Omnivery

Omnivery is a transactional email API and SMTP relay built for regulated senders: the password resets, fraud alerts, payment confirmations, invoices and booking confirmations that cannot go missing. The homepage says banks, travel platforms, broadcasters and energy suppliers run their transactional email on it, on infrastructure the company owns, under certifications it holds, with support from people who answer. Omnivery says its parent company is headquartered in the EU, in the Czech Republic, and that it was founded in 2021 by Jakub Olexa, drawing on 20 years of email infrastructure experience that began with Mailkit, founded in 2006.

Alongside the sending products, Omnivery sells a Bot Detection API and an Email Validation API, and it has solution pages for e-commerce, travel and hospitality, real estate, finance and insurance, utilities and energy, developers, ESPs and platforms, and replacing an on-premise mail server.

Sending by API or SMTP

There are two ways to send, and the company stresses that they are equal. The REST API is JSON over HTTP and natively accepts the SendGrid v3, Mailgun v3 and SparkPost v1 request formats, so an existing integration can move by changing the API key and base URL. The SMTP relay uses standard SMTP with TLS and works with any application, framework or legacy system that can send mail. Omnivery says the relay has full feature parity with the API: templating, webhooks, phishing protection, email journaling, bot detection and enforced TLS are all available over SMTP through X-OV-* headers. E.ON and Centropol Energy are named as customers that send this way, and the site has a separate page on retiring a self-hosted Postfix, Exim or Exchange relay.

The feature list covers webhooks for delivered, opened, clicked, bounced, unsubscribed and spam reported events, in 5 output formats; reusable HTML and text templates with variable substitution, using Handlebars or Template Toolkit; batch sending with rate controls and priority queuing; and an email validation API. Every API token and every SMTP credential can be restricted to an allowlist of IP addresses or ranges, so a leaked credential is useless from anywhere else. The FAQ adds that Omnivery carries both transactional and marketing streams, signing each with its own DKIM key and routing them through different IP pools.

Infrastructure and sender vetting

Omnivery says it runs 100% on its own physical infrastructure, with no AWS, Azure or Google Cloud in the delivery path. It owns its IP address space and operates its own networks and autonomous systems. That ownership is paired with strict vetting: every customer is reviewed before a contract, every sending domain is reviewed by staff, and there are no anonymous senders and no free plans. The FAQ adds that vetting turns away cold prospecting and synthetic warming services.

On IPs, the company's view is that a well-run shared pool of vetted senders beats a cold dedicated address for most senders. It offers dedicated IPs where they are genuinely warranted but does not push them as a default upsell.

The company also says it holds sending standards above what mailbox providers require. When Google and Yahoo brought in bulk sender rules in 2024, requiring DMARC enforcement, one-click list-unsubscribe and a spam rate below a threshold, Omnivery says it already required all three, and it says it is preparing support for DKIM2. Domain setup covers SPF, DKIM and DMARC records, and content is periodically sampled to prevent account takeovers.

Privacy, GDPR and certifications

Omnivery never stores the content of email messages. Its DPA commits in contract that content is deleted immediately after sending, and delivery metadata is kept for 30 days at most. A strict privacy mode, set per sending domain, anonymizes all personal information after the metadata is relayed to the customer. Phishing protection stops unauthorized links from being sent and alerts your security team, and email journaling archives a copy of every transactional message, set with a single domain setting.

The company lists seven ISO certifications, ISO 9001, ISO/IEC 20000-1, ISO 22301, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and ISO/IEC 27701, plus HIPAA, all independently audited. It says the HIPAA certificate is published for download and that it signs Business Associate Agreements for healthcare organizations, life sciences companies and insurers. Because the parent company is in the EU, Omnivery says EU law governs the whole processing relationship, with no Standard Contractual Clauses needed.

Deliverability and bot detection

The deliverability promise is a person rather than an alert. A senior deliverability analyst is part of the service from the day a sending domain passes vetting, on a standing call cadence, with no tier to upgrade into. Analysts review authentication, which message categories belong on which domain and the expected volume at onboarding, then monitor sending around the clock and contact the customer first when a pattern looks wrong. The homepage sums it up as 24/7 analyst-backed sending and says every destination counts, not just Gmail, Outlook, Yahoo and Apple. Bounce data passes on the receiving server's actual SMTP response as received, with no placeholder codes or rewritten reasons, and an InboxMonster integration lets one seed address populate hundreds of inbox placement monitoring addresses.

Bot detection is included automatically for customers using Omnivery's open and click tracking. It separates humans from Apple Mail Privacy Protection, security scanners and botnets using 20+ proprietary datasets built over 8+ years. By June 2026, Omnivery says, 50% of the clicks screened by its Bot Detection API were bots, up from 34% a year earlier, and it reports that beehiiv saved $14.4M in fraudulent ad spend over six months with the API.

Onboarding, migration and pricing

Omnivery says most customers are live within one working day. The steps are to apply at app.omnivery.com, where the account is reviewed and approved before activation, set up the sending domain, use the one-click migration tool to bring over suppression lists, bounces and unsubscribes, connect by SMTP or API, and cut over production traffic. Kiwi.com and Notino each completed their switch in 45 minutes with no application code changes. Omnivery also names Bloomreach as a platform it integrates with natively.

There is no public price list. The comparison page says Omnivery has no public pricing or self-serve signup by design, that every customer is priced on its specific requirements, and that there is no free tier as an anti-abuse policy. The company is frank that it does not compete on headline rate.

Who it suits

Omnivery fits organizations for which a lost or delayed email is a real problem and compliance review is part of buying: banks and insurers, healthcare and life sciences senders that need a BAA, travel and ticketing platforms, utilities and public bodies with old systems that can only speak SMTP, and EU businesses that want message content never stored. Developers moving from one of the three supported API formats can switch with a key and a URL.

The caveats come with the model. Every account is vetted, so signup is not instant and some sending practices are refused, and pricing is quoted rather than published.