Maileroo is a privately owned Australian company that provides email delivery services across Australia. Enterprise customers looking for data residency and compliance requirements can host their email delivery infrastructure with us.
Our support team works from Melbourne, 9 AM to 9 PM Melbourne time, so you talk to engineers in your own time zone.
Enterprise SMTPEnterprise SMTP hosting is a managed email-sending service for organisations that send large volumes of transactional or marketing email. Instead of running your own mail servers, your applications send through the provider using SMTP credentials or an HTTP API.
The provider looks after IP reputation, SPF, DKIM and DMARC authentication, bounce handling, scaling and uptime.
Hosting it in Australia means the servers that accept, queue and deliver your email, and the logs they keep, sit in Australian datacentres under Australian law.
Data residencyWith Maileroo Enterprise in Australia, your email content, attachments, delivery logs and suppression lists are processed and stored in our Melbourne and Sydney datacentres. Here's exactly what stays onshore.
| Data | Where it's stored | Retention |
|---|---|---|
| Message content and attachments | Melbourne and Sydney | 14 days, then deleted |
| Delivery, bounce, open and click logs | Melbourne and Sydney | 14 days |
| Suppression and unsubscribe lists | Melbourne and Sydney | Life of the account |
| Backups | Melbourne and Sydney | 14 days |
| Account and billing details | Stripe and Paddle process billing overseas | Per privacy policy |
| Support tickets | Zendesk and Crisp operate overseas | Per privacy policy |
| Staff access to customer data | Australia-based staff | n/a |
Our full list of sub-processors and their locations for Australian users can be made available on request.
Most major email APIs process email in the US or EU. Some offer a Sydney region, but the provider is still a US company. Under the US CLOUD Act, US authorities can compel US companies to hand over data they control, wherever it's stored.
Maileroo Group Pty Ltd is an Australian company headquartered in Melbourne (ABN 39 691 482 836). Data in our Australian region is subject to Australian law and Australian legal process.
Australian complianceNo email provider makes you compliant on its own. What we can do is make Maileroo easy for your privacy, risk and security teams to assess.
| Regulation | Who it applies to | What it means for your email |
|---|---|---|
| Privacy Act 1988 and the APPs | Most businesses with turnover over $3M, plus all health service providers | Email addresses, names and message content are personal information |
| Spam Act 2003 | Anyone sending commercial email to or from Australia | Consent, sender identification and a working unsubscribe |
| APRA CPS 230 and CPS 234 | Banks, insurers and super funds | Manage material service providers and their information security |
| ASD Information Security Manual | Government agencies and their suppliers | Email authentication and encryption controls |
Under APP 8, if you send personal information to an overseas provider, you can remain accountable for how they handle it. Hosting email in Australia helps keep that data out of the cross-border rules.
APP 11 requires reasonable steps to protect personal information. Maileroo encrypts data in transit (TLS) and at rest, and supports role-based access, SAML SSO and MFA. If a breach affects your data, we notify you within 72 hours so you can meet your Notifiable Data Breaches obligations.
The 2024 Privacy Act amendments raised penalties and created a statutory tort for serious invasions of privacy, which started on 10 June 2025.
Commercial email needs the recipient's consent, must identify the sender, and needs an unsubscribe that takes effect within 5 working days. The ACMA enforces these rules, and recent penalties have run into the millions.
Purely transactional messages, such as receipts and password resets with no promotional content, generally fall outside the consent rules. Adding a promotional banner can change that.
Maileroo automatically suppresses unsubscribes, hard bounces and complaints, and supports one-click List-Unsubscribe headers. You can send transactional and marketing email from separate streams so each is handled correctly.
CPS 230 took effect on 1 July 2025. APRA-regulated entities must keep a register of material service providers and tell APRA about offshoring arrangements, including the country where services are performed.
If you send statements, one-time passcodes or fraud alerts, your email provider may be material. Maileroo Enterprise keeps that processing in Australia and provides a contracted SLA, incident notification terms, audit rights and a security pack for CPS 234 assessments.
The ISM's email guidelines cover SPF, DKIM and DMARC authentication and encrypting email in transit. Maileroo supports all three authentication standards with domain alignment, and sends over TLS 1.2 or higher.
Maileroo has not yet completed an IRAP assessment. Our security pack covers the controls government buyers most often ask about.
Robust FeaturesFrom isolated sending environments and dedicated IPs to SSO, templates, and technical support, Maileroo empowers teams with the control and visibility they need to send with confidence.
Send email through SMTP relay or the Email API with flexible options that fit the way your stack already works.
Protect your sender reputation with dedicated IP addresses built for consistent, high-volume enterprise delivery.
Keep transactional and marketing traffic in separate streams so one channel never puts the other at risk.
Connect every app and website you need on paid plans, with no hard limit on how many domains you can send from.
Give each domain its own logs, analytics, and credentials so teams and brands stay fully separated.
Attach multiple domains to one vendor or service, then set outbound security rules that match your workflow.
Review up to 30 days of sending data and dig into the metrics that show how every campaign is performing.
Search 14 days of email logs with advanced filters so you can find issues quickly and stay in control.
Resend failed, suppressed, or delayed messages from the dashboard for up to 14 days with a single click.
Automatically manage bad recipients, then import or export suppression lists whenever you need a closer look.
Measure opens and clicks across every send so you can see what engages people and improve the next campaign.
Use your own branded tracking domain on links to keep recipient trust high and your brand front and centre.
Set the return-path address that processes bounces and delivery updates so feedback loops stay accurate.
Watch your IPs and domains across major RBLs so reputation problems are spotted early, not after the damage.
Push delivery, bounce, and engagement events into your systems in real time so workflows can react instantly.
Route incoming email into your apps and workflows with inbound processing that fits how your team operates.
Build templates in the drag-and-drop editor, render them dynamically via API, and start from 200+ ready designs.
Import HTML from a file, zip, or URL, then adjust the design visually without writing or debugging any code.
Invite teammates and assign permissions with fine-grained control over what each person can view or change.
Configure passwordless SAML sign-in for your organization. Enables your organization greater security and compliance.
Add two-factor authentication with popular authenticator apps to keep account access locked down and secure.
Track collaborator activity across your account so every important change is logged and easy to review.
Test sending and integrations on a free domain before launch, so production stays clean while you experiment.
Add and manage domains programmatically through the API so onboarding new sending domains stays automated.
Connect with official SDKs in major languages, or plug into tools like Zapier, Make, and WordPress in minutes.
Follow clear documentation with practical examples so your team can integrate quickly and with confidence.
Configure DNS on Cloudflare in one click, with setup that respects your existing records and avoids surprises.
Export delivery reports, suppressions, and more whenever you need the data outside the Maileroo dashboard.
Get help from people with real email experience, so your first contact already understands the problem space.
Need help in real-time? Our live chat is available for both general and technical support.
PerformanceBefore a message is accepted, an SMTP connection makes several round trips: connect, EHLO, STARTTLS, authenticate, MAIL FROM, RCPT TO and DATA. Every round trip to an overseas server adds delay, and that delay repeats on every new connection.
| Your app sends from Melbourne to | Round trip (approx.) | Time to accept one message |
|---|---|---|
| Maileroo Melbourne or Sydney | 10–50* ms | Local handshake, no overseas RTT |
This matters most for time-sensitive email: one-time passcodes, password resets, checkout receipts and fraud alerts. It also reduces the risk of timeouts in serverless functions with short execution limits.
Who it's for| Industry | Typical email | What matters most |
|---|---|---|
| Banks, credit unions, insurers and super funds | One-time passcodes, eStatements, fraud alerts | CPS 230 and CPS 234, onshore data, uptime |
| Federal, state and local government | Rates notices, licence renewals, service alerts | ISM email controls, data residency |
| Healthcare and allied health | Appointment reminders, results-ready notices | Health information is sensitive under the Privacy Act; keep content minimal |
| Energy, water and telcos | Bills, outage and maintenance notices | High volume, reliable delivery during incidents |
| Universities and schools | Enrolment, timetable and LMS notifications | Volume spikes at the start of each term |
| Retail and ecommerce | Order confirmations, shipping updates, campaigns | Spam Act consent, peak capacity |
| SaaS companies selling to Australian enterprise | Invites, alerts, reports | Answering "where is our data stored?" in security questionnaires |
MigrationOur Melbourne and Sydney datacenters ensure that all your sensitive email data, customer information, and transactional records remain on Australian soil, protected by local laws and regulations.
This is especially critical for government agencies, financial institutions, healthcare providers, and enterprises handling sensitive customer data. With Maileroo's local data residency, you can confidently meet Australian Privacy Principles (APPs), comply with the Privacy Act 1988, and satisfy any industry-specific data sovereignty requirements without compromise.
Beyond compliance, local data residency means faster email delivery, reduced latency, and enhanced security. Your data never crosses international borders, minimizing exposure to foreign data access laws and ensuring you maintain full sovereignty over your information.
ReviewsDon't just take our word for it. Read what our customers have to say about our service.
Other regionsIf you also send to customers overseas, Maileroo can host enterprise SMTP in other regions, each with its own data residency.
FAQYes. On Maileroo Enterprise in Australia, email content, attachments, delivery logs and suppression lists are stored in our Melbourne and Sydney datacentres. Our DPA lists every sub-processor and where it operates. Please note, default Maileroo systems are setup in EU and the DPA outlines our global sub-processor list.
Yes. Maileroo is operated by Maileroo Group Pty Ltd (ABN 39 691 482 836), headquartered at Level 14, 333 Collins Street, Melbourne. Maileroo® is a registered Australian trademark.
We provide the option for data residency in Melbourne or Sydney.
Maileroo supports your Privacy Act obligations by keeping email data onshore, encrypting it in transit and at rest, and notifying you of any breach within 72 hours. Compliance remains your responsibility, so check your obligations with your advisers.
For commercial email, yes. The Spam Act 2003 requires consent, clear sender identification and an unsubscribe that takes effect within 5 working days. Purely transactional emails, such as receipts and password resets, generally don't need marketing consent.
99.9% each month, which allows at most 43 minutes and 12 seconds of downtime. If we miss it, you receive service credits under our SLA.
Yes. Enterprise customers get dedicated IP(s), and our engineers manage the warm-up for you.
Our Melbourne team answers live chat and email from 9am to 9pm Melbourne time. Additional support hours are available on request.
Yes. Enterprise plans are invoiced in AUD with GST, as tax invoices from an Australian company.
