Your own email– A Full Mail Server with PGP

You get a full mail server that you run yourself. It has a modern web interface and strong spam defense. Mail can be encrypted end to end.

Request a demo

At a glance

Sending and mailboxes
Spam filter
DKIM, SPF, DMARC
PGP / S/MIME
Webmail in the browser
CalDAV & CardDAV

Features at a glance

Here you find all you need for safe, professional company email. You run it yourself, and all parts work as one. We focus on three things: security, mail that arrives, and easy use.

Sending and Receiving (SMTP)

A proven mail server accepts your mail and sends it on reliably. It queues mail and encrypts it on the way with TLS.

Mailboxes (IMAP/POP)

Fetch your mail securely over IMAPS or POP3S. You create your folders freely. Mail rules (Sieve) and storage quotas are included.

Spam and Phishing Filter

A modern filter keeps spam and phishing out. It learns with machine learning and Bayes rules and checks the reputation of the sender.

DKIM/SPF/DMARC

The server signs and checks mail with keys. Clear rules stop fake senders. So your mail lands in spam folders less often.

Webmail and Calendar

Modern webmail in the browser with calendar, contacts and tasks. ActiveSync keeps all phones in sync.

Virus Protection

Each message and attachment is checked for viruses. The virus database is always up to date.

Technology & integration

All parts of the mail server run bundled in containers. That keeps maintenance simple. You manage everything from one admin interface. TLS 1.3 and certificates without manual work are included.

• All-in-one container package
• Servers for sending and mailboxes
• Webmail and ActiveSync for phones
• Spam and virus filters
• TLS certificates that renew on their own
• TLS 1.3 encryption

Your benefits

Your mail arrives, because DNS is set up cleanly
Strong protection: mail is encrypted and signed on the way
Strong defense against spam and viruses
You keep full control of your mail data
Your mail stays on your servers
Open source: no vendor lock-in
Easy management in the browser

Technical foundation

SecTepe.Comm builds on proven open-source parts here. On a single server, this is Mailcow with Postfix, Dovecot, SOGo, Rspamd and ClamAV. On Kubernetes, Stalwart accepts the mail and Dovecot holds the mailboxes. Sign-in runs through Keycloak.

How email works in practice

SecTepe.Comm offers its mail system in two forms. On a single server, a bundled mail package runs in containers. On Kubernetes, one server sends mail and a second one holds the mailboxes. In both cases, users sign in once through the central login (single sign-on).

How a message flows

The server receives the message. A filter checks it for spam, and a scanner looks for viruses. Then it lands in the mailbox.
A setup script creates your mail domain, a signing key (DKIM) and standard addresses such as postmaster and abuse. It also lists the DNS records you need.
Outlook, Apple Mail and other mail apps sign in through the central login. Older apps can use app passwords.
After repeated failed logins, a firewall blocks the address.
A separate scanner checks Office attachments for macros. DNS answers are checked with DNSSEC. A watchdog monitors the health of every mail service.

Typical use cases

Shared mailboxes like info@ or support@. Members come from groups in the central login and are updated regularly. Nobody needs the mailbox password.
Encrypted mail with PGP or S/MIME. A key directory (Web Key Directory) lets other people find your public keys.
Meetings from the calendar. In the webmail calendar, one click adds a protected video room to an event.
Archiving. A small helper service stores an unchanged copy of each message. It goes to S3 storage with write protection. By default, copies are kept for 84 months.
Moving away from Microsoft 365. The platform includes a migration path for Exchange, OneDrive, SharePoint and Teams.

Operation and data control

You run the mail server yourself, so mailboxes stay on your own platform. Webmail sits behind the central login with multi-factor authentication (MFA). All connections must be encrypted with TLS. Enterprise tenants with their own cluster get a separate mail domain for each customer.

Common questions

Does Outlook work on phones? Yes. On a single server, the webmail provides ActiveSync. On Kubernetes, a separate gateway does this job. Outlook on the desktop connects over IMAP.

Does the spam filter learn? Yes. Moving a message to the junk folder is enough to train the filter.

Which DNS records do I need? You need MX, SPF, DKIM, DMARC and a reverse DNS entry. MTA-STS and DANE are optional extras for stricter encryption.

Ready for self-hosted email?

We plan your mail platform with you and move your mail over. We cover each step, from DNS setup to a clean switch.

Request a demo Back to SecTepe.Comm

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.

Common questions

We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.

How do we start working with SecTepe?: Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
What company sizes and sectors do you support?: We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
Do you work on site, remotely or hybrid?: Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
Which standards and regulations do you cover?: We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
How do you protect the confidentiality of my data?: By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.

Book a conversation