Product
One place for every opt-out, and one way to share it.
Unsubscribes, complaints and bounces come in from everywhere you send. OptOutManager turns them into a single list per brand, keeps a history of every version, and gives each partner exactly the access you decide.
01 Collection
Opt-outs arrive from every source you use.
Whatever raises the event, it lands in the same list within moments, and it is recorded once.
- ESP webhooks
- Receivers for Mailchimp, Klaviyo, ActiveCampaign and SendGrid verify each provider’s signature and turn unsubscribes, spam complaints and bounces into suppression events.
- One-click unsubscribe
- The API issues a signed URL per recipient, in batches of up to 10,000, for the
List-Unsubscribeheaders that Gmail and Yahoo require of bulk senders (RFC 8058). - Hosted opt-out page
- A signed link for the footer of each campaign opens a plain confirmation page served by your installation, on your domain.
- API ingest
- Partners and internal systems post unsubscribes directly. Each request is tied to the key that sent it.
- File and paste import
- Upload a CSV or paste addresses to bring over an existing list. Addresses are hashed as they are read.
- Zapier and generic webhooks
- For platforms without a dedicated receiver, a signed generic endpoint accepts events from anything that can send an HTTP request.
02 Storage and hashing
Lists are stored as hashes, in the formats partners ask for.
The published file is a column of fingerprints. A partner can match their own records against it without receiving a single address.
ff8d9819fc0e12bf0d24892e45987e249a28dce836a85cad60e28eaaa8c6d9765ff860bf1190596c7188ab851db691f0f3169c453936e9e1eba2f9a47f7a0018e0d47ca1bc1eb62e650fc1fd660a9bfbf7cba8dc6337d81df7ea9aa9071a24a57b34211350ff567970974e1e2b98d319a601969e74fd1a957bc889b8332d00eb…A published list is one hash per line.
- Three hash formats
- Every address is normalised, then hashed as MD5, SHA-256 and SHA-512. Partners download whichever their platform accepts.
- Raw addresses off by default
- The installation does not keep plain addresses unless you enable it globally and then again for the specific list.
- Numbered versions
- Each change publishes a new version with a row count and checksum. How many earlier versions are kept is a setting.
- Delta files
- A partner who already holds version 31 can ask for everything added since, instead of downloading the full list again.
- Global opt-out
- One list applies across all of your brands, for the people who should not hear from any of them.
- Suppressed domains
- Block whole domains as well as individual addresses. The scrubber applies both.
03 Distribution
Partners get the list the way their pipeline expects it.
Four routes, all available for the same campaign at the same time.
- API downloads
- Partners request the latest version, or a specific one, and receive a short-lived signed link to the file in your bucket.
- SFTP push
- Deliver files to a partner’s server hourly, twice a day, daily or at a set hour. The server’s host key is pinned, and a destination that keeps failing is switched off and reported.
- Batch scrub
- A partner sends up to 10,000 addresses in one request and gets back which are suppressed. Larger files run as a background job and return an annotated CSV.
- Partner portal
- For partners who would rather click than script: sign in with an emailed link, download current lists, and upload a file to scrub.
04 Access control
Each partner sees the campaigns you grant, and nothing else.
Access is issued per partner, per campaign, and can be withdrawn in one click.
- Keys and grants
- API keys belong to a partner. Which lists that partner can read is set campaign by campaign.
- IP allow-lists
- Restrict a key to the addresses or ranges a partner sends from.
- Rate limits
- Limits on sign-in, unsubscribe and API endpoints are set in configuration, per minute.
- Two-factor sign-in
- Administrators sign in with an authenticator app and hold recovery codes. Two-factor can be made mandatory for every administrator.
- Roles
- Full administrators, administrators limited to a brand, and read-only auditors.
- Encrypted secrets
- SFTP credentials and webhook signing secrets are encrypted at rest with a key that you generate and that stays on your server.
05 Monitoring and audit
Know who took the list, and what they did with it.
The record you will want when a partner says they never received the file, or a regulator asks how an opt-out was handled.
- Audit log
- Sign-ins, downloads, imports and configuration changes, with the person, time and address they came from.
- IP context without a third party
- Country, network and reverse DNS for each address are looked up in a local GeoIP database. A sign-in from a new country is flagged.
- Seed addresses
- Addresses you control are planted in each download. Mail arriving at one identifies the partner, campaign and version it came from.
- Repeat opt-out tracking
- When someone already on the list unsubscribes again through a partner’s mail, that partner is not refreshing their file. The attempt is recorded against them.
- Alerts
- Opt-out rates that spike on one partner, SFTP and webhook failures, and partners who have not adopted one-click unsubscribe. Shown in the dashboard and sent as a daily digest.
- Download reports
- Which partner pulled which version, when, and by which route.
06 Connections
Receivers for the common platforms, and open routes for the rest.
Anything that can send a webhook, call an API, read a file from SFTP or export a CSV can work with OptOutManager.
- MailchimpUnsubscribes, complaints and cleaned addresses
- KlaviyoUnsubscribes, complaints and bounces
- ActiveCampaignUnsubscribes, complaints and bounces
- SendGridUnsubscribes, spam reports and bounces
- ZapierEvents from any connected app
- Generic webhookSigned JSON from any platform
- REST APIIngest, versions, scrubbing and tokens
- SFTPScheduled delivery to partner servers
- CSVBulk import and annotated scrub results
- Email headersRFC 8058 one-click unsubscribe
One license. No meter running.
Tell us roughly how many records, brands and partners you manage, and where you plan to host. We will reply with a quote.