Security
Guardrails you can't argue with.
The point of Mailstack is that its most important rules live in the schema and the function signatures — not in a policy document, and not in a prompt. Inside BoxClaw, the one that matters most is the desk: nothing leaves unattended without an approval a person made, bound to the exact message.
- Your data is yours, on your planeMailstack owns the mail server, the reputation planes and the suppression ledger — you're not renting a scope into a mailbox someone else can revoke.
- Accounts, roles and revocable sessionsOne account, many people, each with their own login and a role the owner controls. Sessions are rows you can kill; a leaked database exposes only their hashes.
- Authentication and encryption by defaultSPF, DKIM and DMARC alignment on every domain, TLS on the wire, and one-click unsubscribe where the rules require it.
- Suppression is global and permanentAn opt-out silences every campaign from every list, forever. There is deliberately no way to un-suppress by accident.
- Signed links carry their purposeA reset link cannot be replayed as a verification link — the purpose is inside the signature, and reset links are single-use.
- Agents are limited by shape, not by promptThe functions an agent can call take no recipient it shouldn't have. The limits a model can read are the limits it truly has.