Security is built in layers.
Platform, identities, delivery, devices, backup and responsibility have to work as one system.
We separate confirmed MrMail practice, configurable Zimbra capabilities and decisions that belong to each customer.
Four levels
Confirmed, available or to be agreed.
Confirmed: maintenance
The Zimbra Network Edition environment operated by MrMail receives regular software and security patching.
Confirmed: backup
Zimbra data is copied every hour to storage outside the Zimbra infrastructure, with an additional daily offsite backup.
Configurable
TLS, 2FA, S/MIME, anti-spam, anti-virus, SSO, mobile controls and archiving exist according to licence, version and configuration.
Customer-specific
Identities, policies, devices, retention, restore procedures and responsibilities are assessed per solution.
No public claim is made about data-centre location, certification, immutable or air-gapped storage, retention period, RPO or RTO.
Responsibility chain
Which layer answers which question.
Platform operation
Regular software and security patching applies to the Zimbra Network Edition environment operated by MrMail. Changes still need planning in the context of that environment.
Active maintenance is confirmed; a particular patch deadline is not promised without agreement.Identity and delivery
TLS, 2FA, S/MIME, SSO, anti-spam, anti-virus and mobile controls are possible components. Domains, DNS, user processes and devices shape their use.
Availability in Zimbra does not mean automatic activation for every customer.Backup and recovery
Confirmed hourly external and daily offsite backups provide two backup cadences. A recovery case still requires solution-specific scope, retention and priority decisions.
Backup frequency is not the same as a promised RPO, RTO or unlimited history.Security remains effective when technical capability, configuration and human responsibility fit together.
What the customer contributes to the assessment.
A security discussion begins with protected data, user roles, mobile devices and administrative access. Forwarding, shared accounts, and processes for people joining or leaving also belong in scope.
MrMail can configure platform capabilities and perform the agreed operation. Customers retain responsibility for authorised users, internal approvals, endpoints, organisational rules and timely reporting of suspicious activity.
A concrete compliance or recovery promise needs evidenced requirements and an appropriate agreement. Unconfirmed data-centre locations, certifications, retention periods or storage techniques are deliberately not claimed.
Clear confirmed facts are stronger than a long list of unverified security terms.
Security questions
Is every protection enabled by default?
No. Licence, version, configuration and requirements determine the controls that apply.
How long are backups retained?
No public retention period is confirmed; it has to be agreed for the solution.
How quickly can data be restored?
The site does not promise a general RTO. The need and procedure are scoped with the customer.
Define controls that fit the risk.
Describe identity, device, protection and recovery requirements.