Control-ready
PMH-SEC matrix, audit export, and compliance crosswalks — your attestation, our controls.
Security matrix
Managed appliance
PostMTA Hosted
Enterprise outbound infrastructure — operated for you or on your metal. KumoMTA control plane, prepaid credits, OmniFBL, and smoke-gated panel.
SOC 2-alignedHIPAA-ready designNIST CSF mappedSmoke-gated
Trust centerArchitecture
One deploy — marketing and panel together
Caddy terminates TLS. Astro serves / and /app on postmta-hosted-web :4321. /v1* goes to the API. SMTP submission on postmta-hosted-smtp.
Why hosted appliance
MailOps outcomes — not a trial funnel
PostMTA Hosted is contact-only enterprise. We operate the stack or install in your VPC. Separate from postmta.com DIY self-install.
Smoke-gated proof
Named QA rows in MATRIX — live Kumo inject, credits ledger, and panel journeys.
Proof hubDeployment choice
We-operate managed stack or customer VPC on your metal — same appliance, honest scope.
Enterprise modelsProduct pillars
What ships today vs next
Credits
Hold → commit → void before every inject. Live Realtime wallet in the panel.
Kumo path
HTTP /v1/send, panel send, and SMTP AUTH all hit live kumod inject.
Security-first
PMH-SEC control matrix on /trust/security. Prod smoke fails if lab flags stay on.
Incus nodes
Provision/health after packaging. Not claimed until smoke-green.
OmniFBL
Included feedback loop — not a separate upsell.
Onboarding
Seven-step wizard until first verified send — then full panel nav unlocks.
Security
Controls you can map — attestation you own
RLS on workspace data. service_role stays on the BFF. JWT gate on /app when SSR is enabled.
Are you SOC 2 or HIPAA certified? No — we ship PMH-SEC controls and compliance crosswalks so your team can attest on your deployment.
Trust centerProof matrixReady for enterprise outbound?
Request access for architecture fit — we operate or deploy on your VPC.