Email is mission-critical infrastructure. Here's exactly how Postly protects your data and your reputation.
All connections to Postly are encrypted using TLS 1.2+ with Perfect Forward Secrecy (PFS).
SMTP traffic is protected with STARTTLS and opportunistic encryption. We enforce HSTS on all web properties.
Mail leaving our servers to external destinations is sent over encrypted SMTP whenever the destination supports it.
All stored email data and customer records are encrypted at rest using AES-256.
Database backups are independently encrypted before being written to cold storage.
Encryption keys are managed via a dedicated Key Management Service (KMS) with automatic rotation.
Postly enforces per-domain DKIM signing (2048-bit RSA), SPF record validation, and DMARC policy checks on all outbound and inbound mail.
Dashboard access supports two-factor authentication (TOTP) and we recommend enabling it on all accounts.
Privileged internal infrastructure access requires hardware security keys and is gated by strict role-based access control (RBAC).
Postly runs on SOC 2 Type II certified cloud infrastructure. All servers are housed in ISO 27001 certified data centres.
Production and development environments are strictly isolated. No customer data ever enters a development environment.
We perform automated vulnerability scanning on all container images and apply OS-level patches within 24 hours of critical CVE disclosures.
Network perimeters are protected by WAF rules, rate limiting, and DDoS mitigation at the edge.
Postly is GDPR compliant. See our GDPR page for the full breakdown of how we handle personal data.
We maintain a sub-processor list and notify customers of any changes at least 10 days in advance.
Annual third-party penetration tests are conducted by an independent security firm. Summaries are available to Enterprise customers under NDA.
We operate a responsible disclosure policy. If you discover a potential security vulnerability in Postly, please report it to security@postly.app.
Please do not publicly disclose the issue until we have had a reasonable time (90 days) to investigate and issue a fix.
We aim to acknowledge every report within 48 hours and provide regular status updates throughout the remediation process.
Researchers acting in good faith will not face legal action. We currently do not operate a paid bug bounty programme.
For security-related questions reach us at security@postly.app. For general data privacy questions, see our GDPR page or contact us.