Self-hosted email and groupware

It applies if you are a broker-dealer subject to the rule, and self-hosting does not change that. SEC Rule 17a-4(b)(4) requires broker-dealers to preserve originals of communications received and copies of communications sent relating to the business, including inter-office communications, for not less than three years. The rule is written around the records, not the server, so your mail platform, archive and retention settings must together keep those communications for the required period. Confirm with your compliance counsel which communications are in scope, how long each category must be kept, and whether your regulator expects a specific storage format. DeployOpen can build and document the archive and retention controls you decide on, but the determination of your obligations stays with your organization and counsel.

The HIPAA Security Rule expects technical safeguards for electronic protected health information sent over networks and audit controls for systems that hold it. Under 45 CFR 164.312(e)(1), you must guard against unauthorized access to ePHI transmitted over an electronic communications network, which in practice means enforcing TLS for SMTP and client connections and reviewing that enforcement. Under 164.312(b), you must implement audit controls that record and examine activity in systems containing ePHI, so mailbox access, administrative changes and archive searches need logging that someone actually reviews. Whether a given email contains ePHI, and how your risk analysis treats it, is your decision with your privacy and security officers. DeployOpen configures and evidences these controls; it does not certify HIPAA compliance.

Journaling copies every message that passes through the mail system, at delivery or submission, into a separate archive store that users cannot edit or delete from their mailboxes. A backup is a point-in-time copy used to restore systems after failure, and it rarely gives you a complete, searchable record of communications over years. For retention obligations, you usually need journaling or an equivalent capture point, plus immutable storage with defined retention periods. With Stalwart or mailcow, confirm which capture mechanisms the version you deploy supports, how journal copies are formatted, and whether the archive can be exported in a format your reviewers and auditors accept. Test a restore and a search before you rely on the archive.

A legal hold suspends deletion for specific custodians or messages while a dispute or investigation is open, and e-discovery is the process of identifying, collecting and producing relevant messages. Both depend on the archive being searchable by custodian, date range, sender, recipient and keyword, and on holds being applied independently of users' own deletion actions. Your legal team sets the hold scope and the production format. Engineering needs to confirm that holds override retention cleanup, that hold actions are logged, and that exports preserve metadata. Ask your implementation partner to demonstrate a hold on a test mailbox, an export and a log entry for each action, and agree the evidence set in writing before go-live.

Your organization decides retention periods, with legal, compliance and records management advising on them. Regulations such as SEC Rule 17a-4 and HIPAA set requirements for particular categories of records and safeguards, but they do not give one universal period for every email, and they interact with state law, contracts and internal policy. The platform implements the schedule you approve, for example by tagging categories, setting retention rules per domain or group, and applying deletion only after holds clear. DeployOpen can configure and document the schedule as written by your organization and prepare evidence that it runs as specified. It does not interpret the law or give legal advice.

Auditors typically ask for the written retention policy, the configuration that enforces it, samples showing messages were captured and kept for the required period, records of holds and deletions, access logs for the archive, and proof that backups of the archive can be restored. For regulated email, expect requests to show who can administer the archive and how those privileges are reviewed. Build an evidence register early: each control, its owner, where the evidence is stored and how often it is produced. DeployOpen prepares controls and evidence for compliance assessments. Independent auditors and certification bodies issue any opinion or attestation, and DeployOpen does not issue those.

Cost has three main parts: the people who design and operate the archive, the storage that holds years of messages, and the effort to run holds, exports and audits. Storage grows with mailbox volume, attachment size and retention length, and it recurs every year, so model it from your message volumes and retention schedule rather than from a generic figure. Implementation effort is one-time, and ongoing administration, log review and restore testing recur. When requesting a quote, ask the partner to separate design, configuration, storage sizing, evidence preparation and continuing support, and to state which items are fixed-scope and which are retainers. DeployOpen agrees scope and deliverables in writing before work starts and does not publish a price list.

DeployOpen can plan, implement, configure, harden and document the archive, retention, journaling and audit logging controls in your own infrastructure, and it can prepare the evidence your assessors request. It does not issue audit reports, attestations or certifications, and it does not decide your legal obligations. Your compliance and legal functions own the retention schedule and hold decisions. Ongoing operation, log review and periodic restore tests can be covered by a retainer if your team wants that support. Put the division of responsibilities into the written scope so that every control has a named owner.

The cost splits into one-time work and recurring work, and the mix depends on the scope agreed in writing. The one-time items are design, DNS and authentication setup (SPF, DKIM and DMARC), the migration, and the archiving design. The recurring items are infrastructure, backups, patching, monitoring, mail queue and reputation watching, and support. Costs rise with mailbox count, the number of domains, the retention period, the volume of mail that needs to be indexed or archived, and whether you need high availability across sites. Costs fall when the scope is narrow, the source mailboxes are clean, and the team can handle first-line support. Ask every quote to separate setup fees from monthly operations, to state who owns the servers and licenses, and to list what is excluded, such as third-party archiving products or paid Stalwart Enterprise License terms. DeployOpen does not publish a price list, so the quote follows from the written scope.

The timeline is set by data volume, number of mailboxes, the cutover model and how much history must arrive intact, not by the platform alone. The main drivers are total mailbox size, the number of shared mailboxes, calendars and contacts that must move with users, the complexity of routing and aliases, and how many domains and users change at once. A phased approach that moves pilot users first, then shared mailboxes, then the rest, usually adds planning time but reduces risk. Ask the partner for a written migration plan that covers pre-migration DNS lowering, sync windows, a rollback path, and a validation step for message counts and folder structure. No duration is given here because none has been researched for this page. Request a timeline that names the assumptions behind it, so you can test those assumptions against your own mailbox inventory.

A small team can run it, but only if the operating model is defined before go-live. The work that tends to fall on staff includes watching the mail queue, responding to blocklist listings, renewing TLS certificates, applying platform updates such as mailcow release 2026-09a, checking backups, and handling user requests for aliases, quotas and mailbox restores. Those tasks are routine but time sensitive, and an outage or a blocklisting can stop business email for everyone. Decide who is on call, who approves changes, and who answers when delivery fails. Many organizations keep internal ownership of identity and user administration while contracting platform operations, monitoring and patching to a partner under a retainer. Ask for a responsibilities matrix that lists each recurring task, the owner, and the escalation path.

The project depends on several inputs that only your organization can supply. You need access to the DNS zones for every mail domain, the ability to create SPF, DKIM and DMARC records, and an owner who can approve changes to MX records. You also need a current inventory of mailboxes, shared mailboxes, distribution lists, aliases, and external systems that send mail, such as scanners, line-of-business applications and marketing tools. Identity inputs matter too: your directory source, password and MFA policy, and how user accounts are provisioned. Finally, you need a named business owner for retention rules and legal hold decisions, plus a hosting environment with the network and storage your security team has approved. Missing inputs are the most common reason a fixed-scope timeline slips, so ask the partner to list them in the statement of work.

Deliverability risk is real in the sense that it is operational, not theoretical. Receiving servers judge a sender by its IP reputation, its domain alignment, and whether SPF, DKIM and DMARC pass and align. A new server starts with no history, so mail to large providers may be filtered until reputation builds. The safeguards to plan for are a correctly configured reverse DNS record, consistent SPF includes for every sending service, DKIM signing on all outbound paths, and a DMARC policy that moves from monitoring to enforcement only after reports show legitimate senders pass. Ask the partner how they will monitor DMARC aggregate reports, check blocklists, and handle a listing if one occurs. Also confirm whether your outbound IP is shared or dedicated, because that choice changes your exposure.

Retention obligations change the design from the first day, because email must be captured, kept and retrievable, not just delivered. For broker-dealers, SEC Rule 17a-4(b)(4) requires preserving originals of received communications and copies of sent communications relating to the business, including inter-office communications, for not less than three years. That means you need a write-once or otherwise compliant archive, a defined retention schedule, and a way to export records on request. For healthcare, the HIPAA Security Rule at 45 CFR 164.312(e)(1) requires technical measures that guard against unauthorized access to ePHI sent over networks, and 164.312(b) requires audit controls that record and examine activity in systems holding ePHI. In practice, you need encrypted transport, mailbox access logging and retention of those logs. Your compliance counsel decides whether a given rule applies and how long to keep records. Ask the partner to show how archiving, journaling, encryption and audit logs map to each requirement, and to name what it will not cover.

Protocol coverage depends on the platform you choose and on how it is configured, so confirm it against your own client list. Stalwart's project documentation lists IMAP, JMAP, SMTP, CalDAV, CardDAV and WebDAV, which covers mail, calendar, contacts and file access in one server. mailcow is built around a different stack of components, so check its documented support for each client type before you commit. Test the clients you actually use, including older desktop mail applications, mobile devices, calendar sharing, and delegated access. Also verify how push notifications and shared calendars behave, since these are the features users notice first when they are missing. Ask the partner for a client compatibility test plan and results before the pilot starts.