Wraps Logo
Product7 min readWraps Team

SSO, Behavioral Segments,and What's Next

Every Scale-exclusive feature explained with real numbers, plus a look at what's coming: audit trail, custom data retention, RBAC, and the Send API.

SSO + SCIMBehavioral segmentsUnlimited AWS accounts1M events/mo1-year history

The Starter and Growth plans cover most teams. But once your organization has multiple AWS accounts, an IdP managing employee access, and segments driven by user behavior rather than static properties, you need more. Scale is the tier we built for that.

This post covers every Scale-exclusive feature that's shipped today, with real numbers, and what's coming next.

What Scale unlocks

SSO + SCIM provisioning

Connect any SAML 2.0 or OIDC IdP. SCIM syncs user provisioning and deprovisioning automatically.

Behavioral segments

Segment users by events they've fired, not just properties they have. "Users who opened 3+ emails but haven't converted" is a behavioral segment.

Unlimited AWS accounts

Growth caps at 3 accounts. Scale removes the limit. Connect staging, prod, and every regional account.

1-year event history

Events, deliveries, and segment memberships retained for 365 days. Growth keeps 90, Starter keeps 30.

1,000 AI generations/month

Template generation, workflow generation, subject line suggestions — 1K per month vs. 250 on Growth.

Priority support + SLA

Named SLA, not just priority queue. Response time commitments in writing.

SSO + SCIM provisioning

Most SaaS tools add SSO as an afterthought or charge a separate "enterprise add-on" price. On Wraps Scale, SSO and SCIM are included in the plan. You pay $199/mo — not $199/mo plus $X for "enterprise auth."

What this means operationally

  • Employees log in with your company IdP — Okta, Entra ID, Google Workspace, any SAML 2.0 or OIDC provider
  • SCIM automatically provisions users when you add them in your IdP and deprovisions when you remove them
  • No orphaned accounts from employees who left two quarters ago
  • Your security team can audit Wraps access from the same IAM dashboard they use for everything else

The SSO settings live at app.wraps.dev → Settings → SSO. You paste your metadata URL, we detect the provider, and you're done. SCIM endpoint and token are on the same page.

SSO controls how employees authenticate. Roles control what they can do once they're in. Wraps ships six roles with per-resource granularity:

RoleWhat they can do
owner / adminFull access — contacts, templates, broadcasts, workflows, AWS accounts, billing, SSO, team management
memberFull content and workflow access. Read-only on API keys, AWS accounts, and team members
marketingCreate and send broadcasts, edit templates, manage contacts. Read-only on workflows, segments, and topics
read-onlyRead and export across all content. No writes anywhere
billingManage billing settings. Read-only on org context and team members

Behavioral segments

Property-based segments are available from Starter. You can target users where plan === "paid" or country === "US". That covers most cases.

Behavioral segments go further. Instead of filtering on contact properties, you filter on events those contacts have fired. The segment updates automatically as new events come in.

Examples of behavioral segments

Re-engagement candidates

Fired "email_opened" at least once, but NOT "purchase_completed" in the last 30 days

Power users

Fired "feature_used" more than 10 times in the last 7 days

Churn risk

Fired "session_started" in the last 60 days, but NOT in the last 14 days

Upgrade candidates

Fired "limit_hit" at least 3 times and has plan === "starter"

Behavioral segments are available in the Segments dashboard and can be used as targets in broadcasts and workflows.

Unlimited AWS accounts

Wraps deploys infrastructure to your AWS accounts — not ours. Every AWS account you connect gets its own SES configuration, dedicated IPs (optional), EventBridge rules, and isolation boundary.

Growth allows 3 accounts. That's fine for dev/staging/prod. But platform teams often have more: regional accounts, accounts per product line, accounts per customer (if you're multi-tenant). Scale removes the limit entirely.

Growth

$79/mo

3 accounts

Scale

$199/mo

Unlimited

Scale-grade limits

The numbers that matter for high-volume teams, compared to Growth:

LimitGrowth ($79/mo)Scale ($199/mo)
Tracked events/month250,0001,000,000
Overage rate$0.50/1K events$0.15/1K events
Event history retention90 days365 days
Batch send size2,000 contacts10,000 contacts
AI generations/month2501,000
API rate limit (per minute)2,000 req/min5,000 req/min
AWS accounts3Unlimited

The $0.15/1K overage rate matters at volume. At 2M events/month, the difference between Growth ($0.50/1K) and Scale ($0.15/1K) is $700/mo in overage alone — Scale pays for itself three times over.

What's coming to Scale

These are features in active development for the Scale tier. Not vaporware — each is something customers have asked for specifically.

Audit trail

Coming soon

A tamper-evident log of every action taken in your Wraps organization: who sent what, who changed a template, who added or removed a team member, who connected an AWS account. Filterable by user, resource, and time range. Exportable for compliance reviews. This is the feature security-conscious teams ask for most in enterprise evaluations.

Custom data retention

Coming soon

Scale today includes a fixed 365-day retention window. Custom retention lets you configure this per resource type: event history, contact activity, delivery logs. Some regulated industries need to retain less (GDPR right-to-erasure compliance); others need to retain more for audit purposes. You'll be able to set both.

More on Scale

Ready to scale?

Scale starts at $199/mo. SSO, behavioral segments, unlimited AWS accounts, 1M events, and a 1-year history window included. No add-ons.