Replace M365 and Google by owning your collaboration backend — not renting another cloud.

The mandated body that can move fast — and the integrator who serves it.

This is not the 50,000-seat ministry RFP. It is the mandated body of 200 to 3,000 seats that has a sovereignty motion and the authority to act on it within a budget cycle.

• Communes & regional departmentsA cantonal or regional administration, or a commune, with a sovereignty mandate and a reachable IT decision-maker. 200 to 3,000 seats, identity already in LDAP or AD.
• Public hospital pilotsA clinical site or health network running a sovereign-collaboration pilot. A verified encrypted disk and a single compliance boundary matter from day one; the audit trail and the data-access log are there from the first day too.
• University faculties & public agenciesA faculty, a research institute or a public agency with federated identity (SWITCHaai and similar) and a strong data-sovereignty position. Fast-moving, often ahead of the central IT cycle.
• Regional health networks & large institutionsA regional health network or a larger institution with an internal DSI. You can own and operate it directly — the binary, the keys and the data stay yours.
• Integrators & system integratorsYou serve these bodies. OxiMail is the sovereign collaboration backend you deploy, harden and hand over — the operator stays your client, the result stays sovereign.

Own it yourself. If you lack mail-ops capacity, we deploy it and hand it over.

The recommendation is simple: own the backend. If your team already runs infrastructure, you install the binary, wire identity and operate it — total sovereignty, no third party in the loop. If you have the mandate but not the mail-ops capacity, our deployment service installs OxiMail on your metal, migrates your mailboxes, hardens the host and trains your team, then steps back. Either way the keys, the data and the operation end up in your hands. The integrator is not the operator — sovereignty stays intact.

A sovereignty and control posture, in one binary.

The value is control. Everything below runs today, in production, in one binary, under one compliance boundary you own:

• Mail, calendar, contacts, tasksJMAP-native (RFC 8620/8621/9610), the modern successor to IMAP — push, mobile, a clean API, all under one login.
• Collaborative files & chatShared files and team chat in the same Workspace web client your users actually open. One interface, one identity, no separate silo to govern.
• Workspace web clientA webmail your people want to use — mail, calendar, contacts, tasks, files and chat in a single integrated interface.
• Verified disk encryption + passkeysEncryption at rest is the volume’s, and the installer refuses a plaintext data volume without explicit consent. Secrets sit under a per-tenant key hierarchy that never leaves your infrastructure. Phishing-resistant passkey sign-in for staff.
• SMTP, IMAP, CalDAV, CardDAVFull legacy-protocol support with DKIM / SPF / DMARC / ARC, a multi-stage spam pipeline and server-side filtering — your existing clients keep working.
• Identity syncLDAP, Active Directory and SWITCHaai-style federated identity, with per-tenant configuration for multi-department or multi-campus deployments.

A word on economics

Mail, calendar, contacts, tasks, files and chat for a few hundred to a few thousand seats: owning the backend replaces per-seat hyperscaler licensing with your own infrastructure plus, if you choose them, a licence for the Pro components. Drive replaces the file server on the office network as well, which retires a second appliance and its support contract. What you buy is sovereignty and control; the savings follow from the seats and the appliances you stop paying for.

Built for regulated environments.

• Encryption at rest, measured — the disk under each instance is encrypted, the installer measures it and refuses a plaintext volume without your explicit consent, and a supervision gauge reports the state it measures rather than the one it was told. Secrets — application passwords, provider keys, node identity — sit under a per-tenant key hierarchy that never leaves your infrastructure. The server holds content in clear at runtime, which is what lets search, server-side rules and legacy clients work; the threat model is your server, your root, no third-party root.
• Fail-loud integrity. OxiMail never silently drops messages, swallows errors or ignores invalid identifiers. Every failure surfaces in logs with structured context — the property regulated environments actually need.
• Passkey authentication for phishing-resistant staff sign-in, with the full legacy-protocol surface still available for existing clients.
• Audit trail and data-access log — a hash-chained, tamper-evident audit log per tenant and per account, verified and attested from the command line and checked by the server’s own rounds; an opt-in data-access log that answers “who read this person’s data, and when” for access by a third party, including what confidentiality withheld; retention chosen by the administrator.
• Legal hold and archive — a legal hold freezes an account’s mail against any destruction, audited and asymmetric to lift; erasure requests against a held account are refused with the reason, and the refusal itself is recorded. Long-term sealed retention of mail and audit events is the part still to come.
• Distribution groups & managed mailing lists — the server covers internal distribution groups; a separate module adds moderation, archives, DMARC-friendly ARC signing and external-subscriber management for corporate-grade list management.