Reliability and backups

All of Cirrux runs in Exoscale’s DE-FRA1 data center in Frankfurt: the application servers, the database, and the object storage holding your mail and files. Nothing is replicated to the US, and no US company holds your data. The facility runs on 100% renewable energy, which we cover on the sustainability page.

Every service that handles your traffic runs as multiple instances on Kubernetes: the web app and API, the IMAP server, the SMTP server, and the background job workers. If one instance fails, its traffic moves to the others. Deployments are rolling, so shipping an update does not take the service down.

Mailbox structure, labels, calendars, contacts and account data live in a managed PostgreSQL cluster with automated daily backups, run and monitored by our hosting provider rather than by a script we maintain ourselves.

The actual content of your mail, along with attachments and Drive files, is stored in object storage that keeps redundant copies of every object across the facility, so a single failed disk or machine does not lose data. Every object is encrypted at rest with keys scoped to your workspace, described on the encryption page.

Cirrux runs a second, independent mail exchanger as a backup. It has no dependency on the database or the main application, so if the primary mail server is unreachable it still accepts your incoming mail, holds it, and delivers it once the primary is back. The sending side never sees a failure, and nothing bounces because of a problem on our end.

A message the recipient’s server temporarily refuses is retried for around two days, with a notice to you after about four hours and a bounce if it ultimately fails. You always find out. See deliverability for the details.