Technology explained openly
Absolute transparency: this page names every component that makes up sxMail and what it does with your data. Everything runs on our own hardware in German data centres, with no cloud provider, no third-party scripts and no external AI services.
Mail server
The mailbox itself is mailcow: Postfix accepts and delivers mail (SMTP), Dovecot stores and serves it (IMAP and POP3), rspamd filters spam and learns from your own markings. Every connection is encrypted. You can use this mailbox with any email program; our interface is just one option. mailcow was not there from the start, by the way: for the first years sxMail ran on a hand-assembled mail server. mailcow is the foundation now because the package is maintained, updates run cleanly and I would rather spend my time on the interface.
- mailcow
- Postfix
- Dovecot
- rspamd
Web app
The interface is a React application in TypeScript, built with Vite and Tailwind CSS. The public pages are prerendered to finished HTML at build time, so they read without JavaScript. Fonts live on our server; there are no CDNs, no analytics and no embedded third-party content. The app installs like a native one and delivers push notifications. PGP encryption runs with OpenPGP.js right in your browser, and HTML mails are cleaned with DOMPurify before they are shown.
- React
- TypeScript
- Vite
- Tailwind CSS
- OpenPGP.js
- DOMPurify
Backend
Between the browser and the mail server sits our own service in Node.js and TypeScript. It speaks IMAP (ImapFlow), SMTP (Nodemailer), CalDAV and CardDAV (tsdav) and keeps one WebSocket per browser for instant updates. Your credentials stay on the server; the browser only gets a random session token. External accounts attach over IMAP and SMTP, Exchange over EWS, Google and Microsoft over OAuth, none of which reveals your password to us.
- Node.js
- TypeScript
- ImapFlow
- Nodemailer
- tsdav
Files
Files live on a WebDAV server. In front of it stands an isolated gateway, the only component that knows the storage credentials, which issues you a short-lived access per session. Share links are checked by the same gateway.
- WebDAV
AI features
Summaries, reply suggestions, dictation and read-aloud run on our own hardware: an open language model served by vLLM on our own hardware (which model exactly changes with the state of the art), Parakeet for speech recognition, Omnivoice for speech output, LanguageTool for spell checking. None of it leaves our network; there is no connection to OpenAI, Google or any other provider. Every AI feature runs only when you explicitly trigger it.
- vLLM
- Parakeet
- Omnivoice
- LanguageTool
Desktop and mobile
The desktop app for Windows and Linux is a Tauri 2 shell in Rust around the same web app, using the system's WebView instead of a bundled browser. It fetches its own updates; every package is signed with our key and verified before installation. The Android app is built with Expo and React Native and is currently an alpha.
- Tauri 2
- Rust
- WebView2
- WebKitGTK
- Expo
- React Native
Operations
Everything runs in Docker containers behind nginx and a Caddy proxy at the edge. Code is built and tested in our own GitLab, SonarQube analyses it statically, and our DNS runs on our own PowerDNS. Error reports from the app and the server go to our own Bugsink instance, not to a third party. Images in foreign mails are fetched by our own proxy so the sender never sees your IP address. The contact form is guarded by a home-built proof-of-work captcha without external services.
- Docker
- nginx
- Caddy
- GitLab CI
- SonarQube
- PowerDNS
- Bugsink
What is not there yet
The source code is not public at the moment. The Windows installer carries no code signature, so SmartScreen warns on launch. The Android app is an alpha. Open sign-up is closed because of abuse; accounts are available on request and by referral. We write this down because transparency also means naming the gaps.