Dashboard

Members & settings

Roles, who can do what, and organization settings such as retention.

Anyone can sign up with Google or with a sign-in link sent by email. A new account creates its first organization on the Free plan.

Organizations

The dashboard lists the organizations you belong to. Click New organization to create one. Enter a name, a URL slug (lowercase letters, digits and hyphens), and a kind (internal or client). You become the first admin of the new organization, and the console opens its Domains page so you can add the first domain.

Roles

Role	Can
Viewer	Read everything in the organization.
Member	Viewer + send, add/verify domains, create `SEND` keys, webhooks, suppressions, templates, contacts, broadcasts, automations.
Admin	Member + create `FULL` keys, register domains for sending, disable/enable domains, MTA-STS, alert rules, organization settings, and manage members.

Every Server Action and API route checks the role again. The sidebar only hides what you cannot use.

Members

Members lists the people with a role. Invite attaches an existing user by email address. The user must have signed in to Refresh at least once. Admins can change roles and remove members. No one can demote or remove the last admin of an organization.

Settings

Settings has these tabs.

Usage — used counts against the plan limits.
Organization — name, slug, kind, retention, daily send cap, postal address, the sending pause, and the danger zone.
SMTP — the relay host on port 465 and the HTTP API base URL.
Alerts — bounce, complaint, DNS drift and related rules (admins only; see Metrics & alerts).
Appearance — light, dark, Refresh, or system theme for this browser.
Unsubscribe — logo URL, colors, and a control that hides the Refresh mark on /u and /p.

The platform counts the allowance per UTC calendar month. On Free, sending stops at the allowance. On a paid plan, mail past the allowance goes out. The next invoice bills it at the overage rate of the tier. The limit is twice the allowance in a month.

Three tabs are for admins only:

Billing — plan, use this month, checkout and the Stripe portal.
Queues — worker queue counts and the jobs of the organization, with Retry and Discard.
Audit log — who changed what, with filters and a CSV export (see Audit log).

On Organization, admins can edit:

Name — the display name of the organization (shown on the unsubscribe and preferences pages).
Event retention (days) — how long the platform keeps message events and API logs (1–3650).
Body retention (days) — how long the platform keeps message bodies (0–3650, at most the event retention).
Daily send cap — messages per UTC day; blank = plan ceiling or platform default (details).
Postal address — the mailing address of the organization; the worker adds it to bulk mail as a footer (details). Set it before the first digest or broadcast leaves the organization.

Sending pause

Settings → Organization → Sending shows whether the organization sends. An admin can click Pause sending and give a reason. From then on the API answers 403 sending_paused, the worker parks queued mail, and a red banner shows on every page of the organization. Resume sending lets the parked mail go out within 15 minutes. The platform keeps every parked message.

Alert rules can pause an organization automatically. See Metrics & alerts. The transport can pause delivery too. Each organization sends under its own isolated reputation, and a pause shows up here within the hour. The audit log records org.pause, org.resume and org.auto_pause.

The banner shows the reason, the start time and the source: an admin, an alert rule, or the transport. It also shows how many messages wait and the next step. Every automatic pause and every provider hold also sends an e-mail to each admin of the organization.

A pause can apply to one domain instead. An admin clicks Pause sending on the domain page, or a domain-scoped bounce or complaint rule with the kill switch fires. Only that domain stops: the API answers 403 sending_paused for it, its queued mail waits, and the other domains keep sending. The audit log records domain.pause, domain.resume and domain.auto_pause.

Messages with a bulk kind (bulk.*, broadcast.*, digest.*, sequence.*) get a small footer. The worker adds it to the HTML part before </body> and to the text part after a blank line. The footer reads: <organization name> · <postal address> · Unsubscribe: <url>. The unsubscribe URL is the same one as in the List-Unsubscribe header.

If the organization has no postal address, the worker sends the message without the footer. Transactional messages never get the footer.

Unsubscribe page

On Settings → Unsubscribe, admins can edit the public /u and /p pages:

Logo URL — an https image that the pages show above the heading.
Background, Text, Accent — hex colors for the page, the copy, and the buttons.
Hide Refresh mark — removes the "Powered by Refresh" line.

The preview on the left updates as you type. Press Save to store the values. /u and /p read them on the next request. Members and viewers can open the tab but cannot save.

Data protection

Settings → Organization shows a Data protection card. A client organization has its own AWS KMS key. The card shows the key ARN once the key exists. The platform creates the key with the organization, or on the first secret the organization stores. That key protects the DKIM keys, webhook secrets, Slack alert URLs and stored message bodies of the organization. Internal organizations share the platform key.

Set Body retention to 0 to keep no message content. The worker removes the body as soon as it sends the message. If that removal fails, the daily retention pass finishes it. Addresses, subjects and events stay for the event retention. See Data protection for the full picture.

Delete an organization

Only an ADMIN can delete an organization. Open Settings → Organization and find the Danger zone card. Type the organization slug and press Delete organization.

Caution: the delete is permanent. It removes the domains, API keys, messages, contacts, broadcasts, automations, webhooks and alert rules of the organization. It does not change SES identities or DNS records. Remove those separately when you no longer use the domains.