Six differences that matter
Where a large platform adds features to grow engagement, Ordner's design states its non-goals explicitly, each with the reason. These six are the shape of it.
Self-hosted by default
An organisation runs its own install on one machine and holds its own data and keys. In hosted mode a provider runs it for many organisations — but it is the same software and the same design, and moving from hosted to self-hosted means moving the same install, not migrating to a different product.
Passkeys only
No primary passwords anywhere in the suite: no password hashes to breach, no password policy, no breach list. Protocol clients get named, scoped, individually revocable app passwords, minted only behind a fresh passkey assertion.
The storage provider reads nothing
Every durable object — contents and names — is encrypted on the node before it reaches the object store. The design treats the provider as the adversary: it sees ciphertext, opaque names, sizes and the shape of access — nothing readable.
No call-home
The suite does not telephone a remote feed to score a message, and there is no metrics or tracing vendor built in. The defences — SPF, DKIM, DMARC, ARC, virus scanning, spam and impersonation scoring — are implemented in-house and run on the install. The runtime's external dependencies are two small libraries.
Not a features race
The design states its non-goals explicitly, each with the reason. What Ordner deliberately does not do is written down — on every page of this site, the limits are named in the same breath as the promises.
You can leave
Data is stored in the standard formats it arrived in — RFC 5322 messages, iCalendar, vCard, your files as they are. A read-only view for backup, a full export on request. Take everything out at any time; nothing holds you.
The promises, and where they are made good
Every promise traces to the design. These are the ones the whole suite is held to.
Nothing readable leaves the node
Every durable object is encrypted before the object store — contents and names included.
Standard protocols, any client
JMAP, IMAP, SMTP, CalDAV, CardDAV, WebDAV. The web apps use the same public surfaces as any other client.
No passwords
Passkeys are the only primary credential; protocol credentials are scoped and revocable.
No lock-in
Standard formats in, standard formats out. Nothing holds the data hostage.
Privacy by construction
Per-principal partitioning, erasure that erases, audit of access on someone's behalf.
Operable by a small team
One administration console, a health check for every service, settings that apply without restarts where they can.
Who it is for
Households, clubs, associations and small and medium businesses, first of all in the EU — organisations that want the standard set without renting the data to a large platform, and that can run (or contract someone to run) a single machine. It is a digital-sovereignty product: the operator and the user keep the data and the keys.
Convinced enough to look closer?
The suite, its security posture, and how to use it.