Security & ComplianceInfrastructure & Reliability

Infrastructure & Reliability

FormaMail is built on modern, scalable cloud infrastructure designed for reliability.

Cloud Infrastructure

FormaMail uses a multi-provider infrastructure for optimal performance and reliability:

Core Services

ComponentProviderPurpose
API ServersRailwayApplication hosting
DatabaseRailway PostgreSQLPrimary data store
Cache & QueuesRailway RedisSession, caching, job queues
Email DeliveryAWS SESTransactional email sending
File StorageCloudflare R2Attachments, assets, generated files
CDNVercel Edge NetworkStatic asset delivery, frontend hosting
DNSCloudflareDomain management, DDoS protection

Region

ResourceRegionNotes
API & DatabaseUSAll application services
File StorageUSCloudflare R2
Email (SES)us-east-1AWS SES region

Data Residency: Currently, all data is stored in the United States regardless of customer location. EU data residency is on our roadmap for future consideration.

High Availability

Railway Deployment

FormaMail runs on Railway’s managed infrastructure:

  • API Servers: Containerized deployment with automatic restarts
  • Database: Managed PostgreSQL with daily backups
  • Redis: Managed Redis for caching and queues

Auto-Scaling

FormaMail can scale based on demand:

  • API containers: Scale based on traffic
  • Queue workers: Scale based on queue depth
  • Database: Vertical scaling available as needed

Uptime Targets

Availability Goals

MetricTargetNotes
API Availability99.9%Best effort
Email Delivery99.9%Via AWS SES
Dashboard99.5%Via Vercel
⚠️

No SLA: FormaMail does not currently offer Service Level Agreements (SLAs) or uptime credits. The targets above represent our operational goals, not contractual guarantees.

Disaster Recovery

Recovery Objectives

MetricTargetDescription
RTO< 4 hoursRecovery Time Objective
RPO< 24 hoursRecovery Point Objective

Backup Strategy

Database Backups:

  • Daily automated snapshots via Railway
  • Point-in-time recovery available
  • Backup retention as per Railway’s policies

File Backups:

  • Cloudflare R2 durability (99.999999999%)
  • Object versioning available

Recovery Procedures

ScenarioRecovery MethodExpected Time
Container failureAutomatic restart< 1 minute
Database issueRailway failover/restore< 1 hour
Complete failureManual recovery from backups< 4 hours

Security Infrastructure

Network Security

  • HTTPS Only: All traffic encrypted via TLS 1.2+
  • Cloudflare Protection: DDoS mitigation and WAF
  • Railway Isolation: Private networking between services

Incident Response

  1. Detection: Error monitoring and alerts
  2. Triage: Engineering team assessment
  3. Mitigation: Immediate actions to restore service
  4. Communication: Direct customer notification if needed
  5. Resolution: Root cause fix
  6. Post-mortem: Incident review and prevention

No Status Page: FormaMail does not currently have a public status page. For service inquiries, please contact support@formamail.com.

Email Infrastructure

AWS SES Configuration

FormaMail uses AWS SES for reliable email delivery:

  • Shared IP Pool: Standard sending infrastructure
  • Bounce/Complaint Handling: Automatic suppression list updates
  • Feedback Loops: ISP complaint processing

Deliverability

MetricTarget
Delivery Rate> 99%
Bounce Rate< 2%
Complaint Rate< 0.1%

Email Authentication

FormaMail emails are authenticated using:

  • SPF: Sender Policy Framework
  • DKIM: DomainKeys Identified Mail
  • DMARC: Domain-based Message Authentication

Queue Infrastructure

BullMQ + Redis

Email processing uses BullMQ queues backed by Redis:

Queue Configuration:

  • Concurrency: 5 jobs per worker
  • Retry: 3 attempts with exponential backoff
  • Job retention: 7 days (completed), 30 days (failed)

Priorities:

  • HIGH (1): Transactional emails
  • NORMAL (5): Standard sends
  • LOW (10): Bulk emails

Queue Monitoring

Monitor queue health via:

  • Dashboard: Settings → Queue Statistics
  • API: GET /api/emails/queue/stats

Maintenance Windows

Planned Maintenance

Planned maintenance is scheduled during low-traffic periods when possible:

  • Notice: Advance notification when feasible
  • Impact: Usually zero-downtime deployments

Emergency Maintenance

Emergency maintenance for critical security patches:

  • Notice: As much as possible
  • Communication: Direct notification to affected customers

Performance

API Response Times

EndpointTarget P95
POST /api/emails/send< 500ms
GET /api/emails< 200ms
GET /api/templates< 100ms

Email Processing

MetricTarget
Queue to Send< 30 seconds (normal load)
PDF Generation< 10 seconds
Excel Generation< 15 seconds

Network Addresses

API Endpoints

EnvironmentURL
Productionhttps://api.formamail.com

Webhook Source IPs

If you need to whitelist FormaMail’s webhook source IPs, contact support@formamail.com for the current IP range.

IP addresses may change. We recommend using signature verification instead of IP whitelisting when possible.

Compliance Infrastructure

Logging

  • Application Logs: Railway logging (retention varies)
  • Audit Logs: Database storage

Data Residency

RegionStatusNotes
USActiveAll customer data
EUNot availableAll data stored in US
⚠️

EU Customers: Please note that all data, including data from EU customers, is currently stored and processed in the United States. If you have specific data residency requirements, please contact us to discuss your needs.

Questions?

For infrastructure questions, contact: