FAQ

General

Do I need a backend? No. The browser SDKs send straight from your frontend with a public key, protected by allowed origins, Turnstile and rate limits. If you have a backend, you can use the Node SDK or the REST API with a private key.

Does Frontmail send the email itself? Frontmail renders your template and hands it to your email provider (SMTP, Mailgun, SES, Postmark, SendGrid, Mailjet, Brevo, Resend, Gmail or Outlook). Deliverability and the From domain stay yours.

Is my public key a secret? No – it is visible in your page source by design. What protects you is the combination of allowed origins, Turnstile, rate limits and templates without dynamic recipients.

Credits and billing

What counts as one credit? One accepted email, including auto-replies, resends and each message in a batch. Test sends from the editor are free. Failed sends are refunded.

What happens when I run out of credits? Nothing is lost. In the default hold mode messages are stored and sent automatically once you have credits again – see Hold queue. Paid plans also have a 10 % overdraft buffer.

Does unused quota roll over? No, the monthly quota expires at the end of the period. Credit packs keep their credits for 3–12 months, and they are always used after the quota that expires sooner.

Can I buy credits on the Free plan? Yes. Packs are available on every plan.

Do you charge VAT? Stripe Tax calculates VAT by your billing address. EU businesses with a valid VAT ID are invoiced with reverse charge. See Invoices and VAT.

Can I cancel any time? Yes. The plan stays active until the end of the paid period, then you move to Free. Packs remain valid.

Templates

Can I use my own HTML? Yes – any HTML email, with Handlebars for variables, conditions and loops. Import an .html file or paste it.

Can visitors inject HTML into my emails? No. All values are escaped. Only params you declare as html are rendered as markup, and those are sanitized.

Can a template send to the address entered in the form? Yes, with an auto-reply (recommended) or by enabling Allow dynamic recipient on the template.

Privacy and data

Where is data stored? In AWS eu-central-1 (Frankfurt). Provider credentials are encrypted with AWS KMS.

How long do you keep my messages? For your plan’s history period (7–180 days), then they are deleted. Held messages are kept for the hold duration.

Is there a DPA? Yes, see the Data Processing Agreement on frontmail.dev.

Migration

I use EmailJS. How hard is it to switch? Change one import to @frontmail/emailjs-compat, recreate the templates and update the IDs. See Migrating from EmailJS.