Engineered in Europe · Sovereign by architecture

Own your mail infrastructure.
Not the other way around.

SEVOCOMM MTA is a European, sovereign mail platform for organizations that refuse to outsource their email infrastructure. Full control over deployment, data location, and operational posture — with monitoring, security, and TLS trust built in from day one.

  • 100% customer-controlled deployment
  • 0 vendor-enforced cloud dependencies
  • EU development & data-protection alignment
Why SEVOCOMM MTA

Six reasons this is not another mail server.

Scannable in seconds. Defensible in an audit.

The problem with the status quo

Your mail already moves through infrastructure you don't control.

Modern mail stacks quietly pull organizations into dependencies they never agreed to: opaque routing, per-seat pricing curves, tenant boundaries enforced by the vendor, and data residency expressed as a contract clause instead of an architectural fact.

Lock-in

SaaS mail providers bind routing, identity, and policy into a single non-portable surface. Exit is expensive. Change is slow.

Hidden infrastructure

Mail is processed, queued, and logged in locations your audit team can't reach. "Cloud" is not the same as controlled.

Weak visibility

TLS is reported as binary. Downgrades go unnoticed. Deliverability problems surface days after they mattered.

Sovereignty by contract

Data location is a promise in a DPA, not an architectural guarantee. Regulators increasingly reject that distinction.

Operational dilution

Tier-1 tickets route to the vendor. Root cause arrives later — if at all. You carry the risk; someone else carries the console.

SEVOCOMM MTA reverses the arrangement.

See how deployment works →
Deploy where you decide

Four environments. One engine. Zero vendor layers in between.

The single most important architectural guarantee of SEVOCOMM MTA: the deployment model is not imposed. It is chosen — by the customer, for the customer, with no vendor-managed layer in between.

On-Premise

Customer data centre. Full perimeter control. Air-gap compatible.

Private Cloud

Dedicated, sovereign region. Customer-managed tenancy boundary.

Public Cloud / VM

AWS, Azure, GCP, Hetzner, OVH — infrastructure you already control.

ISP / Telecom

Multi-tenant, white-label ready, operator-scale provisioning.

Four deployment environments — On-Premise, Private Cloud, Public Cloud/VM, and ISP/Telecom — all converging on a single SEVOCOMM MTA Core exposing identical IMAP, APIs, Monitoring and Admin services
Identical engine, identical behavior, across every environment.

“Deployment is fully decided by the customer.

— Core product principle · Non-negotiable
Product overview

Modular. Observable. Portable.

A modern mail engine structured around three design principles: architectural modularity, first-class observability, and unconditional portability — no forced SaaS layer, no vendor-controlled routing.

Mail engine

High-performance SMTP front-end with policy hooks, DKIM signing, content filtering, and full queue visibility. Standards-compliant IMAP4, POP3, and Submission. Postfix- and Dovecot-compatible for drop-in interoperability.

Security core

DKIM, SPF, DMARC with aggregate-report ingestion. RBL integration, abuse-pattern detection, and TLS 1.2 / 1.3 enforcement built into the pipeline — every message, every hop.

Monitoring

Prometheus-compatible metrics, native dashboards, webhook dispatch, and live queue/TLS/health telemetry. Monitoring is a foundational subsystem — not an optional tier.

Administration

Multi-domain, multi-tenant control plane with role-based access, audit logging, DNS helper, and certificate automation. Every UI action is reachable via REST API.

Integrations

Open standards only: SMTP, IMAP, POP, CalDAV, CardDAV, MTA-STS, TLSRPT, DKIM, SPF, DMARC. No proprietary wrappers. Fits any SOC, SIEM, or observability stack already in place.

Product proof

A mature platform, not a pitch deck.

Real screenshots from production — every view below is shipping functionality.

Administration dashboard showing live system health, 24-hour email traffic, message-status breakdown and real-time activity
Operations dashboard. Live system health, 24-hour email traffic, message-status breakdown, and real-time activity — the first thing an operator sees, every shift.
Mail queue management with per-message diagnostics
Queue management. Direct operator control over active, deferred, and held messages.
Integrated security engine control plane
Security engine. Authentication, anti-spam, greylisting, and content policy — unified.
Integrated monitoring dashboard
Monitoring. Service status, metric aggregation, and alert routing in a native interface.
End-to-end message trace view
Message trace. End-to-end tracing from SMTP ingress to final disposition.
Security & TLS Trust Intelligence

Know what your TLS trust actually looks like.

Most platforms treat TLS as binary — either it handshakes or it doesn't. SEVOCOMM MTA treats TLS as an ongoing intelligence signal, continuously evaluating how your mail actually traverses the public network.

  • DKIM / SPF / DMARC — signing, verification, alignment, enforcement and aggregate-report ingestion.
  • TLS 1.2 / 1.3 — modern cipher suites only, per-transport policy, explicit downgrade visibility.
  • MTA-STS — policy discovery, caching, and enforcement for inbound and outbound flows.
  • TLSRPT — aggregate TLS reports parsed, deduplicated, and surfaced as actionable insight.
  • Downgrade detection — TLS negotiation failures and version downgrades flagged in real time.
  • Edge defences — greylisting, IP reputation, throttling, evaluated before the queue.

The difference between “encrypted in transit” and “provably encrypted in transit” is the difference between a marketing claim and an operational fact.

Email authentication and TLS visibility panel — per-domain DKIM/SPF/DMARC status alongside TLS-enforcement posture
Per-domain DKIM / SPF / DMARC status and TLS enforcement posture.
Continuous security event visibility
Continuous security event visibility.

See the platform against your actual environment. A scoped, no-fluff walkthrough with our engineering team.

Status and SLA view — service-level metrics tracked continuously and reported against defined SLOs
Service-level metrics tracked continuously against defined SLOs.
Deliverability dashboard showing reputation, bounce rate, and delivery health
Deliverability, reputation, and bounce health — one pane.
Monitoring & operational control

Observability, built in.

The platform was designed with operational visibility as a foundational constraint. Metrics, dashboards, and alerting ship with every deployment — not as an optional integration tier, and never as a separate license.

  • Native metrics — Prometheus-compatible endpoints expose every subsystem.
  • Integrated alerting — actionable alerts with full routing control.
  • External integration — webhook dispatch and standard protocols coexist with your existing stack.
  • Queue, TLS, health, security — one operator view, no tab-hopping.
  • End-to-end message trace — ingress to disposition, across every stage.
Business value

Technical capability, translated into business outcome.

Three concrete, executive-level results — not features in disguise.

Cost Control

Predictable economics

  • No SaaS subscription lock-in tied to per-seat curves
  • Infrastructure cost scales with actual consumption
  • Modular licensing matched to deployed capability
  • Reuse existing infrastructure investments

Own the cost model. Forecast it. Defend it.

Risk Reduction

Data stays where it belongs

  • Data inside a perimeter you define and audit
  • Full auditability — every admin action, every policy change
  • No hidden routing through vendor-managed infrastructure
  • No single-provider outage becoming your downtime

Less exposure. Less surprise. Less dependency.

Compliance & Sovereignty

Aligned with how Europe regulates

  • Developed in Europe, GDPR-grade alignment
  • Supports ISO 27001, NIS2, and sector frameworks
  • Data residency as an architectural choice, not a clause
  • Retention, legal hold, journaling — built in

Sovereignty by architecture, not by policy.

Audience fit

Built for the way your organization operates.

Same platform, three operational profiles. No feature gating that forces a “move up to the next tier” conversation.

SME / SMB

Independence, cost control, predictable deployment.

  • Simplified infrastructure control
  • Predictable cost structure
  • Independence from SaaS providers
  • European data-protection alignment
Fit for your team →

Enterprise

Compliance, auditability, data sovereignty, internal control.

  • Compliance & auditability
  • Data sovereignty controls
  • Role-based, auditable administration
  • Integration with existing SOC / SIEM
Request architecture review →

ISP / Telecom

Multi-tenant, white-label ready, operator-scale visibility.

  • Full multi-tenant isolation
  • High-volume mail processing
  • White-label branding per tenant
  • Per-tenant SLA reporting & APIs
Start a pilot →
Technical highlights

What you get under the hood.

A compact technical summary for the people who will actually run it.

Transport security
TLS 1.2 / TLS 1.3 · modern cipher suites only
Authentication
DKIM · SPF · DMARC with aggregate-report ingestion
Trust intelligence
MTA-STS + TLSRPT (native)
Edge protection
Greylisting · IP reputation · rate limiting
MX failover
Multi-node (mx1 / mx2 / mx3) · automatic fail-over
Access protocols
SMTP · Submission · IMAP4 · POP3 · CalDAV · CardDAV
Monitoring
Native metrics · alerting · external integration
Storage
Portable across filesystem & object-storage backends
API surface
REST administration & integration APIs
Admin model
Role-based · multi-tenant · audit-logged
Compliance
Retention · legal hold · journaling · evidence export
Deployment
On-prem · private cloud · public cloud · ISP
Frequently asked

Straight answers, before you ask.

The six questions that come up in every first conversation.

What is SEVOCOMM MTA?

SEVOCOMM MTA is a European-developed, sovereign mail platform designed for organizations that require full control over their email infrastructure, data location, and deployment model. It delivers enterprise-grade SMTP, IMAP, POP, security, and monitoring — without SaaS lock-in.

Where can SEVOCOMM MTA be deployed?

Deployment is fully decided by the customer. SEVOCOMM MTA runs identically on on-premise hardware, private cloud, public cloud (AWS, Azure, GCP, Hetzner, OVH) and ISP / telecom infrastructure. There is no vendor-managed SaaS layer and no forced tenancy.

How does SEVOCOMM MTA handle TLS and email authentication?

SEVOCOMM MTA enforces TLS 1.2 and 1.3 with modern cipher suites only. DKIM, SPF and DMARC are built into the pipeline, including aggregate-report ingestion. MTA-STS and TLSRPT are native capabilities — together forming TLS Trust Intelligence with continuous visibility into real-world delivery security and downgrade attempts.

Is SEVOCOMM MTA suitable for ISPs and telecom operators?

Yes. Full multi-tenant isolation, white-label branding per tenant, high-volume mail processing, per-tenant SLA reporting, and operator-scale provisioning APIs are first-class features — not enterprise-edition gating.

How does SEVOCOMM MTA support GDPR and NIS2 compliance?

Because deployment is customer-controlled, data residency is an architectural choice rather than a contractual promise. Retention, legal hold, journaling and evidence export are built in, which supports GDPR, ISO 27001, and NIS2 programs and makes compliance auditable from first principles.

Is SEVOCOMM MTA compatible with existing Postfix or Dovecot setups?

Yes. The SMTP engine is Postfix-compatible and IMAP/POP access is Dovecot-compatible, enabling drop-in interoperability during migration. Open standards — SMTP, IMAP, POP, CalDAV, CardDAV, DKIM, SPF, DMARC, MTA-STS, TLSRPT — are used throughout, with no proprietary wrappers.

The next step

Take control of your mail infrastructure.

Sovereignty, control, and independence are not add-on features — they are the reason SEVOCOMM MTA exists. If those outcomes match your posture, the next step is a direct conversation.

You do not need permission to own your infrastructure.
You only need the right platform.