I receive?
Yes. The Sendora demo runs the delivered release (v1.0.0), and the build figures on this page are measured from that same source — not from a showcase build kept separately.
Can I test every account role before buying?
Yes — all 3 of them: Campaign collaborator, Account owner, Platform admin. Each one is seeded in the live demo and reachable from the role board above, so you can inspect the product from the customer's side, the agent's side and the administrator's side before you decide.
Is this a complete product or a starter template?
Complete. 86 page modules and 351 HTTP operations, with authentication, roles, billing, an administration panel, background jobs and seeded demo data all wired and running. A template gives you the shape of an application; this is one you can deploy and start operating.
Can I rebrand and modify it?
Yes, without asking. The name, identity, copy, styling and code are yours to change. Rebranding and operating it as your own service is exactly what the licence is for.
What does the licence allow?
A perpetual, worldwide, non-exclusive, non-transferable licence to the product you bought and to every update released for it. The Standard licence covers one business — yours. If you deploy for clients, the Client licence covers up to five. You can modify it, rebrand it, deploy it and charge your own customers.
Can I resell the source code?
No. Reselling, redistributing, sublicensing or giving away the source itself is not permitted under either licence. You build and deliver products with it — the code stays with you.
What services and ongoing costs are required?
You bring your own accounts, so we never mark anything up and there is no ongoing cost to us beyond the purchase. Required: A Node host and a Supabase project, A scheduled runner. Optional: A sending domain you control. The table above says exactly what stops working without each one; most have usable free tiers at low volume.
How difficult is deployment?
Two ways, and most buyers use the first. The installer in your saascode dashboard walks it: you create free accounts at Vercel and Supabase, connect them, and it provisions the database, applies 100 migrations, seeds the data, deploys and verifies the result — you watch the steps go green. Or take the source and do it yourself with the shipped scripts and docs, which is the same sequence run by hand.
What updates and support are included?
Updates to that product for as long as we maintain it — no renewal fee and no expiry date on your access. Support covers download problems, defects in the code as shipped, questions about what the product does and how it is structured, and licence questions. It does not cover debugging your own modifications, building features for you, or setting up your hosting and third-party accounts.
Why does a complete codebase cost $249?
Because it was built once and is distributed many times. SaaSCode builds each product and ships the same finished release through the catalog, so the price reflects repeatable distribution — not a reduced codebase, an unfinished template, or what the same work would cost commissioned.
Do I need to be a developer?
No, for the normal path. You create free accounts at Vercel and Supabase, connect them to the installer in your saascode dashboard, and it does the deployment for you — provision, migrate, seed, deploy, verify. What it asks of you is creating two accounts and copying a token, not writing code. If you would rather deploy it yourself, or host it somewhere else, the full source and the scripts are yours to do that with. Running the product day to day needs no technical skill at all: that happens through its own interface, which is what the demo shows.