LoginSign Up
← Back to all sparks
Postmark logo

Postmark

COMMS
Velocity2.5

Transactional email delivery service

postmarkapp.com ↗

Postmark adds its own SOC 2 Type 2 report to a run of security work.

transactional-emailmcpapi-securitycompliancewebhooks
◆Current state
Postmark's MCP server has 24 tools and delivery diagnostics, and the team has spent the autumn on account security: webhook verification and monitoring, IP Allowlisting for API sending, and 2FA on the free Developer plan. On November 5 it published its first standalone SOC 2 Type 2 report.
◆Where it's heading
Postmark is pairing agent-facing tooling (Skills, the MCP server) with the compliance and security controls larger buyers ask for. The SOC 2 report removes a procurement blocker rather than adding a feature.
◆Prediction
Expect more admin and compliance controls, such as audit logs or SSO, alongside further MCP server tools.

◆Recent moves

  1. 9d ago

    Postmark has its first SOC 2 Type 2 report

    Postmark now has its own SOC 2 Type 2 report, an independent audit of its data-protection controls. It follows the 2FA, allowlisting and webhook security releases and makes Postmark easier to clear in enterprise security reviews.

  2. 1mo ago

    2FA is now available on the free Developer plan

    2FA now works on every plan, including the free Developer tier. It matters because free accounts can still hold live API tokens.

    View source ↗
  3. 2mo ago

    Postmark Webhooks now verify themselves (and tell you when something's wrong)

    Webhooks can now be verified and monitored, and report when something is wrong. It closes the gap where a silent failure could go unnoticed for hours.

    View source ↗
  4. 2mo ago

    Secure API sending to trusted IPs with Allowlisting

    IP Allowlisting rejects API sends from outside defined ranges with a 403. It limits the damage from a leaked server token.

    View source ↗
  5. 4mo ago

    Postmark's MCP server: now with 24 tools and delivery diagnostics

    The MCP server has grown to 24 tools with delivery diagnostics, turning it from a send action into a management toolkit. It pairs with Postmark Skills to cover both agent knowledge and runtime calls.

    View source ↗
  6. 6mo ago

    Python SDK now available

    An official async-first Python SDK lands, with separate ServerClient (sending, bounces, templates, webhooks, streams) and AccountClient (domains, signatures, servers, data removals) surfaces. Closes a long-standing gap for Python developers and matches the async patterns most modern Python apps already use.

    View source ↗