A mailbox the host can't read once your mail has arrived.
Prismara Mail runs your organisation's email, calendars and contacts on its own mail servers, with no Microsoft service involved. Every message is filtered for spam, phishing and malicious links on arrival, then sealed with a key generated in the user's browser, so stored mail can only be opened by its owner. Move over from Exchange Online or any IMAP server, and let us host it or run it yourself.
Demo with sample data at mail-demo.prismara.eu, separate from production.
What Prismara Mail does
Mail, calendar and contacts
Email, shared calendars with free/busy and room booking, and address books in one web app or any standards-based client.
Protection on arrival
Sender authentication, reputation, spam scoring, lookalike and impersonation checks, attachment and malware checks, link protection at click time, and removal of threats after delivery.
Migration
Bring mailboxes across from Exchange Online or any IMAP server.
Everyday Outlook features
MailTips warn before a mistake is sent, and recall pulls back a message sent in error.
Admin centre
Transport rules, connectors, quarantine, message trace, retention, legal holds and journaling.
Central signatures
Signature administrators design company signatures in a visual editor with six layouts; the server stamps them on every message.
Self-hosting made simple
A one-command installer, built-in ACME certificates for every tenant domain, hardened systemd services and a doctor command that checks the set-up.
S/MIME verification
Signed messages are verified and shown with a clear badge in the reader.
How it's secured
Prismara Mail follows the engineering rules shared across the suite, plus these product-specific measures.
Sealed after filtering
Each item gets its own AES-256-GCM key, sealed with ML-KEM-768 and X25519 to a mailbox key generated in the browser, with mailbox key rotation.
Two-person recovery
Mailbox key recovery needs two of three named custodians.
Journaling sealed end to end
Journal copies are sealed all the way to Prismara Gov, so compliance archiving does not open a back door.
Hardened by design
Fuzz-tested message parsing, TLS 1.3 with X25519MLKEM768, DANE and MTA-STS for delivery, and hybrid ML-DSA-65 sign-in tokens.
Connects to the rest of the suite
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.