The backbone behind everything we run.
SPINE is the platform that carries Max Systems: self-hosted mail, SSL, DNS, bots and a single API - one spine connecting every service we build on.
Twelve services, one backbone.
Every capability below runs on the same platform, shares the same identity, and is reachable through one API. Built once, for every project we own.
Self-hosted mail for our own domains: verified DKIM, catch-all, aliases, anti-spam. A letter sent to a mistyped address gets a polite automatic reply: there is no such mailbox, here is where to write instead. Only real people get that reply, never mailing lists, robots or bounce reports, and one address hears from us at most once a day. Amazon SES relay, open and click tracking on your own domain with the country and city resolved by the platform, so a project needs no geo database of its own, one-click unsubscribe, mailing lists with double opt-in and a subscription centre on the client domain. Suppression is split the way a payment platform needs it: a complaint or an unsubscribe belongs to one merchant and one stream, so a receipt still reaches someone who left the newsletter, while a dead mailbox stays blocked everywhere. Attachments both ways, scanned by antivirus, with per-project limits. White-label right down to the client's brand and MX. Shared mailboxes a team works from, each under their own login. Migration from another host over IMAP, folders and dates intact, with catch-up runs after the MX switch. For Google Workspace and Microsoft 365 access is granted once for the whole organisation, after that only the list of mailboxes is needed: 297k messages moved in a day, zero downtime.
Stalwart · SES relay · tracking + antivirusWebmail
A full webmail client on webmail.<domain> - themes, signatures, server-side rules, contacts. Paged lists that handle a 44,000-message mailbox, drafts that autosave, drag-and-drop attachments, priority flags and scheduled send that runs on our server, not in the browser. Embed it in any app with a one-time SSO link. One employee login shows all of their mailboxes across every domain, grouped by domain.
White-label · SSO embedCertificates & PKI
Public TLS certificates now live 199 days, and 47 from 2029. We make that stop being your problem. The private key is reused on renewal, so the SPKI pin your partners embedded never changes. Our own ACME server with EAB lets certbot, acme.sh, cert-manager, Caddy, Traefik, FortiGate and Cisco ASA renew themselves. A private CA issues for up to 10 years, plus mTLS client certificates, for partner channels that never touch a browser. CNAME delegation covers domains whose DNS we do not run, and a watchdog checks every hour that the live host really serves the fresh certificate.
ACME server · private CA · stable pinsDNS
Managed zones across DigitalOcean, Cloudflare and GoDaddy from one place - records, provider detection, and domains as a product. Registration dates for every domain in one list, pulled from the registries, with renewal warnings at 40, 30, 15, 5 and 1 day, and thresholds you set yourself. Where a zone has no machine-readable source at all, the date is entered by hand and counts the same.
Multi-provider · expiry watchTelegram
Create and manage bots at scale - presets applied on creation, token rotation, and webhook routing to each project.
Bot factoryPublic API
One key, 32 scopes. Send mail in batches with attachments, issue certs, manage DNS, read secrets, subscribe to webhooks: HMAC-signed events, durable retries, and subscriptions you can edit without changing the signing secret. Reading mail is built for other systems: page through a mailbox of any size, fetch a message by its Message-ID, or take the whole message as a raw .eml and parse it yourself.
spine_sk_ · 32 scopesReseller & Billing
Sell the platform under a client's brand: their domains, their webmail, flexible tariffs, subscriptions and invoices.
White-labelSecrets vault
Projects store their keys, passwords and tokens with us - encrypted (AES-256-GCM), with environments, versioning, rotation and one-time lease links.
Encrypted · scopedSite & SEO
One config, ready artifacts: robots.txt, sitemap, a full <head>, verification files, plus a branded OG image and favicons generated from the brand kit.
Ready artifactsClients, Projects & Audit
Every project as one card - domains, certs, keys, bots, brand, billing in one place - plus an append-only audit of who changed what, and when.
Single source of truthDomain protection
A switch on the domain card, not a separate product to buy. Rate limits on average and burst, allow and deny lists down to whole subnets, country rules resolved by the platform's own database, and a lockdown mode where only known addresses get through. Turnstile verification for forms is proxied by us, so the secret never leaves the platform. Every refusal is logged with a reason in plain words. If the platform cannot decide, the visitor passes: protection sits on top of a client site, it is not a condition of it working.
Per-domain switch · fail-openVerification
One-time codes over SMS and Telegram, plus an authenticator app with backup codes. A project stops writing its own: one call sends the code, another checks it. Codes are stored as fingerprints only and never leave the platform, except to the person they are for. Limits run on four axes at once - number, project, caller address and key - because a limit on one is walked around with a list of numbers. A sandbox key returns the code instead of spending money, and the delivery status comes from the operator, so support can tell "never arrived" from "typed it wrong".
SMS · Telegram · TOTPExternal projects talk to one API.
Authenticate with a scoped spine_sk_ key. Incoming mail arrives as signed mail.received webhooks - with the folder, fraud signals, RFC threading and an internal-delivery flag. Exactly one event per message. Replies your staff send from webmail come as mail.sent_folder. A CRM embeds our branded webmail with a 60-second SSO link. No second login.
Every service, in production.
HTTPS everywhere, valid certificates, one identity across the platform. Data and mail back up every night, and restoring from those copies has been tested.