Platform dossier · updated 17 Oct 2026
Mautic: marketing operations require an operator.
Mautic is the platform-layer option for self-hosted contact, form, segment, campaign, and email operations. It is conditional on operating the database, transport, scheduler or workers, credentials, access, monitoring, and recovery.
What the checked sources support
Declared source boundary.
The 7.2.1 composer metadata declares GPL-3.0. That applies to the checked repository package, not every separately installed plugin, transport, provider, queue, CRM, or hosted service.
Documented application surface.
7.2 documentation covers forms, contacts, preferences/DNC, segments, campaigns, transport, queues, cron, webhooks, roles, and reports. A documented feature is not evidence of a live deployment or a policy enforcement result.
Form-to-contact handoff
The 17 October audit starts with the existing landing-page form and CRM route. A durable form-submission ID, captured source and notice/preference state, destination CRM ID, and repairable exception are the minimum reconciliation record. Mautic 7.2 documentation describes form results and associated contact IDs; its POST and plugin actions do not prove a CRM write, idempotent retry or destination receipt. No connector was run. Keep promotional eligibility separate from an inquiry.
Campaign execution boundary
Campaign membership and events require the documented campaign cron commands. If an email queue is configured, a consumer must process it. Mail transport configuration also needs a provider and sender. A campaign UI, DNC field, queue setting, role, or active switch does not establish that delivery is approved, compliant, deliverable, monitored, or recoverable.
The documentation describes granular roles and DNC/preference controls, but this audit did not establish immutable consent, all-channel suppression, a two-person approval gate, least privilege in a deployment, or a live-send result.
Conditional decision
One welcome and occasional newsletter? This alone does not justify Mautic's wider campaign surface. The 29 September small-list audit compares an existing sender, Listmonk, and Keila. Keila is only a private-evaluation candidate; neither smaller tool is added to the vetted four-layer shortlist.
Safe first evaluation: use an isolated local environment and fictional data only. Do not configure production credentials, real transport, external actions, tracking, public webhooks, or unattended cron/workers. Keep any form or campaign non-public and inactive; stop before an external call.
Maintenance and open evidence
The 7.2.1 release record was labelled Latest at the audit date. The security page documents a reporting scope and route. These are maintenance signals, not proof that a selected deployment is supported, patched, secure, or ready for production.
Open evidence includes the current 7.2 runtime/database matrix, retention and audit-log semantics, consent and suppression behavior across systems, approval controls, secret management, connector scopes, reconciliation/rollback, deliverability/performance, and real deployment backup/restore status.
Read the 26 September Mautic campaign-operation boundary audit · Back to the research library · Back to comparison
For the separate draft → approval → optional action responsibilities, read the 28 Sep cross-layer handoff synthesis. It is not a tested integration or a recommendation to connect these products.