What do you like best about Cakemail?
The feature I value most with Cakemail is its granular user role control paired with immutable campaign and recipient audit trails, which fits really well for our legal consulting security and governance needs. We don’t use it for mass promotional marketing; we rely on it to send regulated client updates, court deadline reminders, confidential onboarding notices, and periodic compliance check-in emails. The built-in user permission panel lets me lock down what each team member can view or modify, and the permanent activity log saves me roughly three hours each week during our quarterly HIPAA-BAA and CCPA evidence reviews.
Our legal team handles highly sensitive client PII and case data, so separation of duties is non-negotiable. Our paralegals need to build and queue client notification emails, but they must never get access to modify our sending domains, suppression rules, or audit export settings. Inside Cakemail, I can assign custom scoped roles: a paralegal gets permission to draft campaigns and preview recipient lists, but cannot download full contact exports or alter our compliance footer templates. For example, when our family law team sends out retainer follow-up emails, the drafting staff can build the message, submit it for my security sign-off, and hit schedule only after I validate the recipient suppression status. This stops accidental exposure of protected client contact data, and every single action — edits, previews, sends, link clicks — gets timestamped and tied to the individual user account.
I also lean heavily on its domain authentication management workflow. Our firm’s email reputation is critical, and misconfigured SPF/DKIM/DMARC records would risk confidential client messages landing in spam folders. Cakemail walks through domain verification step by step and surfaces real-time authentication health alerts. When we added a secondary subdomain for HIPAA-aligned patient-related notices last quarter, the dashboard flagged a missing DKIM entry before we sent a single message, letting me resolve it fast instead of discovering deliverability failures after the fact.
An unexpected benefit I found is how clean the API webhook logging integrates with our existing Splunk SIEM pipeline. I configured webhooks to push send events, bounce events, and unsubscribe requests automatically into our security monitoring stack. If someone sends an email to a suppressed recipient or there’s a spike in hard bounces from a client list, Splunk flags it as an anomaly for me to investigate. I originally only planned to use Cakemail’s native audit exports manually, but this live feed gives us continuous oversight, which our compliance auditor highlighted as a strong control during our last assessment.
The audience suppression list enforcement is another reliable layer. Once a client opts out of non-essential communications, Cakemail automatically excludes them from all future campaign sends. It prevents team members from manually overriding suppressions, which removes human error risk when our busy legal staff rush to send deadline alerts.
Suggestions: My top ask would be native SSO via Azure AD and full SCIM provisioning, so I can auto-provision and deactivate user accounts as staff join or leave the firm, instead of manually adding and removing users inside Cakemail. I would also like more detailed retention controls for old campaign logs, with configurable auto-archive rules aligned to our legal document retention schedules. Finally, built-in HIPAA-specific email footer templates and BAA documentation resources would reduce the manual work needed to make every client-facing message fully compliant. Review collected by and hosted on G2.com.
What do you dislike about Cakemail?
My biggest frustration with Cakemail is the lack of native Azure AD SSO and SCIM provisioning. Every time we onboard a new paralegal, contract attorney, or admin staff member, I must manually create, assign roles, and deactivate accounts one by one inside the Cakemail user panel. Our firm cycles through temporary case staff fairly often, and manual identity management creates real compliance risk. Last quarter, a contract attorney wrapped up their assignment, and I missed removing their Cakemail account for three business days. That left a user with permission to view our protected client recipient lists active after their access should have been revoked, a finding our internal security checklist flagged as an access control gap. Without SCIM sync, there is no automated offboarding trigger tied to our Azure identity lifecycle, which adds hours of repetitive identity work each month and opens us up to orphaned privileged accounts.
The audit log export filtering capabilities are also very limited, which slows down our evidence collection for HIPAA-BAA and CCPA audits. The logs capture user actions, sends, clicks and bounces, but I cannot filter them by user, recipient category, or date range before exporting. If our auditor requests all activity tied to our healthcare-related client notices over a 90-day window, I have to export the full bulk log file and sift through thousands of unrelated campaign entries manually in Excel. That manual sorting cost me nearly six hours during our last formal assessment. The webhook feeds we push to Splunk help, but they don’t fully replace the ability to quickly pull scoped, ready-to-submit audit trails directly inside the platform.
I’m also disappointed there is no built-in PHI-aware message classification or hardened suppression override guardrails. Our legal team sometimes sends urgent deadline notices for healthcare-related cases, and we need firm controls to block staff from accidentally messaging anyone marked for suppression. While the global suppression list works, there is no separate, locked-down suppression tier for HIPAA-covered individuals. A user with campaign drafting permissions can still copy and paste a protected contact into a new audience list outside the suppression workflow, and Cakemail will not alert me to that risky action. That creates a gap in our controls for sensitive patient-related PII, which is a high-stakes issue for our consulting practice.
Another weak spot is the absence of configurable log retention policies aligned with legal record-keeping rules. Our state bar and HIPAA requirements mandate we retain certain communication records for six years, while older, non-client test campaigns can be purged sooner. Cakemail stores all logs indefinitely with no scheduled auto-archive or secure purge toggle. I have to track and delete old campaign records manually, and accidental retention or premature deletion can both hurt our compliance posture.
Suggestions: First, add Azure AD SSO and SCIM provisioning so user lifecycle changes sync automatically, removing orphaned account risk. Second, add granular filters and saved export views for audit logs, so I can pull auditor-ready subsets without bulk CSV cleanup. Third, introduce a protected suppression tier for HIPAA-regulated contacts with hard blocks and admin alerts when someone attempts to use those records. Finally, build custom retention timers for campaign and activity logs, so retention rules match our legal and HIPAA document schedules. Review collected by and hosted on G2.com.
