You operate it. Your clients keep it in-jurisdiction.
An MSP, a regional hoster or a vertical integrator runs OxiMail for end clients who cannot — or do not want to — operate a mail backend themselves. They get a sovereign suite under local law, with a known, trusted operator: you. This is jurisdictional sovereignty with a trusted local operator, not zero-trust — and we say so plainly.
Delegated, not owned. A real operator, at runtime.
When you run OxiMail for a client, you are the operator — and OxiMail decrypts at read for the authenticated user, so you can technically read their mail at runtime. That is the deal everywhere except true self-operation, and it is fine for the vast majority of SMBs, who already trust their MSP with their AD, their backups and their firewall. What it buys the client is jurisdiction and a counterpart they know by name, instead of a hyperscaler tenancy. We never dress this up as "the operator is no one" — that is the owned tier, for an organisation that runs its own metal.
The owned-vs-delegated distinction, in full →Four profiles we know well.
MSPs serving SMBs
You run IT for professional-services firms, fiduciaries, legal practices, medical cabinets — 10 to 100 seats each. OxiMail gives your clients a sovereign mail + calendar + contacts + webmail stack you operate, instead of reselling a hyperscaler seat you do not control.
Regional hosters
You host in one country or region, with local-language support and local-jurisdiction residency. OxiMail is a modern Rust collaboration backend you can offer without handing your customer to a hyperscaler — and one binary to operate, not a six-daemon zoo.
Vertical integrators
Your client base sits in one industry — healthcare, legal, notaries, architecture — with its own compliance and workflows. OxiMail’s JMAP extension model lets you build vertical apps on top of the same sovereign backend.
Software vendors
You ship a SaaS or desktop product that needs a mail / collaboration component. OxiMail embeds as the backend; you keep your UI, your brand, your customer relationship. Commercial licence under a reseller arrangement — talk to us.
Lead with what ships. The sovereign suite is available now.
Everything here runs today, in production, in a single binary — this is the value you sign clients on:
Sovereign mail, calendar, contacts, tasks
JMAP-native (RFC 8620/8621/9610), the modern successor to IMAP, with full SMTP / IMAP / CalDAV / CardDAV for legacy clients.
Workspace webmail
A white-labellable web client your clients’ users actually want to open — mail, calendar, contacts, tasks, chat, one login.
AI assistant on local data
An assistant over the client’s mail, calendar, contacts and tasks — connected provider or a fully local model — that never sends their data off the server you operate.
Anti-spam, DKIM/SPF/DMARC/ARC, encryption at rest
A three-stage spam pipeline, full mail authentication, a per-tenant key hierarchy and passkey sign-in — the operational table stakes, handled.
The file-server arguments depend on Drive. Drive is a pilot, not a product yet.
Three of the strongest sales arguments below depend on Drive — the file-server replacement. Drive is on the roadmap as a pilot in Q3 2026 on Linux and Windows; it is not shipping today. We mark those arguments as roadmap so you never oversell a date to a client. When Drive lands, these become structural wins; until then, lead on the sovereign mail + collaboration value that is live now.
Three arguments that work — with the Drive ones flagged.
The VPN goes away for files
Remote associates stop filing VPN tickets; you stop maintaining the concentrator. This is a structural change, not a workaround — but it depends on Drive.
Ransomware vector eliminated
A compromised workstation cannot enumerate and encrypt an SMB share that no longer exists. A cyber insurer understands this immediately — once files live in Drive rather than a share.
One identity to manage
Mail, calendar, contacts and webmail collapse into one OxiMail account. One revocation when someone leaves, one provisioning when someone joins. This is available today — Drive widens it to files later.
A 20-seat professional-services firm.
- Microsoft 365 Business per seat
- Windows Server + Active Directory on-prem
- A NAS for file sharing (Synology-class)
- A VPN for remote access
- Ongoing MSP hours to keep the stack aligned
- OxiMail on a single VPS or bare-metal host, operated by you
- Workspace webmail replaces the daily Office apps
- Single identity across mail, calendar, contacts, webmail — today
- Drive replaces the NAS and the VPN for files — when it ships (Q3 2026 pilot)
- You, the MSP, as the single sovereign operational contact
Cost reductions for a firm like this are real, but the largest line items — collapsing the NAS and the VPN — are target-state numbers that depend on Drive (pilot Q3 2026). The value available today is sovereign mail + calendar + contacts + webmail under one operator, one identity, one support contract. We do not anchor a hard ROI percentage on a feature that has not shipped.
Two products, a clear line.
Community ships distribution groups — fan-out aliases suitable for internal team addresses, LDAP-integrated, greylist-aware. Pro adds managed mailing lists for the cases that justify commercial tooling: moderation, searchable archives, digest mode, DMARC-friendly ARC signing, bounce auto-unsubscribe, policy-bounded external subscribers. Your clients get distribution groups out of the box; those who grow into list-management needs pick up the managed-lists module.
Partner pricing — talk to us.
The public per-seat grid is being reworked, so we are not printing numbers here that we would have to walk back. Partner pricing is a scoped conversation against your client base, your tier and the components you resell. The pricing page carries the current framing.
See pricing →Tell us about your practice.
Geographic zone, client-base size, industry focus, current stack. We respond within two business days with a proposed partner arrangement and the next steps.