Security

Postbox handles some of the most sensitive data there is: your mail. Here is how we protect it, and how to reach us if you find a problem.

Data protection

• Encryption in transit. All connections to the API, dashboard, and mail endpoints use TLS. Traffic between our services and our providers is encrypted.
• Encryption at rest. Stored mail and account data are held on managed infrastructure (object storage and database) that encrypts data at rest.
• Secrets are never stored in plaintext. API keys are stored only as one-way hashes, so we never hold your key material. Webhook payloads are signed so you can verify they came from us.

Access and authentication

• Scoped credentials. API keys are scoped to a single project. Mailbox tokens are short-lived and limited to one inbox, so a leaked token has a small, time-bound blast radius.
• Tenant isolation. Every account's mail, domains, and keys are isolated per tenant and per project.
• Least-privilege internal access. Access to production is limited to the personnel who operate it, and reviewed.

Infrastructure

Postbox runs in the EU (Frankfurt, Germany) and you can pin a project to the EU for data residency. We build on established providers, our email delivery, object storage, database, and payment providers each maintain their own SOC 2 and/or ISO 27001 programs. The full list, with the data each handles, is on our sub-processors page.

Reliability and backups

Account and mail data are stored on managed, durable infrastructure with automated backups. We maintain the ability to restore data and periodically verify that restores work, so a backup is something we can actually recover from, not just something we take.

Abuse prevention

To protect deliverability and recipients, Postbox enforces suppression of addresses that hard-bounce or complain, monitors sending reputation, and can throttle or pause unsafe sending. These controls are described in our Acceptable Use Policy.

Compliance and certifications

We align our controls to the SOC 2 and ISO 27001 frameworks, and a formal SOC 2 Type II examination is on our near-term roadmap. For data protection, Postbox acts as a processor of the mail you route through it: our Data Processing Agreement and Privacy Policy set out how we handle personal data, including international-transfer safeguards. If your procurement team needs a security questionnaire completed or wants to discuss our roadmap, contact [email protected].

Reporting a vulnerability

If you believe you have found a security issue, please tell us before disclosing it publicly. Email [email protected] with steps to reproduce. We will acknowledge your report, keep you updated, and we will not pursue legal action for good-faith research that respects our users' privacy and avoids service disruption. Please do not access data that is not yours, degrade the service, or run automated scanning that affects availability.

Contact

Security questions: [email protected]. Postbox, Inc., 2261 Market Street, STE 46197, San Francisco, CA 94114, USA.