Postmark Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Postmark

1. 1

   Request Postmark's SOC 1 Type II report and any available SOC 2 Type II report — email their security team via https://postmarkapp.com/contact or check their trust page at https://postmarkapp.com/security. Many vendors provide these under NDA. If a SOC 2 Type II report exists, prioritize reviewing the availability, change management, and logical access control sections.

   SOC 2 Overview (AICPA)How to Find Vendor Trust Pages
2. 2

   Request a signed GDPR Data Processing Agreement (DPA) and subprocessor list from Postmark before transmitting any EU consumer data — initiate this request via their privacy contact at https://postmarkapp.com/privacy. This is a legal requirement under GDPR Article 28 and should be completed within 30 days.

   GDPR Full TextDPA Template (GDPR Art. 28)
3. 3

   For PCI-DSS 4.0 Requirement 12.8 compliance, add Postmark to your TPSP register and document: (a) what PCI controls Postmark manages vs. your organization, (b) whether email content or delivery logs could contain or reference cardholder data, and (c) request Postmark's PCI-DSS AOC if they handle or transmit any payment-adjacent data.

   PCI DSS Standards
4. 4

   Verify the scope of Postmark's CCPA service provider agreement — review their privacy page at https://postmarkapp.com/privacy and confirm that a written service provider agreement exists that prohibits Postmark from selling or sharing consumer personal information for its own commercial purposes, as required under CPRA.

   CCPA Overview (CA AG)
5. 5

   Remediate the two missing HTTP security headers (Content-Security-Policy and X-Frame-Options) identified on postmarkapp.com — raise this with Postmark's technical team as a low-priority security hygiene item, and request their timeline for addressing the C- HTTP security scanner score. For your own integration, ensure your email rendering environment does not depend on postmarkapp.com iFrame embedding.

   Check Security HeadersCSP Reference (MDN)
6. 6

   Conduct a targeted review of the September 2025 'postmark-mcp' npm package incident documented in tech community sources — while this incident involved a malicious third-party npm package impersonating Postmark (not a breach of Postmark's own systems), confirm with your development team that no one installed the fraudulent 'postmark-mcp' npm package. Review your npm dependency audit logs for any reference to this package.

• Deep SSL/TLS protocol and cipher suite analysis was not available at the time of this assessment; the basic SSL certificate check confirmed a valid Google Trust Services certificate expiring May 28, 2026, but cipher-level configuration (e.g., TLS 1.0/1.1 deprecation, weak cipher suite exclusion) could not be assessed.
• Web archive history data was unavailable from supplementary sources; domain establishment is corroborated by WHOIS registration data (2009) and threat intelligence engine creation date, but full historical web presence analysis could not be completed.
• External cyber risk scoring was not available for this assessment; the clean threat intelligence signals from other sources provide partial coverage, but a quantitative external security rating could not be included.
• Postmark's parent company or corporate ownership structure was not confirmed through available firmographic data sources; the organizational context for Postmark (which operates under ActiveCampaign / Wildbit ownership history) could not be independently verified and is therefore not referenced in this report.
• No subprocessor list was publicly available, preventing supply chain risk assessment of Postmark's downstream data processors.