SharpMailserver SHARPMAILSERVER
DEEN
Start 30-day trial
Enterprise Trust, Maturity & Governance

Verifiable facts for CIOs, CISOs, and Compliance Auditors

Mail and groupware sit at the core of enterprise infrastructure. Here is our unvarnished documentation on release history, RFC 9116 vulnerability handling, source-code escrow, GoBD/IDW PS 880 compliance boundaries, and reproducible benchmarks.

Release History (v1.2.0) Security & Patch SLAs Source-Code Escrow GoBD & IDW PS 880 Status SHA256SUMS.txt
Verifiable Engineering Cadence

Release History & Public Changelog

Every release passes automated protocol, cryptographic, and dual-storage integration suites (SQLite WAL & PostgreSQL) and ships with verifiable SHA-256 digests.

SharpMailserver v1.2.0 — Native Exchange ActiveSync (EAS 16.1), Apple Notes Bridge & Unified Tasks (VTODO/VJOURNAL)

2026-10-30 · Stable
  • Native Microsoft Exchange ActiveSync (EAS 12.1–16.1 over WBXML 1.3): Complete /Microsoft-Server-ActiveSync protocol engine (Provision, FolderSync, Sync, SendMail, SmartReply/SmartForward, Search GAL, ResolveRecipients, Settings/Oof->Sieve, MoveItems, ItemOperations & real-time Ping push) for Android, iOS Exchange accounts, and Windows Outlook with zero extra apps and stateless cluster-safe SyncKeys.
  • Bidirectional Apple Notes Bridge & CalDAV VJOURNAL / VTODO: Live cross-ecosystem sync bridging the native Apple iOS/macOS Notes app (IMAP "Notes" com.apple.mail-note), Exchange ActiveSync Notes & Tasks, CalDAV VJOURNAL/VTODO (/notes/ & /tasks/), Apple Reminders, Thunderbird, and SharpMail Webmail PWA.
  • MobileSync Autodiscover & Exchange .mobileconfig: Added Microsoft MobileSync 2006 XML & Autodiscover v2 JSON (Protocol=ActiveSync) plus PKCS#7/CMS-signed Apple com.apple.eas.account profiles.

SharpMailserver v1.1.0 — Native CalDAV/CardDAV Groupware, GoBD Procedural Docs & Open Benchmarks

2026-10-30
  • Native CalDAV (RFC 4791) & CardDAV (RFC 6352) Engine: Complete WebDAV groupware router (/dav/ plus /.well-known/caldav and /.well-known/carddav) with RFC 6578 sync-collection tokens, optimistic ETag concurrency (If-Match / If-None-Match), and per-device App Passwords for iOS, macOS, Thunderbird, and Android (DAVx⁵).
  • Webmail Calendar & Contacts + Unified Apple QR Profile: Built-in Calendar and Contacts views inside the SharpMail Webmail PWA (/mail/) backed by the live DAV store; PKCS#7-signed Apple .mobileconfig QR profiles now provision Mail, CalDAV, and CardDAV in a single scan.
  • Automated GoBD Procedural Documentation Generator: New Admin Cockpit export (/api/compliance/gobd-verfahrensdokumentation?download=true) generates pre-populated technical GoBD procedural documentation (BMF GoBD Rz. 151 ff.) from live domain retention policies and auditor roles.
  • Pinned OCI Tags & Automated SHA-256 Verification: Both install.sh and install.ps1 automatically verify SHA256SUMS.txt, and install.sh seamlessly builds sharpmailserver/server:1.1.0 locally from the verified tarball whenever a public registry mirror is offline.

SharpMailserver v1.0.2 — Cryptographic License Hardening, Kernel Memory Unmapping & Mobile UX

2026-10-29
  • Multi-layer Ed25519 signature and challenge-nonce heartbeat sealing for cluster licenses while preserving zero-interruption mail flow.
  • Immediate OS-level unmapping of transient 19 MB Argon2id login buffers (~40 MB idle RSS including Webmail PWA).
  • Responsive mobile drawer and touch navigation across Admin Cockpit and Webmail PWA.

SharpMailserver v1.0.0 — PostgreSQL 18 Active-Active Clustering, S3 WORM & Windows .msi

2026-10-18
  • Horizontal active-active clustering backed 100% by PostgreSQL 18 (LISTEN/NOTIFY < 2 ms push, UNLOGGED coordination tables, pg_try_advisory_lock) with zero Redis dependency.
  • 3-stage full-text indexing across MIME, PDF, EN 16931 ZUGFeRD/XRechnung XML, and scan OCR, paired with S3 Object Lock (COMPLIANCE).
  • Interactive Windows Server .msi Setup & Upgrade Wizard (no Docker) alongside Debian/Ubuntu .deb and systemd/launchd packages.

SharpMailserver v0.9.0 & v0.8.0 — JMAP, Webmail PWA, Dual-DKIM & Core Protocol Engine

2026-06 – 2026-08
  • v0.9.0 (08/2026): JMAP (RFC 8620/8621 + SSE), SharpMail Webmail PWA, Dual-DKIM (Ed25519 + RSA-2048), DMARC/TLS-RPT analyzer, WebAuthn Passkeys, OIDC, SCIM 2.0 & 1-click hMailServer import.
  • v0.8.0 (06/2026): Streaming ESMTP (BDAT/CHUNKING, 0 ms SNI STARTTLS), IMAP4rev2 (RFC 9051), ManageSieve (port 4190), SQLite WAL + SHA-256 Zstandard blob deduplication.

Vulnerability Disclosure & Patch SLAs (RFC 9116)

/.well-known/security.txt · security@sharpmailserver.com

  • Direct Security Engineering Contact: Reports sent to security@sharpmailserver.com go straight to core engineering at iqmeta GmbH.
  • Binding Triage & Patch Targets: Human acknowledgment in < 24 hours; hotfix release for Critical issues (CVSS v4.0 >= 9.0) in < 48 hours and High severity (CVSS 7.0–8.9) in < 7 calendar days.
  • Single-Command In-Place Patching: Monthly maintenance releases apply cleanly in seconds via install.sh --update, the Windows .msi upgrade wizard, or pinned container tags.
  • Safe Harbor: Good-faith security research conducted under Coordinated Vulnerability Disclosure enjoys full legal Safe Harbor from iqmeta GmbH.

Source-Code Escrow & Continuity Guarantee

Protection against vendor lock-in & insolvency risk

  • Contractual Software Escrow in Germany: Upon request, iqmeta GmbH deposits the complete source tree and reproducible build toolchains (.sln, WiX .msi, Linux packagers, SQL schemas) with an independent German escrow agent.
  • Escrow Terms: Available as a standard Enterprise contract schedule from 150 mailboxes upward, or as an optional addendum for smaller deployments.
  • Zero Kill-Switch & Open Data Formats: Existing SMTP, IMAP, JMAP, and CalDAV/CardDAV service never halts even if our license servers are unreachable, and all data resides in standard PostgreSQL/SQLite plus RFC .eml, .ics, and .vcf records.
Tax & Audit Compliance Transparency (German GoBD)

GoBD Controls, Procedural Documentation & Honest IDW PS 880 Status

Credible compliance requires precision: under German tax law (BMF GoBD), compliance is achieved jointly through technical immutability controls in software and organization-specific procedural documentation.

1. Technical Immutability Controls

Original-format retention of inbound/outbound MIME messages and embedded EN 16931 ZUGFeRD XML, cryptographic SHA-256 hash chaining, S3 Object Lock (COMPLIANCE) or filesystem WORM, Legal Hold, and a non-mutating ComplianceAuditor role.

2. Built-in Procedural Docs Generator

Starting in v1.1.0, the Admin Cockpit exports a pre-populated technical GoBD procedural documentation template (.md per GoBD Rz. 151 ff.) reflecting your live domains, retention periods, WORM backend, and auditor accounts.

3. Transparent IDW PS 880 Status

As of v1.2.0, an external auditor certificate under IDW PS 880 has not yet been issued and is currently in preparation at iqmeta GmbH. Our technical control matrix is available to compliance teams on request.

Recommended Enterprise Evaluation Path

Why we actively encourage methodical pilot testing

SharpMailserver is a modern 2026 platform engineered by iqmeta GmbH in Waldenbuch near Stuttgart (Commercial Register HRB 748338 · VAT ID DE 294776335 · IT liability insured via exali). Validate every claim on your own hardware:

Step 1: Free Test-Domain Deployment

Deploy the Free Forever Community Edition (up to 10 mailboxes) or a 30-day Enterprise trial key on a staging domain. Verify ESMTP, JMAP, Webmail, CalDAV/CardDAV, and run run-benchmark.sh yourself.

Step 2: Non-Destructive Parallel Sync

Mirror live mailboxes from hMailServer, Exchange, or Dovecot in read-only TLS IMAP delta mode without touching your production MX records.

Step 3: Governed Production Cutover

Cut over MX records using pinned v1.2.0 packages, exported GoBD procedural documentation, S3 WORM retention, and direct German engineering support.

Governance, Audit & Security FAQ

Does SharpMailserver hold an IDW PS 880 audit certificate?

As of v1.2.0 (October 2026), formal IDW PS 880 third-party certification is in preparation and not yet issued. Technically, SharpMailserver implements full GoBD immutability controls (original MIME & ZUGFeRD XML retention, SHA-256 hash chaining, S3 Object Lock WORM, Legal Hold, non-mutating ComplianceAuditor role) and includes a built-in generator for the mandatory procedural documentation (GoBD Rz. 151 ff.).

Is Source-Code Escrow available for business continuity?

Yes. iqmeta GmbH offers contractual source-code and reproducible build-pipeline escrow in Germany for Enterprise customers (included upon request from 150 mailboxes, or available as an optional addendum below 150). Furthermore, SharpMailserver contains no hard kill-switch: existing mail and CalDAV/CardDAV traffic continues indefinitely even if our license servers are unreachable.

How are security vulnerabilities handled and patched?

Reports sent to security@sharpmailserver.com (published via RFC 9116 /.well-known/security.txt) receive human triage within 24 hours. Critical vulnerabilities (CVSS >= 9.0) receive a hotfix within 48 hours; high-severity issues (CVSS 7.0–8.9) within 7 calendar days. Every package is published with verifiable SHA-256 checksums.

How can we verify the published RAM and throughput benchmarks?

Download and run our open benchmark harness (/downloads/run-benchmark.sh) against your own VM or bare-metal server. It records CPU/kernel metadata, measures exact /proc VmRSS idle and post-load memory, drives parallel ESMTP delivery with ZUGFeRD XML payloads, and reports p50/p95/p99 search latency.

Request 30-Day Pilot Key & Control Matrix Download Open Benchmark Script (run-benchmark.sh) Read Fair System Comparison