You operate it. Your clients keep it in-jurisdiction.
An MSP, a regional hoster or a vertical integrator runs OxiMail for end clients who cannot — or do not want to — operate a mail backend themselves. They get a sovereign suite under local law, with a known, trusted operator: you. This is jurisdictional sovereignty with a trusted local operator, not zero-trust — and we say so plainly.
Delegated, not owned. A real operator, at runtime.
When you run OxiMail for a client, you are the operator — and OxiMail decrypts at read for the authenticated user, so you can technically read their mail at runtime. That is the deal everywhere except true self-operation, and it is fine for the vast majority of SMBs, who already trust their MSP with their AD, their backups and their firewall. What it buys the client is jurisdiction and a counterpart they know by name, instead of a hyperscaler tenancy. We never dress this up as "the operator is no one" — that is the owned tier, for an organisation that runs its own metal.
The owned-vs-delegated distinction, in full →Four profiles we know well.
MSPs serving SMBs
You run IT for professional-services firms, fiduciaries, legal practices, medical cabinets — 10 to 100 seats each. OxiMail gives your clients a sovereign mail + calendar + contacts + webmail stack you operate, instead of reselling a hyperscaler seat you do not control.
Regional hosters
You host in one country or region, with local-language support and local-jurisdiction residency. OxiMail is a modern Rust collaboration backend you can offer without handing your customer to a hyperscaler — and one binary to operate, not a six-daemon zoo.
Vertical integrators
Your client base sits in one industry — healthcare, legal, notaries, architecture — with its own compliance and workflows. OxiMail’s JMAP extension model lets you build vertical apps on top of the same sovereign backend.
Software vendors
You ship a SaaS or desktop product that needs a mail / collaboration component. OxiMail embeds as the backend; you keep your UI, your brand, your customer relationship. Commercial licence under a reseller arrangement — talk to us.
Lead with what ships. The sovereign suite is available now.
Everything here runs today, in production, in a single binary — this is the value you sign clients on:
Sovereign mail, calendar, contacts, tasks
JMAP-native (RFC 8620/8621/9610), the modern successor to IMAP, with full SMTP / IMAP / CalDAV / CardDAV for legacy clients.
Workspace webmail
A white-labellable web client your clients’ users actually want to open — mail, calendar, contacts, tasks, chat, one login.
AI assistant on local data
An assistant over the client’s mail, calendar, contacts and tasks — connected provider or a fully local model — that never sends their data off the server you operate.
Anti-spam, DKIM/SPF/DMARC/ARC, encryption at rest
A three-stage spam pipeline, full mail authentication, a per-tenant key hierarchy and passkey sign-in — the operational table stakes, handled.
Drive replaces the file server today. Only the remote mount is still missing.
Drive now serves the office file share over SMB, and the same files open in the browser and in Sync from anywhere. One argument still depends on work in progress: the native mount over HTTPS from outside the office, which is what would retire the VPN for files. We flag it below so you never promise a client a date we have not committed to. Everything else on this page is live now.
Three arguments that work — with the unfinished one flagged.
One box instead of two
The NAS in the cupboard goes away. The file share is served by the machine that already runs the mail, so your client stops paying for a second appliance with its own firmware, its own patch cycle and its own end-of-life — and you stop maintaining it.
One identity to manage
Mail, calendar, contacts, webmail and now files collapse into one OxiMail account. One revocation when someone leaves, one provisioning when someone joins, one place to look when someone asks who can read what.
The VPN goes away for files
Remote associates stop filing VPN tickets; you stop maintaining the concentrator. This is a structural change rather than a workaround, and it needs the native remote mount, which is still in development. Today, working away from the office goes through the browser or the Sync agent.
A 20-seat professional-services firm.
- Microsoft 365 Business per seat
- Windows Server + Active Directory on-prem
- A NAS for file sharing (Synology-class)
- A VPN for remote access
- Ongoing MSP hours to keep the stack aligned
- OxiMail on a single VPS or bare-metal host, operated by you
- Workspace webmail replaces the daily Office apps
- Single identity across mail, calendar, contacts, webmail and files — today
- Drive replaces the NAS today; the VPN goes once the remote mount ships
- You, the MSP, as the single sovereign operational contact
Cost reductions for a firm like this are real. Retiring the NAS is available today. Retiring the VPN is not: it waits on the remote native mount, so treat it as a target rather than a saving you can book. The value available today is sovereign mail, calendar, contacts, webmail and files under one operator, one identity, one support contract. We do not anchor a hard ROI percentage on a feature that has not shipped.
Two products, a clear line.
The server ships distribution groups — fan-out aliases suitable for internal team addresses, LDAP-integrated. A separate module, in development, adds managed mailing lists for the cases that justify commercial tooling: moderation, searchable archives, digest mode, DMARC-friendly ARC signing, bounce auto-unsubscribe, policy-bounded external subscribers. Your clients get distribution groups out of the box; those who grow into list-management needs pick up the managed-lists module.
Partner pricing — talk to us.
The public per-seat grid is being reworked, so we are not printing numbers here that we would have to walk back. Partner pricing is a scoped conversation against your client base, your tier and the components you resell. The pricing page carries the current framing.
See pricing →Tell us about your practice.
Geographic zone, client-base size, industry focus, current stack. We respond within two business days with a proposed partner arrangement and the next steps.