Chain of custody.

Email delivery runs in the EU. Mail sent through Postboi is delivered by Amazon SES from the eu-north-1 region (Stockholm, Sweden), and message content is processed and delivered from there. The application itself (dashboard and API) runs on Cloudflare Workers, which execute on Cloudflare's global edge network close to whoever's making the request, with account data stored in Cloudflare D1.

We're a UK-operated service, and our processing is governed by UK GDPR. If you need a data processing agreement for your own compliance, email support@postboi.app.

• API keys are stored as one-way hashes. We can't read a key back after creation. If one leaks, revoke it and mint another in the dashboard.
• No passwords. Sign-in is by magic link or SSO (Google, Microsoft, GitHub), so there's no password database to breach.
• Card details never touch our servers. Payment is handled end-to-end by Stripe.
• Synced provider credentials are sealed, and used server-side for exactly three things. Credentials your team syncs for postboi sync are AES-GCM-encrypted at rest, and decrypted only (1) to poll your provider for delivery events when it can't push webhooks (SMTP, Microsoft 365, Cloudflare), on by default when such a credential is synced, pausable per provider from the credentials page; (2) to send on your behalf when you have turned on send via there; and (3) to verify the delivery-event webhooks of a provider you have pointed at us, using its signing secret, and, when you press Register on that page, to ask that provider to point its webhooks here, storing any signing key it hands back. Never otherwise.

Every account sends under its own isolated sending identity with per-account bounce and complaint tracking. An account whose sending turns abusive is paused automatically, which means one bad actor can't burn the deliverability of your mail. Suppression lists, rate limits and daily caps back that up.

Hosted form submissions are spam-checked (honeypot, and optionally a managed captcha) before anything is sent, rate-limited per form, and can only deliver to a verified team member's email address. A public form URL can never be pointed at an arbitrary inbox.

The full list of companies that process data on our behalf:

That's the whole list. We'll update this page before adding to it.

Found something? Email support@postboi.app with details and we'll respond quickly, usually the same day. Please give us a reasonable window to fix before disclosing publicly, and don't test against other people's accounts or data. We're grateful to anyone who reports in good faith.

The machine-readable version of this is at /.well-known/security.txt.

Live service health is published at postboi.app/status, checked against the real dependencies every time the page loads.