Every release is battle-tested before it ships
"Battle-test PASS" is not marketing. It means the PMH-SEC-036 multi-tenant isolation test ran green, the smoke gate passed for all 38 PMH-SEC controls, and the release A/B/C completeness gates were all satisfied — on every deployment, ever.
What 'battle-test PASS' means
PMH-SEC-036: Multi-Tenant Isolation Test
This is the most important test in the PostMTA release pipeline. It runs automatically before every production deployment. Here's what it does:
PMH-SEC-036 pseudo-code
workspace_A = create_workspace()
workspace_B = create_workspace()
# Inject secret into workspace A
secret_A = inject_payload(workspace_A)
token_B = get_api_token(workspace_B)
# Attempt cross-workspace read — must fail
result = api.read(token_B, resource_from_workspace_A)
assert result == ACCESS_DENIED
If result ever equals the payload instead of ACCESS_DENIED, the deployment is blocked and the on-call security team is paged. This test has run on every production deployment since 2024.
Zero cross-workspace leaks
In the history of PostMTA, no deployment has ever passed with a cross-workspace data leak. The test has never returned a false positive — if it fails, it means a real vulnerability exists.
What the test covers
- API token scope: workspace A token cannot read workspace B resources
- Database rows: direct DB access with workspace B credentials cannot select workspace A rows
- Webhook delivery: a workspace A webhook URL cannot receive events from workspace B
- DKIM keys: workspace A cannot sign a message claiming to be from a workspace B domain
- Audit logs: workspace B admin cannot read workspace A's audit log entries
- Credentials: workspace A SMTP credentials cannot be used to authenticate to workspace B's relay
Every control, verified before every release
Authentication Controls
JWT signatures verified. Token expiry enforced. MFA claim required when enabled. SSO session invalidation verified.
Authorization Controls
Role checks at API gateway and database layer. Viewer tokens cannot hit mutation endpoints. Credit operations require elevated role.
Credential Handling
API key plaintext returned only on creation. SMTP passwords stored as Argon2id. UI never renders plaintext credentials. DB role cannot SELECT credentials.
Transport Security
STARTTLS attempted on all outbound SMTP. TLS required in production. Certificates renewed via ACME 30 days before expiry. Webhook payloads HMAC-signed.
Multi-Tenant Isolation
service_role key never in browser. DKIM private keys only accessible via service_role. DKIM keys workspace-scoped. PMH-SEC-036 automated isolation test.
Resilience & Recovery
Backups GPG-signed with HSM key. Air-gap bundle for DR. Reputation scoring per domain/IP. Chaos injection testing against RTO/RPO targets.
Release A/B/C completeness model
API Contract
Every release must maintain API contract compatibility. OpenAPI spec is versioned and validated against the actual routes. Breaking changes require a major version bump and 6-month deprecation window.
Suppression Management
Suppression list correctness is critical for deliverability and compliance. Gate B verifies that the suppression pipeline — bounce processing, complaint handling, and unsubscribe propagation — works correctly end-to-end.
Full Panel
Gate C covers everything else: DKIM signing, warmup ladder progression, rate limit enforcement, observability data completeness, and PMH-SEC-036 full isolation test suite.
What evidence is available to customers
PMH-SEC Control Matrix
All 38 controls in spreadsheet format. Columns: ID, title, description, status (Live/Shipping/Roadmap), owner, last review date, evidence reference, exceptions.
Audit Log Schema
Complete schema documentation for the append-only audit log: event types, field definitions, retention schedule, and export format. Includes sample query templates for common auditor requests.
Architecture Diagram
High-level architecture diagram showing data flow from customer API call through PostMTA processing to downstream delivery. Network boundaries, encryption boundaries, and subprocessors labeled.
Penetration Test Summary
Executive summary from the most recent Bishop Fox engagement, including scope, methodology, findings summary (critical/high/medium/low), and remediation status. Full report available under NDA.
SOC 2 Artifact Package
Includes the PMH-SEC matrix, audit log schema, architecture diagram, penetration test summary, and the SOC 2 Type II alignment narrative. Organized as a ZIP for easy distribution to your auditors.
How to Request Evidence
Submit a request
Email security@netwit.ca or fill in /contact. Tell us what you need — e.g., "SOC 2 artifact package" or "full evidence package for HIPAA BAA execution."
NDA execution
For the full artifact package, we'll send a standard mutual NDA. Usually executed within one business day via DocuSign.
Evidence delivery
Evidence delivered as a password-protected ZIP. Password sent separately via SMS or your secure file transfer preference.
Follow-up call
For enterprise deals, a solutions engineer can walk through the evidence package with your security team or auditors directly.
See the battle-test results in your environment
Schedule a technical call with a solutions engineer to walk through the release pipeline, the PMH-SEC-036 test in detail, and the full evidence package.