Home›Guides›Email
Email · Understand
A business email system can run on a platform shared between customers, on an instance reserved for your organization, or on a server installed on your premises. Where the machine sits changes less than people think: what matters is who operates it, who can open a mailbox, and how you get out. Self-hosting gives you physical control; it does not solve operations, nor does it alone ensure sovereignty.
People often talk about “cloud” versus “on-premise,” as if there were two camps. In practice, three models coexist, and they are distinguished by two questions: where the machine runs, and who runs it.
Operating an email system means applying updates, monitoring the queue and disk space, renewing certificates, backing up, restoring, responding to an incident at 7 a.m. and maintaining the domain’s sending reputation. Hosting only means providing the machine and the network.
The provider runs the entire platform. It is generally shared between several customers, with logical separation: each organization sees only its own domains and mailboxes, but the servers, storage and operations teams are shared. It is the simplest model to get started with and the cheapest to run.
An instance or a server is reserved for your organization. Your data is not stored alongside that of any other customer. The provider still operates it: you are buying isolation, not a workload. This model suits regulated sectors, large volumes, groups that want to clearly separate their companies, or settings that a shared platform cannot grant to a single customer.
The machine is on your site, in your server room or your data center. Yet someone has to operate it. Either your team does it, or a provider does it remotely, with access you grant. Both choices are legitimate; they do not cost the same and do not provide the same recovery guarantees.
Five points distinguish the three models. The others, such as webmail or Outlook compatibility, depend mainly on the software, not on the location.
| Point | Managed cloud | Dedicated | On your premises |
|---|---|---|---|
| Neighbors | Shared platform, logical separation | No other customer on the instance | Your network, your other servers |
| Updates | The provider, on its schedule | The provider, schedule sometimes negotiable | Your team or the appointed provider |
| Backups | At the provider, under its contract | At the provider, sometimes dedicated | To be organized: where, by whom, off site? |
| Who can open a mailbox | Your administrators and the operator | Your administrators and the operator | Your administrators, and the operator if there is one |
| Exit | Export and MX change | Export and MX change | Export, MX change, and the machine to repurpose or recycle |
On a shared platform, a spam campaign sent from another customer’s compromised account can damage the reputation of the shared sending IP address. A dedicated instance, or a dedicated IP address, isolates this risk. On your premises, the neighbor is your own network: an infected workstation can reach the server if it is not segmented.
This is the line people fill in too quickly. Whoever can restore a mailbox can read it, whatever the model. Location does not remove this access; it only changes the list of people who have it. The useful questions are therefore: who holds the administration accounts, are these accesses named and logged, and does the contract prohibit the operator from opening a mailbox except at the customer’s request. Only end-to-end encryption, for which you keep the private key, for example with S/MIME, makes the content of a message unreadable for the operator.
The domain name must remain in your name: its MX record designates the server that receives your mail, and you must be able to change it without asking for permission. The rest has to be prepared: export of mailboxes in a standard format, including calendars and contacts, export lead time, deletion after the end of the contract.
Putting the server on your premises answers one specific question: where the disks physically are. The guide what is a sovereign cloud points out that at least three others remain: which company operates it, which law applies to that company, and how you get out.
A server within your walls can thus remain dependent on outside parties without it being visible:
Conversely, a hosted service can be operated by a European company that alone has control over the data, with logged access and a written exit plan. Location remains a useful element, particularly for the record of processing activities. The hosting and sovereignty page details the options offered by Klytic.
An SME may want control without wanting to be on call. Before bringing email back in-house, take stock of what operating it really requires.
Example. A 60-person manufacturing company (hypothetical case) has a server room and wants its drawings never to leave the site. It installs email on its premises, but entrusts remote operation to a provider: updates, monitoring, restores. Its IT technician keeps control of the hardware and the network. It has the location it wanted, without carrying the on-call burden alone. It still has to write down where backups go and who can connect.
Managed cloud is suitable when you want to start quickly, without an operations team, and the logical separation and the operator’s written commitments are enough for you.
A dedicated instance is suitable when a client, a regulated sector or a multi-company group requires that your data not be stored alongside that of any other customer, without you wanting to operate it.
Your premises are suitable when data must not leave the site, when the network must be able to be isolated, or when the directory and infrastructure already exist and are maintained.
Your premises are a poor choice if they serve only to “be sovereign” without anyone having time to operate the system or to back up off site.
The features to require, whatever the model, are in what a business email system must do. Backup and recovery after an outage are covered in backup, deletion and continuity. To compare European providers, see choosing a European business email provider.
Only if you have a reason to keep the machine on site and someone to operate it, or a provider appointed to do so. On the question of sovereignty alone, the operator and the contract matter more than the location.
It removes neighbors from other customers. It does not, on its own, change who can open a mailbox or the quality of backups. Compare these two points in writing.
Yes, provided mailboxes can be exported in a standard format and the domain is in your name. The method is that of a migration without interruption.
No. A security gateway can be placed in front of the email system, somewhere else. The guide built-in filter or gateway explains this choice.
Klytic Mail is offered in all three models: in Klytic’s shared architecture, separated by customer, in a dedicated instance, or on the customer’s premises. Whatever the mode, Klytic operates the platform: maintenance, updates, security, monitoring and keeping it in operational condition. The dedicated server is set up on quotation. Switching from one mode to another is possible later.
Hosting is possible in any geographic area matching the applicable jurisdiction, subject to service availability, notably in Europe or Mauritius, or on the customer’s own servers.
Klytic Mail is the email system. Klytic MTA is the gateway that filters mail in front of it; a mixed setup is possible, for example filtering at Klytic and email on your premises. Details of the filter are in built-in filter or gateway.
Klytic teams are prohibited from accessing customers’ email accounts; technical access is controlled and audited. Messages are encrypted at rest with keys managed by Klytic, which protects the storage media; for content unreadable by Klytic, the customer encrypts end to end with its own private key, for example with S/MIME.
What the offering does not cover: an email system you would operate alone, without Klytic, on your own server. Klytic is not SecNumCloud-qualified; if a client requires it, this offering does not meet that requirement.
This page describes a general framework. It does not replace an analysis of your contract or your infrastructure.
Consulted in October 2026.
Constraints, existing infrastructure, preferred region: an advisor reviews your context and recommends a hosting mode.
Welcome offer
No-commitment trial offer. An advisor will call you back to understand your needs and prepare your Klytic space.
