Email — Resend

Executive Summary

In brief: Transactional email for approvals, invitations, and system notifications via Resend.

Why it matters: External auditors and staff receive time-sensitive governance emails from a verified MQA domain.

Cost: Free tier (3,000 emails/month) → Pro $20/month (50,000 emails) if needed.

Status: Live in production with governance@mqa.group.

Decision needed: Upgrade to Resend Pro ($20/mo) if monthly volume exceeds 3,000 emails

Services & Costs — full vendor overview with pricing

Overview

The portal sends transactional email through Resend. Implementation: backend/src/services/email/.

Item	Value
Provider	Resend
Env key	RESEND_API_KEY
Set on	mqa-backend (Render secret)
Primary sender	MQA Group <governance@mqa.group>
Internal sender	MQA Governance Portal <system@mqa.group>
Support / reply-to	support@mqa.group

Fallback: Microsoft Graph (MICROSOFT_SENDER_EMAIL) can be used server-side if configured — see ENV-INVENTORY.

---

Pricing (August 2026)

Plan	Monthly emails	Daily limit	Price
Free	3,000	100/day	$0
Pro	50,000	—	$20/mo
Scale	Custom	—	Contact sales

Rate limit: 2 requests/second on free tier — the app batches onboarding emails with delays to respect this.

Monitor volume in the Resend dashboard.

---

What Resend is used for

Template / flow	Trigger
Auditor invitation	External audit access
User registration	New portal account
Password reset	Auth recovery
Approval request / decision	Workflow notifications
Audit assignment, findings	Governance events
Compliance deadline	Reminders
Policy update	Change notifications

If RESEND_API_KEY is missing, email is disabled (API continues; errors logged only).

---

Domain setup

1. Add domain mqa.group in Resend → Domains
2. Add DNS records (SPF, DKIM) — typically on Cloudflare or Hostinger
3. Verify domain status Verified
4. Use verified domain in EMAIL_FROM / default senders

Production senders already configured:

• governance@mqa.group — external stakeholder communication
• system@mqa.group — internal system notifications
• support@mqa.group — support / reply-to

---

Configuration

RESEND_API_KEY=re_...          # Required for email
EMAIL_FROM=MQA Group <governance@mqa.group>   # Optional override
EMAIL_REPLY_TO=support@mqa.group
FRONTEND_URL=https://portal.mqa.group

See backend/.env.example and ENV-INVENTORY.

---

Operations

Task	Where
Check delivery / bounces	Resend dashboard → Emails
Rotate API key	Resend → API Keys → update Render env → redeploy backend
Test without sending	Resend test keys (re_test_...)
Webhook (delivered)	EMAIL_WEBHOOK_SECRET + /api/email-tracking/delivered

Security: Never commit RESEND_API_KEY. Rotate if exposed.

---

Staging

Use a separate Resend API key or test mode on staging. Do not point staging at production sender volumes without rate-limit awareness.

---

Related

• Services & Costs — budget overview
• ENV-INVENTORY — all email-related env vars
• MONITORING — alert if email delivery fails repeatedly
• Backend reference: backend/src/services/email/README.md (developer detail)