Roadmap
Four phases, from working email with AI to Enterprise deployments. We show what is done, what we are building next and how we will know something is finished.
These are estimates for a team of 2–3 people, not promises. We review them every quarter and scope can change. We ship what unblocks everything else first: payments and deliverability.
Status as of 19 October 2026 (v1.2): first versions of some Phase 1 and 2 items are already available.
Phase 0 · status: 2026-10
Working email in the browser with AI, tracking and encryption. This is the version you use today.
100% of scope delivered
DoneRegistering a name@mbox.ulewicz.space address, sessions, TOTP two-factor authentication with recovery codes, password changes and a session list.
Threads, folders, categories, search operators, labels, stars, snooze, bulk actions, attachments up to 25 MB, one-click unsubscribe and live updates.
Drafts, undo send, send later, DKIM signing and our own mail server. Incoming mail is checked for SPF, DKIM, DMARC, spam and phishing.
A pixel and rewritten links, events with client and device, a proxy-open flag, a live feed and statistics.
“Remind me if no reply”, automatic follow-ups and your own reminders.
Summaries, a morning brief, drafts, rewriting, smart replies, Copilot, natural-language search, subject lines, commitment and deadline suggestions and optional automatic triage.
OpenPGP in the browser with a private key encrypted by your passphrase, WKD, password-protected messages (AES-256-GCM, PBKDF2) and zero-access.
Templates with variables, sequences, meeting links with bookings and ICS invites, and conversation sharing via link.
Free, Pro and Business plans with limits, custom domains with DNS records and verification, and aliases.
Changing plans works without a real payment. This is the first item of Phase 1.
Phase 1 · Q4 2026 – Q2 2027
The first paying accounts, domains, mail clients and apps. The target: at least 98% inbox placement at Gmail and Outlook.
0 of 7 fully done · 5 with a first version in v1.2
In progressStripe Billing with cards, Apple Pay and Google Pay, SEPA, plus BLIK and Przelewy24. EU VAT (OSS), PDF invoices and failed-payment handling.
Already in v1.2Payments by card, BLIK and Przelewy24 (PLN) and SEPA (EUR), new Domain (9 PLN) and Team (29 PLN per user) plans, and VAT invoices. The rest of the scope, such as Apple Pay and Google Pay, is planned.
Done whenBuying Pro in production changes the plan in under 30 s, and plan changes only come through signed webhooks.
Plan-based send limits, Rspamd and ClamAV for incoming mail, bounce and complaint handling, IP warm-up and verification of new accounts.
Done whenA mail-tester score of at least 9/10, complaints under 0.1% and hard bounces under 2%.
A wizard detects your DNS provider and sets up MX, SPF, DKIM, DMARC and MTA-STS through the Cloudflare API or Domain Connect. If that isn't possible, you get records to paste.
Already in v1.2The DNS wizard walks you through records step by step, and for domains on Cloudflare setup is one click. Domain Connect is planned.
Done whenA domain on Cloudflare is ready in under 2 minutes, and SPF, DKIM and DMARC pass at Gmail.
Thunderbird, Outlook, Apple Mail and K-9 work with mbox: IMAP with IDLE, SMTP submission, app passwords and autoconfiguration. Zero-access messages stay out of IMAP because the server has no key.
Already in v1.2Connecting external mailboxes over IMAP with two-way sync, plus app passwords and sending over SMTP for desktop clients. Still to come: our own IMAP server for receiving mail in Thunderbird, Outlook and Apple Mail.
Done whenAutoconfiguration and push in under 5 s in four clients, and an imaptest compliance score of at least 95%.
Windows, macOS and Linux on Tauri 2: notifications, system tray, mailto: handling, offline work, signed updates and keys in the system keychain.
Done whenAn installer under 25 MB, startup under 2 s and 99% of sessions crash-free in the beta.
iOS and Android on Capacitor. Push notifications with no message content, biometrics and a Brief widget. You buy the subscription in the browser.
Already in v1.2An installable app (PWA) and push notifications in the browser. Native iOS and Android apps are still to come.
Done whenPush in under 10 s, no content in the payload and at least 99.5% crash-free sessions.
Owner, admin and member roles, an admin console, invitations, team templates, mailbox import from Gmail and Outlook over IMAP and a basic audit log.
Already in v1.2Team workspaces with shared inboxes, thread assignment and internal comments (Business), import from Gmail and Outlook over IMAP with a full export, and an audit log in the security center. The rest of the scope is planned.
Done whenAn admin sets up a workspace with 10 people and a domain in 30 minutes, and a 5 GB import loses no messages.
Phase 2 · Q3 2027 – Q1 2028
Shared inboxes, CRM and calendar integrations, and an AI agent that does tasks for you, but only with your approval.
0 of 9 fully done · 5 with a first version in v1.2
Plannedsupport@ and office@ handled together: thread assignment, statuses, internal notes, an “Anna is writing a reply” signal and assignment rules.
Already in v1.2The basics: shared inboxes with thread assignment and internal comments (Business). Assignment rules and SLAs are planned.
Done whenFive people on one inbox with no double replies, and changes show up in under 2 s.
First-response time, volume, template and sequence performance per person, and an hourly heat map.
Done whenMetrics match the raw data (±1%) and export to CSV.
HubSpot, Pipedrive and Salesforce: two-way contact sync, automatic thread logging, a CRM card next to the conversation, and creating deals and tasks from an email.
Done when100 threads logged with no duplicate contacts and a sync delay under 5 minutes.
CalDAV, Google and Microsoft: free and busy times in meeting links, ICS invites with the reply in the thread, and an mbox calendar of your own.
Already in v1.2A built-in calendar with invites and RSVP. Sync with Google, Microsoft and CalDAV is planned.
Done whenA booking never clashes with a busy slot (100-try test).
Claude searches, reads, writes, schedules, sets reminders and books meetings. Always as plan, preview, approval, execution, with a full log and an undo option.
Done whenAt least 90% correct results across 20 test scenarios and no email sent without approval.
Dictating drafts, voice commands and read-aloud in the apps. Processing in the EU, with an on-device option.
Already in v1.2Voice dictation of drafts in AI+. Voice commands and read-aloud are planned.
Done whenA speech-recognition error rate up to 8% for Polish and German, and dictation latency under 1.5 s.
A relationship timeline, notes, tags, company detection from domains and duplicate merging.
Already in v1.2People and mini-CRM: contact cards with history and a “keep in touch” feature. Tags, company detection and duplicate merging are planned.
Done whenMerging without losing history, and contact search under 200 ms with 50,000 contacts.
CSV import, A/B tests of steps, AI that recognises the kind of reply (out of office, interested, refusal), conditional variables and warm-up.
Done whenReply classification of at least 92% F1 for PL and DE, and zero sends outside the recipient's time window.
API tokens, webhooks, Zapier and Make, and a public OpenAPI spec.
Already in v1.2API tokens, webhooks and an MCP server for AI agents. Zapier, Make and a public OpenAPI spec are planned.
Done whenDocumentation with limits and three reference integrations.
Phase 3 · Q2 2028 – Q1 2029
Features for organisations with legal and security requirements: SSO, DLP, data residency, on-prem and next-generation cryptography.
0 of 10 items done
PlannedEntra ID, Okta, Google Workspace and Keycloak, JIT provisioning and SSO enforcement per domain.
Done whenSign-in through Entra ID and Okta works end to end, and enforced SSO blocks passwords (except a break-glass account).
Automatic creation and deactivation of users and groups from your identity provider.
Done whenAn IdP change shows up in under 60 s, and disabling a user ends their sessions in under a minute.
Content rules (national IDs, tax numbers, IBANs, card numbers, keywords, AI classifiers) and actions: warn, block, require encryption, quarantine or manager approval.
Done whenDetection of national IDs, IBANs and cards with at least 99% recall and under 2% false alarms.
Cross-mailbox search with permission and logging, export (MBOX, PST, EML) with a hash manifest, and a deletion lock for the duration of proceedings.
Done whenLegal hold prevents permanent deletion, and exports are verifiable with SHA-256 hashes.
Choose a workspace region (DE, PL, FR, CH…): separate clusters with local storage of content, indexes, backups and AI inference.
Done whenProof of location in a report and an external audit, with no content traffic between regions.
Installation at the customer (Helm or Docker Compose), an air-gapped mode with a local model or your own model provider, and a licence.
Done whenInstallation in one day following the guide, updates without downtime.
A KMS with an HSM, BYOK and HYOK for workspace keys, rotation without downtime and a key ceremony.
Done whenThe root key never leaves the HSM, and revoking a tenant key makes the data unavailable (tested).
A hybrid KEM, X25519 + ML-KEM-768, for messages and keys, optional ML-DSA signatures and MLS (RFC 9420) for group inboxes with E2E. Backward compatible with OpenPGP.
Done whenNIST test vectors pass, and encrypting 1 MB takes under 100 ms.
An immutable audit log (WORM) with SIEM export, ISO 27001, SOC 2 Type II, an annual external pentest and a bug bounty.
Done whenAn ISO 27001 certificate and no critical pentest findings open for more than 30 days.
An SLA, priority support with a technical account manager, a data processing agreement (DPA) and a public status page.
Done whenAn availability report that meets the SLA for 6 months.
How we plan
What counts is that a feature reaches users, not that the code is written.
Every item has a completion condition you can check with a test, not with an opinion.
We plan for a team of 2–3 people and review the plan every quarter. When something has to go, we cut Phase 2 before Phase 1 suffers.
Deliverability, scaling and legal compliance don't wait until the end. Without them nothing else matters.
Under the hood
Email has to reach inboxes, grow without outages and stay within the law. These three tracks run alongside the features.
We grow in stages, from a single server through PostgreSQL, object storage and queues, to separate mail nodes and multiple regions. We move to the next stage when metrics say so, not when the calendar does.
IP warm-up, SPF, DKIM and DMARC, MTA-STS, TLS-RPT, DANE and BIMI, Rspamd and ClamAV filtering, and a backup relay. Your email should land in the inbox, not in spam.
GDPR and data processing agreements, ePrivacy for tracking pixels, and the AI Act: transparency about AI-generated content and no training on your mail.
This roadmap is alive. Tell us what you want to see first and we'll get back to you.
Two minutes, no credit card. You get a @mbox.ulewicz.space address, 15 GB and an AI that starts helping from your first email.
Free @mbox.ulewicz.space address · no ads · no card
