Sovereignty you own, not rent.

An operator can be pressured. A datacenter location cannot fix that.

The question is never only “where are the bytes.” It is “who can be compelled to act against you.” Any operator — Swiss, French, German — is a company that can receive a subpoena, a sanctions order, a gag request, a government instruction. In 2025 a sitting prosecutor at an international court had his email account cut off after foreign sanctions reached his provider. Data residency did not protect him; the provider did what it was compelled to do. As long as a third party operates your mail, your continuity of service is their decision, not yours.

The operator can be no one but you.

OxiMail is a single Rust binary you run on your own infrastructure. No US dependency in the stack. The encryption keys are wrapped with your own tenant master key and never leave your machine. When you operate it yourself, there is no third party to subpoena, to sanction, to pressure — because there is no third party at all. This is the one thing a “sovereign cloud” can never offer, by construction: their model requires an operator. Ours does not.

Owned or delegated — and we never blur the two.

Total sovereignty requires that you be the operator. If a trusted local partner runs it for you, you gain jurisdiction and a known counterpart, but you are trusting that partner at runtime. Both are legitimate. We tell you exactly which one you are buying.

Your server, your root — not an end-to-end gas factory.

Encryption at rest is the disk’s. The volume under each OxiMail instance is encrypted, by you, and the product measures it: the installer refuses to set up on a plaintext data volume unless you consent explicitly, and a supervision gauge reports the state it finds rather than the one it was told. We used to encrypt content a second time inside the application and stopped, deliberately: it cost every request between six and twenty times over, it created a “key lost, data lost” failure mode of its own, and it protected against nobody the disk does not already protect against. The server holds content in clear at runtime — that is what lets search, server-side rules, the AI assistant and IMAP/CalDAV clients all work. The consequence, stated plainly: whoever has root on the server can read mail. So “the operator is no one” is true precisely when you are the operator — which is the entire point.

We do not chase Proton-style end-to-end-everywhere. On a server you control, it breaks half the product — no server-side search, no assistant, no shared calendaring — for a benefit that evaporates the moment the box is yours. The threat model is “own your infrastructure,” not “distrust your own administrators.” If you cannot trust the people who run your server, encryption is not the problem you need to solve first.

What we do take seriously is the traffic in flight and the keys themselves. Every port we serve negotiates a post-quantum key exchange, because an adversary can record encrypted traffic today and decrypt it years from now — that is a deadline you cannot meet retroactively. OpenSSL is gone from the binary entirely, so the TLS stack is memory-safe Rust. The root key still exists, for the secrets that are worth something off the box — application passwords, AI-provider keys, the node’s federation identity — and it can be escrowed off the machine, in a form you write down and store where you choose: we have restored an instance from scratch on new hardware to prove that it works, rather than assuming it. Losing it now costs re-provisioned secrets, never your data.

Your AI assistant follows the same rule.

Microsoft Copilot and Google read your mail in their cloud — there is no other setting. OxiMail’s assistant lets you choose where it runs, and the choice is the same own-vs-rent line. For a sovereign deployment the default is a local model: it reads your mail on your own hardware and nothing leaves the box. On a modest GPU box, a self-hosted model holds its own against a managed sovereign AI for everyday mail, calendar and tasks — with no third party at all. We deliver that box turnkey through Services — it runs your assistant and trains your per-tenant models, with no third party and no per-token cloud bill.

The mandate is here — and the migration has already started.

Public bodies across Europe are being told to leave the US hyperscalers, not asked. French administrations are moving off US collaboration tools; German data-protection authorities have ruled against Microsoft 365 in schools; a German state is migrating tens of thousands of workstations to open source; the EU funds alternatives through its Next Generation Internet programme; Switzerland tightened the FADP. The budget is allocated and the direction is set.

And the organisations already moving to Linux, LibreOffice and Thunderbird hit the same wall: the OS, the documents and the files have sovereign answers — mail, calendar and contacts do not. OxiMail is that missing answer, and the move is not a leap: your existing mailboxes come over from Microsoft 365, Google or your own server, with their history.

A CIO who must leave Microsoft goes looking. The shelf is nearly empty.

What a sovereign buyer actually finds today — counting only what each product ships. Drive puts OxiMail on the file-server shelf too, so that column is here.

The budget is allocated, the mandate is issued — and there is no other complete, self-hostable, modern sovereign suite. Most of the shelf shows its age; OxiMail is of recent design: fast, fluid and built for the phone, the kind of mail your people open without a sigh.

Why one binary, and why Rust →