The bulk-email module. Campaigns, lists, events and stats — with list hygiene and suppression built in from the start.
Sign in with GoogleSeats only: sign-in authenticates a seat the admin created — it never creates accounts. God sees deployment health, never tenant list contents; a tenant opens only through its own seat.