EMAIL CONTROL PLANE
We don’t send your email. We prove what happened to it.
Password resets, invoices, “verify your email” — the mail your product has to send. You keep the mail server you already have (or SES, Mailgun, Postmark). We keep the proof: did it go out, what it said, and who sent it.
live
STATUSRECIPIENTSUBJECTTIME
HOW IT WORKS
Your email goes out exactly as it does today. We write down what happened.
Spoolway sits between the apps you build and the mail server you already pay for. Nothing about your sending changes. What changes is that afterwards, you can look any of it up.
WHO WE AREWe are YS Progress Inc., a small Canadian company. We built the layer we could not buy — one place that answers did it send, what did it say, who can send.
Your appyoursSends one request: who it goes to, which template to use, and the values to fill in.
Spoolwaythis is usWe fill in your template, hand it to your server, and write down every step.
Your mail serveryoursAmazon SES, Mailgun, Postmark, or your own server. We never send as if the mail were ours.
Your customeryoursGets the email, the same as they do today. Your address, your reputation.
and every step above is written down
THE RECORDsearchable later — and kept for exactly as long as you decide
Did that email actually go out?Your mail server’s own reply, word for word, with the time it was accepted.
What exactly did it say?The message itself, stored encrypted, for as long as your retention policy says — or never stored at all.
Who else can send as us?Every key is named and belongs to a person. Revoke one without breaking the rest.
Most teams cannot answer those three today — not through carelessness, but because the answers live in five providers, five .env files, and nobody’s dashboard.
An archive that answers “what exactly did it say?”Search any email later. We store the body encrypted, for as long as you choose — or not at all, for password resets. When the time is up, deletion is a dated event you can see — not a mysterious 404.
to
subject
template
Body deleted 12 Jun 2026 per billing-prod’s 30-day policy — the envelope stays (who it was to, the subject, the delivery record).
Templates, versioned in gitWrite a password-reset once. Every product uses the same copy. Later you can see exactly which version went out.
Every message names its ApplicationAn Application is one of your products. “Which of my products sent this?” is a filter, not a forensic hunt. Unapproved senders have nowhere to hide.
Who can send. Who can read.
If you sign the contracts, these are the questions you actually ask — answered in the product, not in a PDF.
Reading a customer’s email is an audited actMost tools let anyone with a login read every customer’s mail and leave no trace. Here, opening a body records who, when and from where — and tells the reader they are being recorded.
Body views are audit-logged. Who, when, where — recorded. You are casey@acme-corp (owner).
Every key belongs to a personFire someone and their send key dies with their access — watch:
JD
Scope people to ApplicationsA contractor sees one product. A junior sees staging, not billing.
client-acmeonly
Visibility never costs a licenceAnyone who only needs to look is free, on every plan. Support can always check the log.read-only viewers · free · unlimited
Watch how far we can see.
Your apps → us → your mail server (a transport, in our words — the server or SES/Mailgun/Postmark account you already have). The dashed line is where we stop guessing. A 250 from your server means it accepted the job, not that the inbox got it, so we call it handed to your server. Green appears only when Mailgun or Postmark later confirms delivery — and if a feed goes quiet, the count shows a dash with the time, never a zero.Reading the diagram: the dashed line is where custody passes to your server; the violet dashed path is webhook evidence, drawn only when a feed is connected.
Provider with webhooks: Mailgun or Postmark can later tell us the inbox got it. Only then do we say — tagged as their word, not ours.
The whole integration.
You send us a template name and the details. We accept it, write it down, and hand it to your server. After that, every step is time-stamped and searchable.
curl -X POST https://spoolway.com/api/v1/messages \ -H "Authorization: Bearer spw_…" \ -H "Content-Type: application/json" \ -H "Idempotency-Key: pwreset-usr_8812-20260802T1402" \ -d '{ "template": "auth/password-reset", "application": "auth-prod", "to": { "email": "[email protected]", "name": "Casey Reid" }, "variables": { "reset_url": "https://basalt.app/reset/tk_9f2a81", "expires_minutes": 30 } }'
← 202 Accepted · queued, not yet sent
{
"id": "2ee35675-6bae-42be-aa5e-6d4618d0c61d",
"status": "queued",
"application_id": 1,
"over_monthly_quota": false,
"attachments_captured": 0
}ENGINEERING TEAMSSeveral products, one mail logWrite the password-reset once. See which product sent which email. One log instead of five dashboards.authbillingnotifyone layer
AGENCIESClient sites, cleanly separatedEach client is its own product in the log. A contractor sees only that client. Anyone who just needs to ask “did it send?” looks for free.
ANYONE ON CALL“Did that email actually go out?”If you have been asked at 2am and could not answer — search the log. You get the mail server’s own reply as the receipt.
PROOF, THE HONEST KINDNo customer logos yet, so the proof is our own — checkable in the product.
“We exercise every path on our own multi-application account before any of our live products points its mail at Spoolway. We will not claim five live products until each one is actually on the wire.”tested end to end · not yet live on our products
Your transport. Your record.
Running in five minutes.
connect your mail server → name the product → send a testStart free — no card requiredFree forever tier · caps pause, never auto-upgrade