The federation · vision
When two OxiMail meet, the old mail disappears.
Email was designed in 1982, for a world without malice. SMTP — the protocol every message still rides — has no idea who is really sending, and protects nothing on the way. Everything we've bolted on since (SPF, DKIM, DMARC, spam filters, anti-spoofing) is decades of patches over one original flaw: mail was never built to know identity or keep a secret. Between two OxiMail servers, we don't patch that. We remove it.
No SMTP between nodes
They speak JMAP, end to end.
When two OxiMail organisations exchange, they speak JMAP end to end. Identity isn't a claim made at the moment of the message, the way SMTP works: it is established before any message, in a ceremony where two administrators compare a fingerprint out of band and each server pins the other's identity. Nobody outside admits, certifies or excludes a node. That is what removes spam rather than filtering it — an unknown sender has no path at all. Confidentiality is there by construction, not bolted on. No clear-text relay handed between strangers. It is, simply, what mail would be if it were invented today. The price is deliberate: you don't discover a colleague you have never contacted; you pair with an institution you already know.
The intermediaries become unnecessary
We take the intermediary out of the pipe. We keep it as a witness.
Whole sectors run expensive, painful intermediaries to bolt identity and encryption onto a protocol that has neither. In Swiss healthcare it's called HIN. Lawyers, notaries, administrations each have their own. They all sell the same thing first: a secured transport grafted onto legacy email, decrypted at the recipient's gateway — a patch over SMTP's original defect, for one industry. Between two paired OxiMail nodes that transport isn't required; to the rest of the world you still speak clean, standards-compliant mail. What we do not replace is the other thing such intermediaries do: verifying, under a regulated method, that a person is the practitioner they claim to be. Redoing that would cost a fortune to reach the same result with less legitimacy. So the federation consumes those attestations — a HIN identity, a professional register, a national electronic ID — and never issues its own. The third party leaves the pipe; it stays as a witness.
The graph of confidential exchange
Not a market we conquer. A substrate that spreads.
You don't need everyone to join. Two nodes already make a complete, sovereign link — full value, no waiting for critical mass. And every node that joins doesn't just gain for itself: it makes every other node it can reach a little more sovereign.
Medicine is only the first sub-graph. The lawyer who writes to the notary, who writes to the fiduciary, who writes to the bank; the lab that writes to the practice, the pharmacy, the hospital — this whole web of professionals who must pass secrets and can't do it cleanly today. Put them on one federation and the entire graph of confidential professional exchange becomes sovereign. Not a market we conquer. A substrate that spreads.
Orange = a federated OxiMail ↔ OxiMail link. The sovereign sub-graph spreads one link at a time.