Self-hosted email for EU data sovereignty

The cost is driven by four parts: the servers and storage in your chosen EU location, an outbound relay or clean sending IP addresses, the spam and malware filtering layer, and the people who run it. Hardware or cloud infrastructure is usually a recurring cost, while migration, design and initial hardening are one-time costs. Mailbox count, message volume, archive retention length and the number of domains move the total up or down. Storage grows every year with retained mail, so ask any partner to show the growth assumption behind its storage line. A quote should list each component separately, state who pays for each one (your cloud account, your hardware, the vendor, or the implementation partner), and name the recurring items such as support, patching and backup capacity. Compare that total with your current per-mailbox subscription, including any licensing you would still need for a supported groupware edition.

Some internal teams can, but the work is broader than installing a mail server. The team needs skills in DNS, TLS certificates, SPF, DKIM and DMARC, mail routing, backup and restore testing, and the monitoring that tells you when mail is being rejected. Migration also needs a cutover plan, a coexistence period and a way to confirm that no mailbox lost messages. Open-source platforms such as Stalwart and mailcow each document their own install paths, and OX App Suite v8 is designed to run on Kubernetes and is delivered as Helm charts that require Helm 3.17.0 or newer, so the platform choice shapes the skills you need. A practical test is whether you have people who can own the service on call, not only deploy it once. DeployOpen plans, implements, hardens, backs up, upgrades and documents self-hosted platforms inside the client's own infrastructure, so a fixed-scope engagement can cover the parts your team does not want to build alone.

The duration depends mainly on total mailbox size, the number of mailboxes, the source platform's throttling limits, the number of shared mailboxes and calendars, and how much history must move. Large archives and many small mailboxes take different paths, and pilot batches usually reveal throttling and client issues before the full run. We do not state a duration here because no researched figure is available for this scope. Ask any implementation partner for a migration plan that sets out batches, pilot mailboxes, the order of DNS and routing changes, the coexistence period and the rollback point, and ask for the throughput assumption it used for your data volume. Confirm with your current provider which export and API limits apply to your tenant before you accept a schedule.

Responsibility splits differently for self-hosted, partner-run and hosted email, and the split should be written into the contract. In a self-hosted model, your team or the partner runs the filtering engine, tunes false positives, manages blocklist responses and tests restores, which makes those tasks your own operating duty. In a partner-run model, the partner operates these services in your infrastructure under a fixed scope, and you retain ownership of the data and the decisions about retention. In a hosted SaaS model, the provider runs filtering and backups, but you have less control over where data is processed and restored. Ask each option to state, for every control, who configures it, who monitors it, who responds to an incident, how often restores are tested and where the backup copies are stored. Backup location matters for sovereignty, so check it as carefully as the primary mailbox store.

No. Hosting in the EU reduces transfer exposure but does not remove every obligation. Under GDPR Article 44, every transfer of personal data to a third country, including onward transfers, must meet Chapter V conditions, and the EDPB's Guidelines 05/2021 state that remote access from a third country, even only displaying data on a screen for support, is a transfer. Storage in a cloud outside the EEA is also a transfer. Using an EU processor that is subject to third-country law with extraterritorial effect is not itself a transfer, but complying with a third-country authority request would be, so controllers should assess that exposure before engaging the processor. Check who has administrative access from outside the EEA, where backups and logs sit, which support staff can view mail content and whether any vendor component sends data elsewhere. Your data protection officer or legal counsel should confirm the conclusion for your own processing.

Deliverability depends on sender authentication, IP reputation, reverse DNS, TLS and consistent sending behavior. Publish SPF, sign outgoing mail with DKIM, and set a DMARC policy that you monitor before tightening it. Many self-hosted operators use a smarthost or relay with clean addresses, which is a recurring cost to plan for. Gmail and Outlook also expect correct reverse DNS and TLS, and they watch for sudden volume changes from a new IP. Monitor postmaster reporting from both providers and DMARC aggregate reports from the start, and plan a warm-up period for new sending addresses. Ask any partner how it handles blocklist listings, which owner receives alerts and how long a remediation step takes in practice. Do not expect an outcome guarantee from any party, because inbox placement depends on factors outside the server.

A quote should follow directly from a written scope and list each deliverable, the environment it runs in, and who supplies each component. Ask for the server and storage design, the EU location and provider of each component, the list of domains and mailboxes in scope, the migration method and batch plan, the DNS and authentication changes, the spam and malware filtering setup, backup and restore testing, monitoring, documentation and handover. Require a separate line for any licence that may apply, because Open-Xchange states that some modules or features may be subject to custom packaging, limitations or separate fees, and that support lifecycle terms differ for standard and LTS releases. Also request the support and upgrade model, the assumptions behind storage and relay costs, the exit and data return process, and the list of items the quote excludes. DeployOpen does not publish a price list, and a quote follows from the written scope.

It can matter, because the risk depends on who controls the provider, not only on where the server sits. The US CLOUD Act provision at 18 U.S.C. 2713 requires electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control, regardless of whether it is located inside or outside the United States. Under GDPR Article 48, a third-country court judgment requiring disclosure is recognized only if it rests on an international agreement in force with the Union or a Member State. The EDPB's Recommendations 01/2020 also note that where the destination's public authority powers go beyond what is necessary and proportionate, the EDPB cannot envision an effective technical supplementary measure. Map your mail provider's corporate ownership, its support access and its subprocessors before deciding, and ask your counsel to review the result.