Built by people who hate bad forms.
Postbox started with a simple observation: the way we collect structured data on the web hasn't fundamentally changed in 30 years. We're fixing that.
The word "form" does something funny to your brain.
You hear it and you see fields to fill in, a button to press. That's been the shape of it since the web first became interactive — and it works fine for humans. But agents hate forms. Especially the ones that ask for one field at a time, and the platforms that charge you to put your own logo on them. We hated them too.
So we wondered if we could do it better. And then we realised we'd had it all wrong — or been made to have it all wrong. A form isn't a UI with fields and a button. A form is a contract. The schema is the intent. The URL is the interface. That's all an agent needs. Humans get it too, because the contract doesn't care who's holding it.
Postbox is for both of them. For the developer who wants an endpoint that validates, filters, translates, and routes without writing the boilerplate. For the product manager who wants to see submissions without exporting CSVs. For the support team who wants smart replies without training a model. For the agent who wants to create a form, collect data, and report back — all in one conversation.
We didn't set out to build another form builder. We set out to make structured data collection invisible. To turn the part every team rebuilds from scratch into infrastructure that just works. To make the boundary between "your data" and "your AI" disappear entirely.
Principles that shape every decision.
Contracts over UIs
The schema is the source of truth. The UI is just one of many possible consumers. When you design for the contract first, every client — browser, mobile app, agent, webhook — gets the same guarantees.
Agents are first-class
MCP servers and skills aren't bolt-on features. They're core to how Postbox works. Your agent should be able to create forms, read submissions, and draft replies as naturally as you do.
Security by default
Tenant isolation, encrypted transport, HMAC-signed webhooks, idempotent endpoints, and proactive security audits. Safety isn't a feature you toggle on. It's the foundation everything else sits on.
Infrastructure, not software
You don't maintain Postbox. We do. Scalability, reliability, and security are our problems, not yours. You focus on what your data means. We focus on making sure it gets to you clean, fast, and safe.
Small team. Big ambition.
Postbox is built by Variant Systems, a small group of engineers and designers who believe the agentic web needs better infrastructure. We've spent years building APIs, developer tools, and data platforms — and we kept running into the same problem. Every project needed forms. Every form needed validation, spam filtering, routing, and analytics. And every time, someone had to build it from scratch.
We're based across time zones, work asynchronously, and ship continuously. Our stack is Elixir and Phoenix on the backend, Tailwind and HEEx on the frontend, and a lot of coffee in between. We run internal security audits quarterly, publish the results, and fix everything we find.
Where to find us
Security is a process, not a checkbox.
We run internal security audits quarterly. Our April 2026 audit found zero critical issues. We publish summaries of what we found and what we fixed. If you need details for your own security review, email us — we'll share everything that isn't covered by responsible disclosure.
Read the latest audit →Want to see what we're building? Try it.
Start free. No credit card. No time limit. Build your first form in under a minute, or ask your agent to do it for you.