Questions about owned messaging, answered.

Supromail is a self-hostable messaging platform for sending email, SMS, WhatsApp, and Telegram from infrastructure you own: verified domains, Android phones, linked WhatsApp numbers, and Telegram bots.

It means your sending identity and routes belong to you. Email uses your domains and relay, SMS uses your phones and SIMs, WhatsApp uses your linked numbers, and Telegram uses your bots.

No. Channels are enabled per workspace. You can turn on only Email, only SMS, or any combination of Email, SMS, WhatsApp, and Telegram.

Supromail uses passwordless login. You enter an email address, receive a 6-digit code, and sign in with that code. New email addresses are created automatically on first sign-in.

A workspace is your organization container. Domains, phones, linked numbers, bots, messages, API keys, members, roles, and logs all belong to one workspace.

Yes. Add a domain, publish the ownership and DKIM DNS records Supromail gives you, then verify the domain before sending.

Verification needs both the ownership TXT record and the DKIM TXT record to be live. Check the host names exactly, including the DKIM selector, and allow time for DNS propagation.

Supromail adds the recipient to your workspace suppression list, records the event, and sends subscribed webhooks such as `email.bounced` or `email.complained`.

Not yet. Supromail currently handles outbound email plus bounce and complaint feedback. Do not point MX records at it for inbound mail.

Email is delivered through the outbound relay you configure, such as Postmark or your own MTA. Relay costs and reputation are separate from Supromail.

Yes. Pair Android devices with Supromail and they become secure SMS gateways for your workspace, using your SIMs and carrier plans.

`delivered` requires a carrier delivery receipt, and many carriers never send one. `sent` means the phone handed the message to the carrier successfully.

Rule-routing may not be enabled, no rule may have matched, or the matching phone may have been offline. Use Test route and message history to inspect the routing decision.

A strict rule refuses fallback. If it matches a number but no allowed phone is available, the message waits for that rule's phones instead of falling back to auto-routing.

Yes. If a phone goes offline, fails a send, or does not acknowledge an assignment, Supromail can re-route the message to another eligible phone.

No. SMS goes through your phones and SIMs, so you pay your carrier directly. Supromail does not add a per-message SMS platform markup.

Supromail links your WhatsApp number with a QR flow like WhatsApp Web and sends through that linked number. This arm is early access.

Fresh deployments keep live WhatsApp dialing off with `WA_LIVE_DIAL=false`. Ask your operator whether that gate has been enabled, then scan the QR promptly because it refreshes about every 20 seconds.

Yes. WhatsApp does not officially sanction this style of automated companion-device sending. Use numbers you can afford to lose, message people who expect it, and ramp volume slowly.

Yes. WhatsApp receipts can advance message state from sent to delivered to read when the platform provides those receipts.

Telegram messages are sent through your own Telegram bot using the official Bot API. You create the bot with BotFather and register its token in Supromail.

Your bot can only message chats that opted in. A user must press Start, the bot must be in the group, or the bot must be an admin of the channel before you send.

Use your bot's inbound traffic. Have the user message the bot, call Telegram's `getUpdates`, and read the numeric `chat.id`; public channels can also use `@channelusername`.

No. Telegram's Bot API only confirms that Telegram accepted the message, so `sent` is the final success state.

Yes. Supromail exposes REST APIs with predictable JSON, bearer API keys, scoped permissions, delivery logs, and signed webhooks.

API keys are shown once and stored only as hashes. Revoke the lost key and create a new one.

Hash the raw body bytes, not re-serialized JSON, and verify the signed string made from the timestamp and body. During a rotation window, accept either valid signature.

Yes. If your endpoint does not return a 2xx response or is unreachable, Supromail retries on a schedule before marking the delivery failed.

Include an `idempotency_key` when retrying an SMS API request. Supromail returns the original message instead of creating a duplicate send.

Data is scoped to workspaces, and the documented backend model uses Postgres Row-Level Security with a non-superuser runtime role to keep one workspace from reading another's data.

DKIM private keys, webhook signing secrets, Telegram bot tokens, and WhatsApp session cryptographic state are sealed at rest with AES-256-GCM using the deployment master key.

The dialable SMS number is stored only while a message is in flight. At final status, Supromail keeps only a masked number and non-reversible hash for history and abuse controls.

Access is revoked within one short token lifetime because login tokens are stateless and short-lived. Deleted logins are denylisted immediately so lingering tokens cannot recreate an account.

Yes. Supromail can run on your own Linux host with Docker, Postgres, Keycloak, workers for the enabled channels, and an HTTPS reverse proxy.

Carrier plans, SIMs, Android phones, email relay fees, DNS, hosting, backups, and cloud infrastructure are billed by the providers you choose.

No. Defaults are safety ceilings for abuse containment, such as request limits, SMS quotas, per-recipient caps, duplicate-collapse windows, and blocked premium prefixes.

Customers can open a support ticket from the dashboard. Operators can also check the deployment documentation for infrastructure-specific runbooks.