Engineering description of controls. Not a SOC 2 / ISO certification claim. Internet delivery stays off until signed approval on a dedicated ≥4 GiB VPS.
What this service does
Authenticated API (and optional inject SMTP) accept → safety/compliance gates → queue → lab sink or production MX on a dedicated host.
| System | Role |
|---|---|
app.mailers.io | ESP control plane |
smtp.mailers.io | Customer SMTP ingress |
| This node | Independent outbound processor |
Controls (summary)
| Topic | Practice |
|---|---|
| Auth | Bearer platform token or hashed tenant API keys |
| Tenant isolation | Cross-tenant access denied; admin RBAC + optional MFA |
| Secrets | Env files mode 600; not in git |
| Abuse | Dual approval; incident stop revokes keys, preserves evidence |
| Safety | Fail-closed scanners; hold on outage |
| Compliance | Consent, purpose gates, counsel-signed jurisdiction packs |
| Delivery | INTERNET_DELIVERY=false by default |
Live node snapshot
Requires portal token (same as ops overview).
—
Documents
Updated 2026-09-06 · noindex