Field 07 — Postage
Every tier cleans and sanitizes every message, and runs a deterministic injection check that is not billed. The model injection scan and schema extraction are what a plan counts. The price is that comprehension, not how many inboxes you rent.
Four things a raw inbox hands your agent as-is — here they're the product
Flagged mail is delivered deterministic-only — never as trusted content. Fail-closed.
Hidden text, zero-width characters, and homoglyphs stripped. Every removal logged.
Your JSON Schema in; typed fields and a confidence score out.
Your agent blocks for the reply instead of polling the inbox.
Launch offer Early-stage team? Email agent-hello@mail.postfleet.ai and mention this offer. If we confirm it in the reply, the first month of Scale ($200) is free. It does not apply to Free, Starter, or Pro, and it is not applied at checkout. The same words are on the terms.
Try it. No card.
Screened mail, small scale.
For a developer shipping agents.
For a team running agents in production.
Deterministic sanitization and the deterministic injection check run on every message and are not metered. The model injection scan and schema extraction share the monthly monthly limit. Past that limit, your agent still gets the cleaned text, and the deterministic injection check still runs.
Two guarantees behind it
Go Pro risk-free. If Postfleet isn't comprehending your mail the way you need within 30 days, email us — full refund, no questions.
If a message we flag as a prompt-injection risk is ever delivered to your agent as trusted, comprehended content, that month is on us. The pipeline fails closed by design — this stands behind it. The red-team results and the gate that produces the flag are both published.
Questions
An inbound message that runs the model stage: a prompt-injection scan, then extraction to your JSON schema with a classification and a confidence score. That pair counts as one comprehended message. Deterministic sanitization and the deterministic injection check run on every message and do not count against this.
Schema extraction and the model injection scan pause until next month or an upgrade. Deterministic sanitization and the deterministic injection check keep running, so your agent still receives cleaned text that passed that check. It is not the model scan.
Hidden-content sanitization is deterministic and free on every message, including after you hit the monthly limit. The deterministic injection check is free too. The model injection scan is part of a comprehended message, so it pauses with extraction when the limit is used up. You are not billed a separate safety fee.
If a message we flag as a prompt-injection risk is ever delivered to your agent as trusted, comprehended content, that month is on us. It covers our fail-closed gate holding — not a promise to catch every conceivable injection. Flagged mail is delivered deterministic-only by design.
No. Your mail is processed only to comprehend it for you, and our model provider does not train on API traffic. The privacy page is the public note. A data processing agreement, including the named providers, is available on request from that page.
Same. The hosted MCP endpoint and npx @postfleet/mcp use the same pf_ key and draw from the same plan limits. Pick whichever fits your setup.
Cancel anytime from the dashboard. Pro is backed by a 30-day money-back guarantee, so you can try it risk-free.