Why Open-Xchange for telecom and hosting providers changes your mail operations
Open-Xchange for telecom and hosting providers starts from a familiar operating problem: many mailboxes, several brands, resellers who sell under their own names, and customers who expect to be able to leave. Open-Xchange positions OX App Suite as a fully white-label email and collaboration platform for hosting providers, telcos and ISPs, scaling from thousands to millions of mailboxes. For an operator, the question is less whether the product can carry that load and more who controls the platform when a brand launches, a reseller changes terms or a customer asks where their data sits. This section sets out what changes when mail becomes a platform you operate, so the decision is made before the build starts.
The operating model changes first at the infrastructure layer. OX App Suite v8 is delivered as Helm charts that reference container images, and Helm 3.17.0 or newer is required. The platform runs on Kubernetes, with supported versions following the N-1 and N-2 pattern, and it requires Istio, with a basic ingress-nginx option where Istio cannot be used. Redis 7.4.x handles caching and session storage, MariaDB with the InnoDB engine holds primary data, and OX Drive files and PIM attachments need a distributed file system such as NFS or object storage. Each of these becomes a service your team must size, patch, back up and monitor.
Operating the platform also changes your upgrade work. Open-Xchange documents a standard release support window of 12 weeks, which ends with the availability of the third following release, so a provider running standard releases needs a recurring upgrade cycle on a short clock. The LTS track gives a longer runway, since an LTS release is supported until the next LTS release plus six months. v8.47 (FCS 2026-03-18) is the current LTS, and v8.35 is now discontinued. Decide early which channel each brand or environment uses, who approves the upgrade window, and how staging mirrors production. Ask Open-Xchange to confirm the support dates for any version you plan to deploy.
Licensing needs the same scrutiny as the architecture. Open-Xchange's Operations Guide notes that the right to use certain modules or features may be subject to custom packaging, limitations or separate fees set in the license agreement. Provider scope often extends beyond core mail, calendar, contacts and tasks, so the list of modules each brand will use should be part of the written scope before any quote is accepted. Ask which features your agreement includes, which are charged separately, and whether charges change as mailbox or tenant counts grow. Those answers define the cost model you will carry for the life of the platform.
Identity is the last decision that shapes the operating model. OX App Suite supports single sign-on through OpenID Connect, and Open-Xchange documents SAML login configuration for the middleware. For a provider with resellers, the identity design determines whether a reseller's customers sign in through the brand's own portal, whether administrators are separated per brand, and how accounts are removed when a customer leaves. Confirm which protocol each brand needs, which identity provider it will federate with, and who owns the attribute mapping. Start this inventory now, because it feeds the multi-tenant and provisioning design that follows.
Provider requirements from the platform and the regulations that apply
This table compares the platform requirements of OX App Suite v8 for telecom and hosting providers with the EU rules that may apply to the provider itself. Rows marked as confirmed in platform documentation can be planned now, while the regulatory row needs your legal team's reading before design decisions are locked. Read the last column as the build consequence of each requirement.
| Requirement | Source and status | What it means for the build |
|---|---|---|
| White-label multi-brand operation | ox.io service provider page (vendor positioning; confirm specifics with Open-Xchange) | Plan the context model, branding and provisioning flows per customer group before build. Confirm multi-tenant limits and branding controls with the vendor. |
| Scale from thousands to millions of mailboxes | ox.io service provider page (vendor positioning; confirm with Open-Xchange) | The platform is positioned at this range, but cluster layout, database sizing and file storage for your mailbox count must be confirmed in writing before you commit. |
| Kubernetes with Helm 3.17.0 or newer | OX App Suite requirements (confirmed in platform documentation) | Delivery uses Helm charts that reference container images. Your tooling must run Helm 3.17.0 or newer, and your cluster must sit within the supported Kubernetes versions (N-1 or N-2). |
| Istio or ingress-nginx | OX App Suite requirements and Operations Guide (confirmed in platform documentation) | Istio is required, with the latest release and two prior versions supported. ingress-nginx is a basic option where Istio cannot be used, so decide early because it changes routing and runbooks. |
| Redis 7.4.x | OX App Suite requirements (confirmed in platform documentation) | Redis 7.4.x handles caching and session storage. The default deployment uses the littlered operator. A custom or unmanaged Redis is possible, but you then own its sizing, failover and patching. |
| MariaDB with supported versions and Galera | OX App Suite requirements (confirmed in platform documentation) | Supported versions are 10.6.x, 10.11.x, 11.4.x and 11.8.x on InnoDB, and Galera Cluster is supported. Select a version from this list and confirm the Galera topology and backup approach for your volume. |
| Distributed file system for persistent data | OX App Suite requirements (confirmed in platform documentation) | OX Drive files and PIM attachments need a distributed file system: NFS for small to mid-size deployments, or object storage such as AWS S3, Ceph RadosGW or Scality RING for larger ones. Choose based on expected attachment growth. |
| Support windows for standard and LTS releases | Open-Xchange Support Commitment (confirmed in platform documentation) | Standard releases are supported for 12 weeks, ending with the availability of the third following release. LTS releases are supported until the next LTS plus six months. Plan upgrades around these windows, noting v8.47 is the current LTS and v8.35 is discontinued. |
| NIS2 Annex I and Implementing Regulation 2024/2690 for cloud, managed and data center providers | Directive (EU) 2022/2555 Annex I and Commission Implementing Regulation (EU) 2024/2690 (legal text; confirm with your legal team) | Annex I covers cloud, data center and managed service providers. Whether your telecom or hosting services fall in scope, and which Article 21(2) measures apply, is a legal question. Platform documentation does not settle it, so resolve it before design is locked. |
Sizing OX App Suite for millions of mailboxes without guessing
Sizing an OX App Suite deployment for provider scale starts from a written mailbox forecast and a load test profile, not from a per-mailbox rule of thumb. The inputs that matter most are the mailbox count for each tenant, the expected growth per tenant and per quarter, peak concurrency (how many users are logged in and active in the busiest hour), and the volume of attachments and OX Drive files each mailbox will hold. Each of these drives a different component, so a single average figure hides the load that breaks the platform. This section gives no capacity figure. Ask the partner for a sizing model built on your own forecast and on load tests run against a realistic copy of your tenant mix, with the assumptions written down so you can challenge them.
Attachment and Drive volume decide the storage design. OX App Suite v8 requires persistent data such as OX Drive files and PIM attachments to sit on a distributed file system. NFS fits small to mid-size deployments. For larger ones, the supported options named in the requirements are object storage such as Ceph RadosGW, AWS S3 or Scality RING. The choice depends on where you run the platform and what your team already operates. If you already run Ceph or a compatible object store, that usually changes the cost and skills picture. Confirm throughput, metadata behavior, replication and backup for the option you choose, and collect the attachment size distribution and retention policy before the storage tier is sized.
The database and cache are the two places where early design mistakes are expensive to reverse. MariaDB with InnoDB is the primary data store, and the supported branches are 10.6.x, 10.11.x, 11.4.x and 11.8.x. Galera Cluster is supported, so the decision is whether to run a Galera cluster, how many nodes it needs for your availability target, and how write load from many tenants will behave under synchronous replication. Redis 7.4.x handles caching and session storage. The littlered operator deploys it by default, and unmanaged or custom Redis setups are possible. Decide whether Redis is dedicated, shared or placed per region, because session volume tracks peak concurrency and a shared instance can fail for every tenant at once. Confirm each choice with the vendor's current requirements.
Turn these decisions into a short list before requesting a quote. Give the partner the mailbox forecast by tenant and region, the peak hour assumption, the attachment and Drive profile, the availability target, and the storage platform you already operate. Ask what the sizing model covers: the node counts for the application, database and Redis tiers, the storage capacity and growth plan, the load test method, and the headroom it assumes. Also ask which items are fixed in the written scope and which are re-measured after the first load test. A quote built on these inputs lets you compare a partner's model with your own team's estimate on the same assumptions, instead of comparing two unexplained numbers.
Which modules and settings matter for a provider deployment
A provider deployment of OX App Suite depends on a small set of decisions that affect each other: how tenants are modeled, how identity and provisioning connect to existing systems, where files live, and how modules are licensed. Settle these early, because changing them after mailboxes exist is costly.
Tenant contexts, branding and white-label UI
Decide how your resellers, business customers and consumer brands map to OX App Suite contexts, and which context holds the branding, logos, login pages and default settings for each. Check how many contexts your platform will need, how users move between them, and which settings can be overridden per context. Ask Open-Xchange to confirm which UI and branding options are configurable in v8 and which require custom frontend work, since that work adds maintenance with every release.
Single sign-on with OIDC and SAML
OX App Suite supports single sign-on through OpenID Connect, and Open-Xchange documents SAML login configuration for the middleware. Decide which protocol your identity provider supports, how claims map to mailbox and context identifiers, and how sessions expire across web, mobile and desktop clients. Confirm with Open-Xchange that the SAML configuration for your target v8 release matches the documentation you plan to follow, because the documented SAML guide you find may be written for an earlier version.
Provisioning integration with BSS or CRM
Mailbox creation, changes, suspension and deletion usually start in your billing, subscriber or CRM system, so that system becomes the source of truth for each account. Decide which events trigger provisioning, how failed requests are retried, and who reconciles differences between your BSS and the mail platform. Confirm the provisioning interfaces Open-Xchange supports for your release and whether they cover context, quota and feature settings as well as user records.
Documents and Drive on the storage backend
OX Drive files and PIM attachments must sit on a distributed file system. NFS fits small to mid-size deployments, while object storage such as AWS S3, Ceph RadosGW or Scality RING is the documented option for larger ones. Decide the backend from expected file volume, growth and the per-customer quota model, and check how Documents editing sessions behave when storage latency rises. Confirm with Open-Xchange which backend and sizing guidance applies to your planned mailbox count before you buy hardware.
Licensing for separately priced modules
OX App Suite includes email, calendar, contacts, tasks, Documents and Drive, but Open-Xchange states that some modules or features may be subject to custom packaging, limitations or separate fees set in the license agreement. List the modules you want to resell or enable for each customer tier, then ask which of them are licensed separately, how they are counted, and whether usage limits apply. Get the answers in writing before you publish a service catalog, because changing a module after customers have it can be difficult.
Kubernetes ingress choice: Istio or ingress-nginx
OX App Suite v8 runs on Kubernetes using Helm 3.17.0 or newer, supports the N-1 and N-2 Kubernetes versions, and requires Istio. A basic ingress-nginx option exists where Istio cannot be used. Decide which ingress your platform team can operate, consider how it affects mTLS, traffic policy and your upgrade cadence, and confirm with Open-Xchange which features are available with ingress-nginx and what limits apply before you commit to that path.
How the EU Data Act shapes switching for mail customers
The EU Data Act requires providers of data processing services to let customers switch to another provider or to on-premises ICT infrastructure. For a telecom or hosting provider running white-labeled OX App Suite, this means your mail offering must be designed so that a business or consumer customer can leave with their mailboxes and data. The Act sets a maximum two-month notice period for switching and a 30-day transitional period, as set out in Articles 23, 25 and 50 of Regulation (EU) 2023/2854. These are obligations to plan for now, not after a customer asks. The Data Act has applied since 12 September 2025. From 12 January 2027, providers of data processing services may not impose any switching charges. Until that date, any reduced switching charge may not exceed the costs directly linked to switching, under Article 29. Review your customer terms, notice clauses and fee schedule against these limits, and decide which internal costs you can document as directly linked to a switch. Ask counsel whether your white-label mail service, and the way you contract with your own customers, falls under the Act. This section is an engineering summary, not legal advice.
Switching is only possible if the data can be taken out in a usable form. In OX App Suite v8 on Kubernetes, mailbox and calendar data sit in MariaDB with the InnoDB engine, while OX Drive files and PIM attachments sit on a distributed file system such as NFS or object storage. An exit plan that exports only the database will leave attachments and files behind. Identity is a separate concern: if customers sign in through OpenID Connect or SAML, you need a mapping from identity-provider accounts to exported mailboxes so the receiving environment can match users. Redis holds cache and session state, so it is not a primary exit source. Before committing to an exit commitment, confirm with Open-Xchange which export formats and tooling your release supports for mailboxes, contacts, calendars and files. Then document each format, its version, and the fields that will not survive the transfer. Customers and receiving platforms need that list in advance.
An exit runbook is the document that turns these capabilities into a repeatable procedure. It should name the owner for each step, including the people who approve a switch request, run the per-tenant export, verify it, hand over the data and decommission the old context. Include checks that compare message and file counts and checksums between source and target, and state how long backups of the exported data are kept before deletion. Record the evidence of each step, because you will need it if a customer disputes the switch. Runbooks only count once they have been rehearsed. Run a full export and import into a non-production target for a representative tenant, time each stage, and compare the result against the two-month notice and 30-day transitional periods the Act sets. Repeat the rehearsal after each OX App Suite upgrade and after any change to storage or identity. When you request a quote, ask for the exit runbook, the export tooling, the rehearsal, and the support hours during a switch as separate line items.
Ask your engineering and legal teams to agree on three decisions before the next product review: which offerings are in scope of the Act, which exit formats you commit to in writing, and who signs off that a rehearsal met the timing your contracts promise. These decisions shape the architecture more than any single setting does, so make them while the tenant model and storage layout are still open.
Rollout phases for a provider moving to OX App Suite on Kubernetes
This sequence takes a provider from a scoped multi-tenant design to a production OX App Suite v8 service on Kubernetes that the provider operates in its own infrastructure. Each phase ends with a written artifact, so the next phase starts from agreed decisions and migration waves begin only after the pilot passes.
Agree scope and the tenant model
Scope covers which brands, mailbox types, regions and OX App Suite modules the service includes, and how OX contexts map to tenants. Module licensing is settled early because the Operations Guide notes that some modules may carry custom packaging, limitations or separate fees set in the license agreement. The output is a tenant model document listing each tenant, its administrators, quotas, branding scope and included modules. The step closes when the provider confirms that document and the module list in writing.
Design the Kubernetes reference architecture
DeployOpen maps the target cluster to OX App Suite v8 requirements: a supported Kubernetes version within the N-1 and N-2 range, Helm 3.17.0 or newer to deploy the charts, and Istio or the basic ingress-nginx option where Istio cannot be used. The design also covers Redis 7.4.x, deployed by default through the littlered operator unless a custom setup is chosen, MariaDB with InnoDB in a supported version line, and a distributed file system for Drive files and attachments. Confirm each component with your platform team. The output is an architecture decision record and a reviewed Helm values baseline.
Integrate identity and single sign-on
Choose the identity source and protocol. OX App Suite documents OpenID Connect for single sign-on, and the middleware documents SAML login configuration. Map identity attributes to mailbox provisioning, define how administrators and end users sign in, and agree session lifetimes with your security team. Test sign-in with accounts from each tenant, including failure paths such as disabled users and expired sessions. The output is an identity integration specification and a test record showing each allowed and denied sign-in per tenant.
Prove the pilot tenant end to end
Build one pilot tenant with the production brand and run brand checks covering logo, colors, login page, sending domain and client-facing text. Then run provisioning tests: create, suspend, move and delete mailboxes, enforce quotas, manage aliases and confirm calendar sharing across the tenant. Verify DNS records, inbound and outbound mail flow and access from supported clients. Confirm the exact provisioning interfaces for your release with Open-Xchange documentation. The output is a pilot acceptance report with pass or fail results per test and a defect list with named owners.
Migrate mailboxes in controlled waves
Group existing customers into waves by tenant, mailbox volume and business risk, starting with the lowest-risk group. Each wave includes a mailbox inventory, a pre-migration sync, a cutover window agreed with the provider and a rollback plan that is tested before cutover. Confirm the source platform's export format and the migration tooling for each source, since these depend on the platform being left. The output for each wave is a completion report with reconciled mailbox counts, sampled message and calendar checks and sign-off from the provider.
Set the release channel and upgrade cadence
Decide whether each environment follows standard releases or the LTS line. Standard releases are supported for 12 weeks, ending with the availability of the third following release. An LTS release is supported until the next LTS release plus six months, with v8.47 (FCS 2026-03-18) the current LTS and v8.35 discontinued. Align the cadence with the provider's change calendar so no tenant runs an unsupported build. The output is a written release policy with staging order, approval gates and an upgrade calendar.
Hand over runbooks and operating records
Your operations team shadows DeployOpen during onboarding, provisioning, upgrades and a restore exercise before ownership transfers. Runbooks cover tenant onboarding and offboarding, mailbox provisioning, Redis and MariaDB failover, storage, backup and restore, Helm upgrade and rollback, and incident escalation contacts. The output is the runbook set, the architecture record, an access matrix and a signed handover acceptance. The step closes when your on-call team completes a restore and an upgrade in a non-production environment without DeployOpen staff.
Licensing terms and release planning to settle before quoting
Settle the licensing position before you ask for a quote, because it changes what the quote covers. Open-Xchange's Operations Guide states that the right to use certain modules or features may be subject to custom packaging, limitations or separate fees set in the license agreement. For a telecom or hosting provider, that makes tenant design and module choices cost decisions as well as product decisions. A design that gives every reseller context the same feature set may fall under different terms than one that enables a few add-on modules for selected business customers. Ask Open-Xchange for a module-by-module statement of what is included, what is limited and what is priced separately, and test it against the tenant model you plan to run.
Ask which charges recur and what they are measured against. A quote from DeployOpen covers implementation work under a written scope, but module entitlements, license fees and any usage-based terms come from the license agreement with Open-Xchange. Confirm whether any charge is tied to mailboxes, contexts, tenants or specific modules, how it is counted, and whether it renews annually or on another schedule. Also confirm how the agreement treats white-label branding and whether any restriction applies when you resell the service to your own customers. Get these answers in writing before you size the environment, because changing tenant structure after go-live can change the license position as well.
Plan releases around the support commitment, not around the feature list. A standard release is supported for 12 weeks, ending with the availability of the third following release. An LTS release is supported until the next LTS release plus six months. v8.47 (FCS 2026-03-18) is the current LTS, and v8.35 (FCS 2025-03-12), the first v8 LTS, is now discontinued. For a fleet serving many tenants, standard releases arrive too quickly to stage upgrades across all of them safely, so most providers should run on an LTS track. The newest release listed in the commitment is v8.53, which is a reason to confirm your upgrade path, not a reason to move the fleet.
Choose an LTS track for the fleet, then write the release calendar around its end date. Record the date on which v8.47 support ends, which depends on the next LTS release plus six months, and schedule rehearsals on a staging copy of your largest tenants before that date. Confirm in writing with Open-Xchange what counts as the next LTS, how much notice you receive, whether security fixes are available for a discontinued release, and how license terms carry across an upgrade. If any tenant is still on v8.35, treat migration off it as an open risk with an owner and a deadline. These checks should be part of the statement of work, so the cost and timing of upgrades are visible in the quote.
Compliance duties a telco or hosting provider carries into the mail service
Telcos and hosting providers carry several overlapping duties when they run mail for customers: sector rules for their infrastructure, assurance evidence for their customers, and data protection terms for mailbox content. The cards below separate what each framework requires, what buyers ask to see, and where DeployOpen's preparation work ends and an independent auditor's work begins.
NIS2 and the 2024/2690 requirements
NIS2 Annex I lists cloud computing, data center and content delivery network providers as digital infrastructure, and managed service providers and managed security service providers as ICT service management, both high-criticality sectors. Commission Implementing Regulation (EU) 2024/2690 sets the technical and methodological requirements for the Article 21(2) measures these providers must take. Confirm with counsel which entity and sector classification applies to your mail offering, then map the 2024/2690 requirements onto the OX App Suite hosting, backend and managed operations.
SOC 2 Trust Services Criteria evidence
SOC 2 examinations assess controls against the AICPA 2017 Trust Services Criteria across security, availability, processing integrity, confidentiality and privacy. The security common criteria CC1 to CC9 apply to every SOC 2. A Type 1 report describes the system and the design of controls as of a date, while a Type 2 report adds an opinion on operating effectiveness over a period. DeployOpen prepares controls and evidence for the mail platform, but independent auditors issue the report, so confirm which report your customers will ask for and its scope.
ISO/IEC 27001:2022 Annex A controls
Annex A of ISO/IEC 27001:2022 lists 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34). Many mail-platform controls fall under the technological theme, covering access, logging, backup and configuration of the mail backend and identity services. Accredited certification bodies certify organizations on a three-year cycle with at least one audit every calendar year. Ask whether your certification scope includes the mail service and which Annex A controls map to it.
GDPR Article 28(3) processor contracts
When you host mailboxes for business and consumer customers, you often act as a processor for their personal data. Article 28(3) requires the processor contract to bind you to process only on documented instructions, including for transfers, and to take the security measures required by Article 32. Check that the contract describes mail logging, backup locations, support access and sub-processors, and that it defines what happens to mailbox data at termination.
Cyber Resilience Act relevance
The Cyber Resilience Act applies to products with digital elements, including software, from 11 December 2027. Its Article 14 reporting obligations have applied since 11 September 2026 to in-scope products whenever they are placed on the market. Operating a hosted mail service for your own customers may fall outside the Act, but white-label packaging, redistributed appliances or software supplied to other organizations may change the answer. Confirm the position with counsel before assuming it applies or does not.
What telecom and hosting providers ask before hiring a partner for OX App Suite
What drives the cost and effort of a white-label OX App Suite deployment?
Cost follows the number of environments, tenants, branding variants, provisioning integrations and the platform components you must build or operate. The core work is platform design (Kubernetes, Istio or ingress-nginx, Redis, MariaDB, a distributed file system for Drive and attachments), then white-label configuration, provisioning and monitoring, and a test plan for each tenant context. Recurring costs include upgrades, support, capacity growth and your own team's time. Licensing for modules can add a separate line item. Ask each bidder for a written scope that lists components, tenant assumptions, environments, the handover package and what is excluded, plus the assumptions behind each work package so you can compare quotes on equal terms.
How long does an OX App Suite migration take for large mailbox counts?
Migration duration depends mainly on mailbox volume, total data size including attachments, the number of tenants, the source platform, and the cutover window you can accept. Consumer and business tenants usually move in waves, so the tenant count and grouping drive the schedule as much as raw mailbox numbers. Coexistence periods, directory cleanup and DNS changes add time that is easy to underestimate. Ask for a migration plan that sets out pilot waves, data validation steps, rollback criteria, the cutover runbook and how user communication is handled. A partner should be able to show how the estimate changes if mailbox volume or tenant count changes, before any timeline is committed.
What must a hosting provider supply before OX App Suite deployment starts?
Providers must supply the target infrastructure and the decisions that depend on it. On the architecture side, that means a Kubernetes cluster with a supported version, a service mesh or ingress choice, a Redis and MariaDB plan, and storage for Drive files and attachments, typically NFS for smaller deployments or object storage for larger ones. Identity needs an OpenID Connect or SAML provider, plus the rules for mapping users to tenants. Provisioning APIs must be documented so account creation, suspension and deletion can be automated. DNS zones, mail routing records and TLS certificates must be available early, since they gate testing and cutover. Ask partners which of these items they expect you to own and which they will build.
Can our own platform team run OX App Suite on Kubernetes after handover?
Yes, if your team already operates Kubernetes, Helm, a service mesh, a managed database and a distributed file system, and has a release process for changing them. The platform uses Helm charts that reference container images, so Helm 3.17.0 or newer is required. Day-two work includes tracking Open-Xchange's support commitment (standard releases are supported for 12 weeks, while LTS releases are supported until the next LTS plus six months), applying upgrades in order, and keeping backup and restore tested. Ask for a runbook, a training plan for your engineers and a clear list of the operations the partner will continue to cover under a retainer, if you want one.
How do OX App Suite licensing terms change the quote for a provider?
Open-Xchange's Operations Guide states that the right to use certain modules or features may depend on custom packaging, limitations or separate fees set in the license agreement. The core code is published as mirrors on GitHub under AGPL-3.0, but that does not settle which modules you may use commercially, or on what terms. Before you compare quotes, ask for an itemized list of modules and features in the proposed package, the license terms for each, the unit the license is measured against (confirm this with Open-Xchange, since it depends on the agreement), and whether support is included. Your legal team should review the agreement before the scope is signed.
How do Data Act switching duties change the exit design for a hosted mail service?
The EU Data Act has applied since 12 September 2025 and requires data processing service providers to let customers switch to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transitional period. From 12 January 2027, switching charges may not be imposed at all, and until then reduced charges may not exceed the costs directly linked to switching. For your exit design, this means you need exportable mailboxes, contacts, calendars and Drive files, documented tenant configuration, and a tested export procedure that works without vendor help. Whether the duties apply to your specific service model is a legal question, so confirm the role split and obligations with counsel before writing contracts.
Which identity setup should a provider plan for OX App Suite single sign-on?
The first decision is whether one identity provider serves all tenants or each tenant brings its own. OX App Suite supports single sign-on through OpenID Connect, and Open-Xchange documents SAML login configuration for the middleware, so the protocol choice depends on what your customers already use. Plan how user records are created and removed, how group or organization claims map to tenant contexts, and how sessions expire. Test failover paths for the identity provider, because a sign-in outage affects every tenant at once. Ask bidders to confirm which protocol and configuration pattern they have implemented for the specific release you will deploy, and to show the test evidence for multi-tenant login.
How DeployOpen scopes and delivers a provider OX App Suite implementation
DeployOpen plans, implements, customizes, hardens, backs up, upgrades and supports self-hosted open-source platforms in your own cloud accounts, data centers or air-gapped networks. For white-labeled OX App Suite, we fix the Kubernetes, database, storage, identity and branding design in writing before build starts, so the platform matches how your provider operates.
How we scope
- The written scope names the tenant and context model, branding scope and provisioning interfaces to be delivered.
- Capacity assumptions for mailboxes, concurrent sessions and growth are recorded so sizing can be checked against them.
- Engagements are fixed-scope, and modules that may carry separate license fees are identified before work starts.
How we build
- Kubernetes runs OX App Suite via Helm 3.17.0 or newer, with Istio or ingress-nginx chosen against your network policy.
- Primary data runs on MariaDB with InnoDB, choosing among supported 10.6.x, 10.11.x, 11.4.x and 11.8.x branches.
- Persistent files such as Drive and attachments go on NFS or object storage, sized to mailbox and tenant growth.
How we hand over
- Helm charts, values files and configuration are documented against your written scope and kept under your version control.
- Acceptance tests cover login through OIDC or SAML, mail flow, calendar sync and tenant separation checks, with results recorded.
- Runbooks cover provisioning, branding changes, upgrades, backups and restores, and the support commitment release cadence.
How we support
- Standard releases are supported for 12 weeks, so your upgrade plan must account for the release calendar.
- LTS releases are supported until the next LTS release plus six months, which bears on your upgrade cadence.
- Retainers can cover ongoing support, upgrades and continuous testing for the platform after handover.

