Workspaces isolate data — leads, campaigns, mailboxes, replies — so an agency can run clients side by side and a company can separate teams. Roles control who can launch, edit or only view. SSO and audit logs are the enterprise layer: procurement and security teams (Enterprise RevOps buyers) won't sign without them.
The volume tools were built for founders and agencies and charge by sends, not seats. The suites were built for enterprises and charge by seat. The two worlds have different answers here, and the middle is underserved.
How it works
A workspace is a tenant boundary: its own mailboxes, leads, blocklist and API keys. Users are invited into one or more workspaces with a role. SSO (SAML or OIDC) lets the customer's identity provider control login; an audit log records who changed what. Agencies add a layer on top — a parent account that sees every client workspace (White-label and agency portals).
Who does it well
| Player | Workspaces and roles (as of Oct 2026) | SSO / audit |
|---|---|---|
| EmailBison | Unlimited workspaces with isolated data; Admin, Editor, Reseller roles; no per-seat fees (emailbison.com); API keys per workspace (docs) | Not documented |
| Instantly | Workspaces, workspace members and workspace groups in the API (docs); no per-seat pricing | Audit-log API endpoint; SSO not found |
| Smartlead | Client workspaces at $29–39/mo each on Pro+ (pricing, pricing.md) | Not documented |
| Salesforge | "Unlimited mailboxes and workspaces" even on $40 Pro; unlimited users on Growth (pricing) | Not verified |
| Reply.io | Agency plans with unlimited client workspaces from $210/mo (pricing) | SSO "Limited" on Email Volume, included on higher plans |
| lemlist | Unlimited users on Email plan | Custom roles and SSO/SAML on Enterprise only (pricing) |
| Saleshandy | Unlimited teams on all plans; 1 / 10 / unlimited users by plan (pricing) | SSO on Enterprise only |
| Woodpecker | Agency Panel at $27/mo per active client, client view-only access (pricing) | Not verified |
| Outreach | Seat-based, roles, custom objects (5–20 by tier) (pricing) | SSO supported |
| Apollo.io | Scoped permissions enforced for its MCP actions (Apollo) | Not verified |
| HubSpot Sequences | Seat-gated: Sales or Service Hub Pro/Enterprise seat required to use sequences (HubSpot KB) | Enterprise-grade permissions (not re-verified) |
Instantly, Smartlead and EmailBison do not document SSO on public pages found in this pass. Absence from docs is not proof of absence; enterprise contracts may include it.
Where implementations differ
- Cost of a workspace. Free and unlimited at EmailBison and Salesforge; $29–39/mo at Smartlead; $27/mo per client at Woodpecker. For an agency with 30 clients the difference is $870–1,170/mo at Smartlead before any sending.
- Cost of a seat. Volume tools mostly don't charge per seat (Instantly, EmailBison, lemlist's Email plan, Woodpecker). HubSpot Sequences and Outreach do — they monetise seats, not sends.
- Role granularity. EmailBison's three roles and Instantly's per-client portal permissions are coarse. Instantly's portal can't restrict a client to specific campaigns (help).
- Enterprise controls. SSO sits behind Enterprise at lemlist and Saleshandy, behind higher plans at Reply.io, and is undocumented at the volume leaders. Instantly is the one volume tool exposing audit logs by API.
Risks and abuse
Weak workspace isolation is a data-breach risk: one compromised agency login can expose every client's leads and replies. Shared logins (common when seats cost money) defeat audit logs. Under GDPR and ePrivacy, an agency is usually a processor for each client; it needs to show separation, which per-client workspaces and logs make provable.
What this means for an entrant
- Make workspaces free and unlimited. EmailBison and Salesforge already do; per-workspace fees are a tax agencies resent.
- Offer real roles: per-workspace, per-campaign and per-inbox permissions, plus a client-viewer role that sees only its own data.
- Put SSO and audit logs in a mid-tier plan, not Enterprise-only. That alone opens In-house SDR teams and Enterprise RevOps buyers buyers who want volume pricing but must pass security review.
- Log agent actions separately from human ones — the MCP era makes "which key did this" a compliance question (API, webhooks and MCP).
- For EU buyers, pair workspaces with data-residency options — none of the pricing pages fetched in this pass advertises an EU data region (Germany).