Chain of custody.

Email delivery runs in the EU. Mail sent through Postboi is delivered by Amazon SES from the eu-north-1 region (Stockholm, Sweden), and mail sent to your own domain is received by SES in Ireland. A few checks read content elsewhere, each named in the subprocessor list. The application itself (dashboard and API) runs on Cloudflare Workers, which execute on Cloudflare's global edge network close to whoever's making the request, with account data stored in Cloudflare D1.

We're a UK-operated service, and our processing is governed by UK GDPR. Our data processing addendum is part of the terms and applies to every account. If you need a signed copy, email support@postboi.app.

• API keys are stored as one-way hashes. We can't read a key back after creation. If one leaks, revoke it and mint another in the dashboard.
• No passwords. Sign-in is by magic link or SSO (Google, Microsoft, GitHub), so there's no password database to breach.
• Card details never touch our servers. Payment is handled end-to-end by Stripe.
• Synced provider credentials are sealed, and used server-side for exactly three things. Credentials your team syncs for postboi sync are AES-GCM-encrypted at rest, and decrypted only (1) to poll your provider for delivery events when it can't push webhooks (SMTP, Microsoft 365, Cloudflare), on by default when such a credential is synced, pausable per provider from the Providers page; (2) to send on your behalf through a provider you have put in the sending order there, or a list's texts through yours; and (3) to verify the delivery-event webhooks of a provider you have pointed at us, using its signing secret, and, when you press Register on that page, to ask that provider to point its webhooks here, storing any signing key it hands back. Never otherwise. Keys you connect on the Providers page stay on our side: postboi sync never writes them to anyone's machine.

Postboi is built and run by one engineer, its founder, and nobody else has access to production systems or customer data. Looking inside a team's account happens to answer that team's support request or to investigate abuse, and never otherwise.

You can see when it happens. Every page support opens in your account and every setting it changes is written to your team's audit log, marked via Postboi support, beside your own team's activity.

Each team chooses how long the content of its mail is kept, under Settings: 7, 30 or 90 days, a year, or for as long as the account is open. It's 1 year until somebody picks. Past that it's deleted, and what's left is enough to tell you a message was sent and how it went, and not what it said. The privacy policy has the rest.

Every account sends under its own isolated sending identity with per-account bounce and complaint tracking. An account whose sending turns abusive is paused automatically, which means one bad actor can't burn the deliverability of your mail. Suppression lists, rate limits and daily caps back that up.

Hosted form submissions are spam-checked (honeypot, and optionally a managed captcha) before anything is sent, rate-limited per form, and can only deliver to a verified team member's email address. A public form URL can never be pointed at an arbitrary inbox.

The full list of companies that process data on our behalf:

That's the whole list. We'll email every team's owners at least 30 days before adding to it, as the data processing addendum promises.

• Abuse is stopped first. An account sending phishing, spam or malware has its sending stopped and is suspended as soon as it's found, and we report it to the parties involved.
• A breach is reported. If your recipients' data is ever exposed, we tell you within 72 hours, by email, with what happened and what we've done, and help you with any notice you need to give the ICO or the people affected; the data processing addendum has the detail. If it's data we hold for ourselves, like your sign-in or billing details, we tell the ICO within 72 hours where UK GDPR requires it, and tell you without undue delay.
• Every incident is on the record. Outages, delivery problems, security problems and abuse that touched the shared sending reputation are listed on the delivery record.
• Support is a person. Email support@postboi.app and the founder answers, usually the same working day, UK time.

Found something? Email support@postboi.app with details and we'll respond quickly, usually the same day. Please give us a reasonable window to fix before disclosing publicly, and don't test against other people's accounts or data. We're grateful to anyone who reports in good faith.

The machine-readable version of this is at /.well-known/security.txt.

Live service health is published at postboi.app/status, checked against the real dependencies every time the page loads.