Trust & security

For law firms, accounting practices, and other teams that need a clear answer to “where does our mail live, who can see it, and how is it protected?” Written for procurement and security questionnaires — without marketing fluff.

Short version: Polozhevets Mail Server is self-hosted software. Mail, attachments, and accounts stay on the server you deploy. We do not operate a multi-tenant inbox cloud that reads your mail. You choose the host and the country. You are the data controller under the GDPR for mail processed through your instance.

1. Who this is for

Professional services and regulated buyers often need more than a feature list. This page summarizes how the product handles residency, encryption in transit, access, deliverability authentication, and operational responsibility — so you can compare us to Google Workspace / Microsoft 365 and to DIY stacks.

2. Data residency & privacy

Your infrastructure. Deploy on a VPS or machine you control. Data does not live in a Polozhevets-hosted shared mail cloud.
Jurisdiction. You pick the region (e.g. EU member state) via your hosting provider. We can help you choose a host for free upon request.
No provider scanning of your mail for ads. We are not a free consumer inbox funded by reading content.
GDPR roles. For personal data in mailboxes, your organization is typically the controller; the product is the tool you use to process that data on your systems.

3. Encryption & transport security

SMTP and IMAP support STARTTLS and implicit TLS.
TLS certificates can be issued and renewed automatically for the web/mail endpoints you configure.
HTTP security headers (including HSTS where configured) harden the admin and webmail surfaces.
Outbound mail is signed with DKIM; SPF and DMARC records are generated for you to publish.

4. Access control & admin hygiene

Accounts Create, suspend, and delete users from the admin panel. Suspended mailboxes do not keep receiving via catch-all fall-through.

Login protection Per-IP and per-account rate limiting reduces password-guessing risk on mail and web login.

Routing Aliases, plus-addressing, catch-all, and send-as — configured in admin, not by editing the database by hand.

Keys DKIM private material is kept for signing on the server; admin DNS views are designed to show publishable public records, not to leak private keys in API responses.

Two-factor authentication for logins is on our security roadmap for teams that require it in questionnaires. Ask us for the current status when you evaluate.

5. Spam, phishing & deliverability

Inbound checks include Bayesian filtering, RBL lookups, and SPF/DKIM verification.
Phishing heuristics look for spoofing and suspicious links.
A built-in deliverability score checks SPF, DKIM, DMARC, reverse DNS (PTR), and blocklists before you go live — useful evidence for “will mail reach the inbox?”
Outbound queue with retries and bounce/NDR notices so failed delivery is visible, not silent.

6. Backups & continuity

Mail and attachments persist on the storage attached to your server. For disaster recovery, use your VPS provider’s snapshots or backup product on a defined schedule. When you ask for free VPS setup help, we recommend hosts and snapshot practices that match your residency needs.

If Polozhevets OÜ stopped operating tomorrow: your data remains on your server; the license is perpetual for the version you have; SMTP/IMAP standards mean you are not locked into a proprietary cloud export path.

7. Company & contracting

Vendor: Polozhevets OÜ (registry code 16456417), Estonia. Contact: [email protected].

License: One-time commercial license with first year of support included; optional yearly support thereafter. Full terms: Software License.

Invoices: EU B2B invoicing with VAT ID / reverse charge as applicable — confirm details when you purchase.

8. Security questionnaire shortcuts

Where is data stored? On the customer’s server / chosen VPS region.
Multi-tenant SaaS mail? No — self-hosted instance per customer license.
Encryption in transit? Yes (TLS for SMTP/IMAP/web).
Who can read mail? Operators with access to the customer’s server and credentials; not a Polozhevets-operated shared inbox farm.
Subprocessors for mailbox content? Determined by the customer’s hosting provider, not by a Polozhevets mail cloud.
Incident contact: [email protected]

9. Next step

Evaluating for a firm or regulated team? Contact us with your questionnaire or residency requirement. We reply within one business day and can help with VPS choice and setup free of charge upon request.