EN
Start for free
Enterprise Trust, Maturity & Governance

Verifiable facts for CIOs, CISOs, and Compliance Auditors

Mail and groupware sit at the core of enterprise infrastructure. Here is our unvarnished documentation on release history, RFC 9116 vulnerability handling, source-code escrow, GoBD/IDW PS 880 compliance boundaries, and reproducible benchmarks.

Release History (v1.0.0) Admin Manual & Best Practices Security Disclosure (RFC 9116) Source-Code Escrow GoBD & IDW PS 880 Status SHA256SUMS.txt
Verifiable Engineering Cadence

Release History & Public Changelog

Every release passes automated protocol, cryptographic, and multi-engine integration suites (SQLite WAL, PostgreSQL® & Microsoft® SQL Server®) and ships with verifiable SHA-256 digests.

nextxch 1.0.0 · First official release

1.0.0 · 03.11.2026

Licence tiers: Free up to 6 mailboxes free forever, Business from 7 mailboxes, Enterprise from 15 mailboxes with the Microsoft protocols on request; 30-day Enterprise trial on request. Licence terms (EULA) version 2.3.

  • Protocols: Streaming ESMTP (BDAT/CHUNKING, SNI STARTTLS), IMAP4rev2, POP3, ManageSieve, JMAP with push and files (FileNode), CalDAV/CardDAV with delta sync, MTA-STS and DANE, true dual-stack IPv6 with Happy Eyeballs delivery. Enterprise: ActiveSync® (12.1 to 16.1, push), EWS, MAPI over HTTP and Autodiscover.
  • Webmail: PWA with calendar (month, week, day, agenda), invitations, series with exceptions, scheduling assistant with free/busy, rooms, booking pages and Teams meetings; contacts with photo and all fields, notes and tasks; S/MIME and OpenPGP, sharing with send as and send on behalf, source and header view, phishing check and report, switchable mail layout.
  • Admin: Sidebar with 8 areas and search, editors for accounts, domains, aliases and lists, domain rename, deep links, protocol logs with live viewer, 30-day statistics, message trace, SpamGuard and ClamAV panel, MX, STARTTLS and DANE tester, external port and PTR check, hostname change without restart, mandatory signatures, invitation by link, QR or WhatsApp and 1-click update with SHA-256 verification.
  • Security: Argon2id, 2FA, passkeys, app passwords, OIDC, Kerberos SSO (from Business) and an own OAuth 2.1 server (XOAUTH2, OAUTHBEARER, device code); dual DKIM (Ed25519 and RSA), SPF/DKIM/DMARC on every inbound message, phishing heuristics, login history, sessions with sign-out per device, IP countries, self-service unblock, Web Key Directory, CSP and HSTS.
  • Compliance: GoBD archive with S3 Object Lock (COMPLIANCE) and a warning on missing Object Lock, GoBD procedural documentation generator, full-text search across MIME, PDF, ZUGFeRD/XRechnung and OCR with German stems, umlauts, compounds and typo correction, DMARC and TLS-RPT reports, Encrypted File Share.
  • Cluster and operations: SQLite WAL, PostgreSQL® 18 active-active without Redis and Microsoft® SQL Server® (2019 to 2025, Express, Azure® SQL); built-in DNS failover (Hetzner, Cloudflare), EHLO name per node, temporary errors (SMTP 4xx) during a storage outage, Let's Encrypt, /metrics for Prometheus; packages as Windows® .msi, .deb, .tar.gz for Linux® and macOS®, multi-arch OCI image and Helm chart.
  • Integration: API v1 for calendar, rooms, bookings, contacts, directory and sharing with scoped API keys or OAuth 2.0, signed webhooks and OpenAPI 3.1; transactional send API with IP warming and provider limits, optional Reputation Shield, smarthost routes; nextxch-cli, configuration as a file (GitOps), AI conditions in Sieve rules (from Business), SCIM 2.0; migration from Exchange® 2013 to 2019, PST and hMailServer import.
  • Languages: Webmail, admin, system mails and website in 10 languages, including right-to-left Arabic; time zone picker with a world map.

Vulnerability Disclosure & Patch Targets (RFC 9116)

/.well-known/security.txt · security@nextxch.com

  • Direct Security Engineering Contact: Reports sent to security@nextxch.com go straight to core engineering at iqmeta GmbH.
  • Engineering Triage & Patch Targets: Our engineering target is human acknowledgment in < 24 hours, with hotfix releases for Critical issues (CVSS v4.0 >= 9.0) in < 48 hours and High severity (CVSS 7.0–8.9) in < 7 calendar days. Contractually binding Support SLAs are included starting at 10,000 licensed mailboxes.
  • Single-Command In-Place Patching: Monthly maintenance releases apply cleanly in seconds via install.sh --update, the Windows® .msi upgrade wizard, or pinned container tags.
  • Safe Harbor: Good-faith security research conducted under Coordinated Vulnerability Disclosure enjoys full legal Safe Harbor from iqmeta GmbH.

Source-Code Escrow & Continuity Guarantee

Protection against vendor lock-in & insolvency risk

  • Contractual Software Escrow in Germany: Upon request, iqmeta GmbH deposits the complete source tree and reproducible build toolchains (.sln, WiX .msi, Linux® packagers, SQL schemas) with an independent German escrow agent.
  • SLA & Escrow Terms (from 10,000 mailboxes): Included upon request as an Enterprise contract schedule alongside our binding Enterprise SLA starting at 10,000 mailboxes (plus external escrow agent fees), or available as an optional addendum in Tiers 1–4.
  • Zero Kill-Switch & Open Data Formats: Existing SMTP, IMAP, JMAP, and CalDAV/CardDAV service never halts even if our license servers are unreachable, and all data resides in standard PostgreSQL®/SQLite plus RFC .eml, .ics, and .vcf records.
Tax & Audit Compliance Transparency (German GoBD)

GoBD Controls, Procedural Documentation & Honest IDW PS 880 Status

Credible compliance requires precision: under German tax law (BMF GoBD), compliance is achieved jointly through technical immutability controls in software and organization-specific procedural documentation.

1. Technical Immutability Controls

Original-format retention of inbound/outbound MIME messages and embedded EN 16931 ZUGFeRD XML, cryptographic SHA-256 hash chaining, S3 Object Lock (COMPLIANCE) or filesystem WORM, Legal Hold, and a non-mutating ComplianceAuditor role.

2. Built-in Procedural Docs Generator

Starting in v1.1.0, the Admin Cockpit exports a pre-populated technical GoBD procedural documentation template (.md per GoBD Rz. 151 ff.) reflecting your live domains, retention periods, WORM backend, and auditor accounts.

3. Transparent IDW PS 880 Status

As of v1.0.0, an external auditor certificate under IDW PS 880 has not yet been issued and is currently in preparation at iqmeta GmbH. Our technical control matrix is available to compliance teams on request.

Recommended Enterprise Evaluation Path

Why we actively encourage methodical pilot testing

nextxch is a modern 2026 platform engineered by iqmeta GmbH in Waldenbuch near Stuttgart (Commercial Register HRB 748338 · VAT ID DE 294776335 · IT liability insured via exali). Validate every claim on your own hardware:

Step 1: Free Test-Domain Deployment

Deploy Free (up to 6 mailboxes, free forever) or request a 30-day Enterprise trial with the full feature set for a staging domain. Verify ESMTP, JMAP, Webmail, CalDAV/CardDAV, and run run-benchmark.sh yourself.

Step 2: Non-Destructive Parallel Sync

Mirror live mailboxes from hMailServer, Exchange®, or Dovecot in read-only TLS IMAP delta mode without touching your production MX records.

Step 3: Governed Production Cutover

Cut over MX records using pinned v1.0.0 packages, exported GoBD procedural documentation, S3 WORM retention, and direct German engineering support (contractual SLA from 10,000 mailboxes).

Governance, Audit & Security FAQ

Does nextxch hold an IDW PS 880 audit certificate?

As of v1.0.0 (November 2026), formal IDW PS 880 third-party certification is in preparation and not yet issued. Technically, nextxch implements full GoBD immutability controls (original MIME & ZUGFeRD XML retention, SHA-256 hash chaining, S3 Object Lock WORM, Legal Hold, non-mutating ComplianceAuditor role) and includes a built-in generator for the mandatory procedural documentation (GoBD Rz. 151 ff.).

Are Source-Code Escrow and a binding Enterprise SLA available?

Yes. iqmeta GmbH offers a binding Enterprise SLA and contractual source-code and reproducible build-pipeline escrow in Germany. Both are included at no extra license charge starting at 10,000 licensed mailboxes, with Source-Code Escrow also available as an optional paid addendum below that threshold. Furthermore, nextxch contains no hard kill-switch: existing mail and CalDAV/CardDAV traffic continues indefinitely even if our license servers are unreachable.

How are security vulnerabilities handled and patched?

Reports sent to security@nextxch.com (published via RFC 9116 /.well-known/security.txt) receive human triage within 24 hours. Critical vulnerabilities (CVSS >= 9.0) receive a hotfix within 48 hours; high-severity issues (CVSS 7.0–8.9) within 7 calendar days. Every package is published with verifiable SHA-256 checksums.

How can we verify the published RAM and throughput benchmarks?

Download and run our open benchmark harness (/downloads/run-benchmark.sh) against your own VM or bare-metal server. It records CPU/kernel metadata, measures exact /proc VmRSS idle and post-load memory, drives parallel ESMTP delivery with ZUGFeRD XML payloads, and reports p50/p95/p99 search latency.

Is the WBXML Mobile Push interface affiliated with or licensed from Microsoft®?

No. nextxch is a 100% independent clean-room implementation engineered by iqmeta GmbH. The optional WBXML Mobile Push interface (configurable via ActiveSync:Enabled) implements publicly documented interoperability specifications ([MS-ASHTTP]/[MS-ASCMD]/[MS-ASWBXML]) strictly for client interoperability. nextxch is neither affiliated with nor endorsed, licensed, or certified by Microsoft®, Apple®, or Google®.

Request an Enterprise Trial & Control Matrix Download Open Benchmark Script (run-benchmark.sh) Read Fair System Comparison