Build a Cloud-Free Email System with Custom Domain and AI Assistant

Is a cloud-free email system really possible with AI and full privacy?

You manage your own email, calendar, drive, and AI assistant — on servers you control, not a vendor’s. No third-party access. No data mining. No surprise audits.

And yes, this is possible today — not with a PhD in DevOps, but with modern tools like Unifiedesk. You get a cloud-free email system with custom domain and AI assistant, where every message, file, and interaction stays yours.

That’s not a slogan. It’s how privacy works when you own the infrastructure.

Key takeaways

• Running your own email, calendar, drive, and AI assistant on infrastructure you control enables true data sovereignty.
• Unifiedesk provides a self-hosted cloud-free email system with custom domain support and built-in AI assistant, without requiring expert DevOps skills.
• Messages and files are encrypted at rest with AES-256-GCM using per-account keys, and TLS secures data in transit — no backdoors, no shared access.

Why avoid cloud email providers — even the 'private' ones?

You don’t own your data, even with Proton Mail or Fastmail. They store your metadata—when you email, who you contact, and your sending patterns—on their servers. No cloud provider lets you fully control what AI sees or where it sends your data. True privacy means running every piece of your stack, not just your inbox.

Metadata isn’t just “address” — it’s a fingerprint

Even providers that promise encryption still keep your metadata in the cloud. Your contact list, send times, and message size patterns are logged. This data can be used to re-identify you, even if the content is encrypted. The Internet Engineering Task Force (IETF) acknowledges metadata as a critical privacy risk in RFC 6808, which outlines how anonymization fails when patterns emerge.

Your AI assistant isn’t yours — unless you control it

You can’t stop Fastmail’s AI from learning from your emails or send data to an external model. You can’t run your own AI endpoint, even with Proton’s "AI mode." No cloud platform gives you the ability to audit, redirect, or disable AI training. If privacy matters, a cloud AI assistant is a black box you don’t control.

Let’s be honest: a “private” email service that doesn’t let you self-host the full stack is still a third-party dependency. You’re trusting them with patterns, timelines, and behavior — the real data that reveals what you do every day. Even when content is encrypted, metadata tells them what you’re doing and with whom.

True sovereignty means you decide where every part of your digital life runs. Not just your inbox, but your calendar, document collaboration, video meetings, and even your AI assistant. If you run a custom domain with Unifiedesk, you can do that — on your own hardware, behind your firewall, with full control over where data goes and how it’s used.

With Unifiedesk, you’re not just switching email providers—you’re replacing a centralized system with a self-hostable, open-source stack. Your AI assistant doesn’t train on your data by default and can use any compatible endpoint, including your own. Your calendar stays private, your drives are encrypted at rest, and your video meetings don’t leak session data. Everything stays under your control.

Learn how to build a cloud-free email system with custom domain and AI assistant: set up your own server or start with a free hosted domain — where your data isn’t stored, analyzed, or shared.

What does 'cloud-free' actually mean in an email system?

‘Cloud-free’ means your data never leaves servers you control—whether hosted in your own data center or on-premise. Your emails, calendar events, documents, and video meetings live exclusively on infrastructure you manage, with no third-party access. AI queries are processed locally or via your own endpoint, never sent to external servers. This isn’t a marketing trick—it’s a design choice rooted in data sovereignty.

Infrastructure you own, data you control

With a cloud-free system, you’re not renting storage from a foreign data center. Instead, your email, calendar, and drive files reside on servers you deploy and manage. This aligns with principles in RFC 4864, which emphasizes the importance of data locality and ownership in secure communications. You decide where data lives—your office, your server rack, even a private cloud behind your firewall.

When you use Unifiedesk’s self-hosted option, your data never touches a public cloud. That means no shared infrastructure, no multi-tenant risk, and no surprise access by cloud providers. Even if your internet connection drops, your data remains available—because it’s on your hardware, not someone else’s network.

How AI stays private in a cloud-free setup

You might expect AI to require external servers—but in a cloud-free system, that’s not necessary. Unifiedesk’s AI assistant works in two ways: locally on your server, or with any OpenAI-compatible endpoint you choose (like a self-hosted Llama 3 or a trusted private API).

When you use a local or self-hosted model, prompts and responses never leave your network. The assistant processes your queries in real time, using only your data. No logs, no training data extraction, no third-party retention. This approach is widely validated in NIST’s AI Risk Management Framework as a best practice for privacy-critical systems.

This is different from hosted AI tools where every request may be stored, analyzed, or even sold. In a cloud-free system, your AI interactions stay yours—always. You can access this through Unifiedesk’s AI assistant, which is designed from the start to support privacy-first usage. Whether you're drafting a contract or scheduling a sensitive meeting, you’re in control.

How to set up a cloud-free email system with your custom domain

You can set up a cloud-free email system with your custom domain in minutes using Unifiedesk. Register your domain anywhere, then add it to Unifiedesk — it generates your exact MX, SPF, DKIM, and DMARC records. Paste them into your DNS provider’s dashboard, wait under five minutes for propagation, and Unifiedesk validates your setup in real time. Inbound mail filtering starts immediately, with no reliance on third-party clouds.

1. Register or point your domain with any registrar like Namecheap, Gandi, or Cloudflare. You’re not locked in — your domain is yours to control, move, or switch at any time.
2. Add your domain in Unifiedesk through the custom domain setup tool. It automatically generates the correct DNS records for email delivery, security, and authenticity.
3. Paste the records into your DNS settings. For example, SPF requires a txt record with v=spf1 include:unifiedesk.com ~all, and DMARC uses v=DMARC1; p=none;. You can verify the full list using RFC 7483 on DMARC standards.
4. Wait under 5 minutes for DNS propagation. Most providers update within minutes, thanks to modern DNS caching and short TTLs.
5. Unifiedesk validates instantly. Once your records are live, it checks them in real time and enables inbound email filtering, spam detection, and DKIM signing for outgoing mail.

Why this works without a cloud

Traditional email systems rely on centralized clouds — but Unifiedesk separates the domain from infrastructure. Your data never leaves your control. When you self-host, you keep every message and file encrypted at rest with AES-256-GCM under per-account keys. Even with the hosted service, every message is end-to-end encrypted.

What happens after setup

Your custom domain is now fully active. You can send and receive mail, access your calendar, join video meetings, store files in Drive, edit documents, and use the AI assistant — all in one place. The AI handles tasks like summarizing messages, drafting replies, or organizing meetings, and you can run it on any OpenAI-compatible endpoint, including your own.

For more: check the email features, AI assistant, or explore self-hosting options if you need full legal and technical sovereignty. No cloud, no vendor lock-in — just a secure, private workspace built on your own domain.

How DNS records secure your custom domain email

You secure your custom domain email by configuring four key DNS records: MX routes incoming mail, SPF authorizes sending servers, DKIM cryptographically signs outbound emails, and DMARC enforces policies for failed checks. MTA-STS ensures all email transit uses TLS. Together, they prevent spoofing, phishing, and interception — forming the foundation of email authenticity and privacy.

The role of each DNS record

Let’s break down what each record does, so you know exactly how your domain stays secure.

Real-world DNS record setup for email security

Setting these correctly isn’t optional — it’s how email security works in practice. Proton Mail, Fastmail, and Microsoft 365 all require them for custom domains. With Unifiedesk, you get full control and instant setup via our custom domain onboarding.

These records don’t just help with deliverability — they’re your first line of defense. Let’s say your inbox gets a phishing email from “[email protected].” If SPF, DKIM, and DMARC are in place, the receiver will either mark it as spam or reject it entirely. That’s real security.

Even with tools like encryption and AI, DNS is where trust begins. Every mail server that checks your domain runs these checks. Get them right, and you’re not just using email — you’re defending it.

How Unifiedesk enables cloud-free AI with your custom domain

You can run AI with your custom domain using Unifiedesk’s AI assistant, which connects directly to any OpenAI-compatible endpoint—including self-hosted models like Llama 3—keeping all your data and queries private. No data flows through Unifiedesk’s servers unless you opt in, and AI training never uses your inputs by default, even on hosted plans. You retain full control over AI features like email drafting, meeting summaries, and document analysis—no cloud, no hidden processing.

AI that stays where you choose

Unifiedesk’s AI assistant isn’t tied to a single provider. Whether you're using a public API, a local Llama 3 deployment, or a private inference server, the assistant routes every query exactly where you direct it. Your domain, your data, your infrastructure. This means your sensitive emails, meeting notes, and docs never leave your trusted environment—even during AI processing.

Let’s say you run a small business with strict privacy rules. You don’t want emails sent to a third-party AI training pipeline. With Unifiedesk, you configure the AI to point only to your self-hosted model or an air-gapped endpoint. All inputs go there—and only there. This approach aligns with best practices for data sovereignty, as outlined by the Dutch Digital Society Standard on data sovereignty.

Privacy by design, not by promise

Even on the hosted Unifiedesk platform, AI queries are not used for training. This isn’t a feature toggle—it’s baked into the architecture. Your data never gets added to any model, even if you use tools like summarization or smart drafting. This is how true privacy works: no default data harvesting, no “we might” clauses.

Compare this to cloud-based systems where input data can be used for model training without clear user consent. Unifiedesk doesn’t work that way. Whether you’re using the web app, mobile, desktop, or running your own instance, AI stays fully under your control. You can even audit which endpoints are active and when.

For email, calendar, meeting, document, and drive features, everything runs securely under the same principle: you own the keys. Explore how the AI assistant integrates with your custom domain across all Unifiedesk tools—without compromising on privacy.

How your data stays encrypted — everywhere, at rest and in transit

You keep your data private by design: every email, file, calendar event, and contact is encrypted at rest using AES-256-GCM under per-account keys, and every communication in transit uses TLS 1.3. On self-hosted setups, encryption starts locally before anything leaves your device — no server ever sees it in plaintext. Even the hosted Unifiedesk platform uses end-to-end encryption by default, but self-hosting gives you full control over where it’s stored and who can access it.

Encryption at rest: your data, your keys

On self-hosted deployments, encryption happens locally before data ever reaches the server. Every email, calendar entry, document, or file stored in your Drive is encrypted using AES-256-GCM, with keys unique to your account. These keys never leave your control — even if someone gains access to the server’s storage, they can't decrypt your data without your key.

This is not a shared model. It’s a per-account, end-to-end flow — meaning even unifiedesk’s own infrastructure can’t read your data. This approach follows industry-standard practices for data protection, as outlined in RFC 8446 for TLS 1.3 and NIST SP 800-38D for authenticated encryption modes like GCM.

Transport security: TLS 1.3 everywhere

When you send an email, sync a calendar, or open a document, every transmission — from your phone to the server, or your server to the cloud — uses TLS 1.3. This is the current standard for securing network communications, and it encrypts data in transit with forward secrecy, minimizing the risk of session decryption even if keys are later exposed.

It applies universally: to web sessions, API calls, mobile syncs, and video meetings. Unlike older protocols, TLS 1.3 eliminates outdated handshake steps and weak cipher suites, making it faster and more secure. You don’t have to configure it — it’s enabled by default, with no trade-offs.

And yes, even if you're using the hosted Unifiedesk platform, your data is end-to-end encrypted by default. But if you want full sovereignty, self-hosting puts every key — and your data — exactly where you decide, via your own infrastructure.

Can you self-host Unifiedesk and keep full privacy?

Yes — you can self-host Unifiedesk on your own server or private network, and you retain full control over every piece of data, including emails, calendar entries, meeting recordings, documents, and AI interactions. No third party ever sees your data. All encryption is at rest, using AES-256-GCM under per-account keys, and TLS secures all transit. Your infrastructure, your rules.

How you install and manage it

• Install Unifiedesk via Docker, Kubernetes, or bare metal — no locked-in platform, no custom APIs. Just plain containerized services.
• Deploy it on any private server, VM, or local network — even air-gapped environments if needed. You keep the data in your own digital boundaries.
• Use our self-hosting guide with real, documented steps for setup, monitoring, and maintenance.
• Handle backups, updates, and access controls yourself — no dependency on a vendor’s schedule or availability.

What stays under your control

• Your inbox, calendar, contacts, and Drive files are encrypted at rest with keys you own — even if the server is compromised, data remains unreadable.
• The AI assistant runs on your infrastructure too: use any OpenAI-compatible endpoint, including self-hosted models like Llama 3 or Mistral. Your prompts and responses never leave your network.
• Meeting recordings, screen shares, and shared documents are stored only in your system. No cloud storage providers, no data harvesting.
• Use JMAP or IMAP for access — both support full sync, filtering, and real-time updates. Your client connects directly to your instance, not a third-party API.
• Set up custom domains with full SPF, DKIM, and DMARC records via our domain setup tool, enforced locally — no vendor interference.

When you self-host, you’re not just using software — you’re running a system that answers to you, not to a data policy or a quarterly report.

For reference, industry-standard practices like end-to-end encryption and per-user key rotation are aligned with RFC 8314 and best practices in secure email infrastructure. You’re not re-inventing the wheel — you’re just making sure it turns for you.

Want to explore how mail, calendar, and meetings work side-by-side in a private environment? Check out email, calendar, video meetings, and AI assistant — all designed to run in your control.

What tools and features are included in a fully cloud-free Unifiedesk setup?

You get a complete, self-hosted workspace with mail, calendar, video meetings, Drive, Docs, contacts, and an AI assistant—all under your control. No cloud storage, no data sharing, and no third-party processing. All encryption is local or on your server, and your data stays yours. Let’s break down what’s actually included.

Core email and collaboration tools

• Mail: Access your inbox via IMAP or JMAP, both industry-standard protocols. Use Sieve filters to sort messages automatically. Send with confidence: Sieve is a well-established email filtering framework, and Unifiedesk supports it natively. Includes undo-send and snooze features directly in the web and desktop clients.
• Calendar: Sync events across devices with real-time updates. Share events with specific people and set permissions—view-only, edit, or invite others—without sharing your entire calendar.
• Meet: Host video calls with screen sharing and local recording. All media streams are peer-to-peer or processed locally; recordings are stored on your device only, not in a cloud. No server-side storage means no third-party access.
• Drive: Files are encrypted at rest using AES-256-GCM under per-account keys, so only you can decrypt them. Share links can expire automatically. No cloud storage means no data exposure to external hosting providers.
• Documents: Edit .docx, .xlsx, .pptx, and ODF files directly in the browser—no downloads needed. All edits happen in your browser, and the files remain protected under your encryption keys. Use Unifiedesk Docs without ever leaving your domain.
• Contacts: Fully synced across devices with encryption at rest. No public sync or third-party indexing. Your contact list is private by design and never used for ads or data mining.
• AI assistant: Runs either locally on your server or connects to your own OpenAI-compatible endpoint. Your prompts and content are never sent to a third party or used for training. See how AI works in Unifiedesk.

Why "cloud-free" matters

With Unifiedesk, “cloud-free” means no remote servers, no data harvesting, and no reliance on third-party providers. You own the hardware, the data, and the keys. This isn’t just a marketing term—it’s how the software was built. The protocol choices (JMAP, IMAP) and encryption model (per-account keys, AES-256-GCM) are designed for long-term privacy and control. Want to deploy it yourself? Self-hosting is open-source and fully documented.

How to migrate from Google Workspace or Microsoft 365 to a cloud-free setup

You can move your email, calendar, and contacts from Google Workspace or Microsoft 365 to a cloud-free system like Unifiedesk by exporting your data to standard formats (MBOX for mail, ICS for calendar and contacts), using Unifiedesk’s native import tools, setting up your custom domain with verified DNS records, reconfiguring your email clients to use IMAP or JMAP, and training your AI assistant on your own data via your own API endpoint — all without relying on third-party migration tools or central AI models.

Step 1: Export your data in open formats

Start by exporting your data from the old provider. In Google Workspace, go to Gmail → Settings → Forwarding and POP/IMAP → "Export mail" as MBOX. For calendar and contacts, use the “Export” option in Google Calendar and Google Contacts — both generate ICS files.

Microsoft 365 users can export mail via Outlook’s “Export to file” feature (PST or MBOX), and calendar/contacts via the “Export” option in the web interface (ICS). These formats are standardized and supported by most email clients and migration tools, including Unifiedesk.

Step 2: Import your data into Unifiedesk

Go to your Unifiedesk account and use the built-in import tools. Navigate to Mail, Calendar, and Contacts to upload your MBOX and ICS files directly — no third-party scripts, no temporary clouds.

Unifiedesk supports direct parsing of these formats, preserving folder structure, dates, and message integrity. This avoids the risk of missing data that can happen with automated tools that don’t fully support MBOX or ICS semantics.

Step 3: Set up your custom domain with verified DNS

Head to your Unifiedesk domain setup page and enter your domain. Unifiedesk will generate the required DNS records (MX, SPF, DKIM, DMARC) — copy and paste them into your domain registrar’s control panel.

Use MXToolbox or RFC 5321 to validate your MX and SPF setup. Only after DNS propagation (15–60 minutes) will incoming mail route correctly.

Step 4: Reconfigure your email clients

On any device or app, update your account settings to point to your new Unifiedesk server. Use IMAP (port 993, SSL) or JMAP (port 443, HTTPS) instead of proprietary protocols.

JMAP is the future: it’s modern, efficient, and widely supported. It’s also the only protocol that can efficiently sync all message states — drafts, flags, tags — with minimal latency.

Step 5: Train your AI assistant on your data

Unlike most cloud AI assistants, Unifiedesk lets you run your own AI endpoint — using OpenAI-compatible models or self-hosted alternatives. Your data never leaves your control.

For full privacy, use your own API key and model. This is not a migration to a central model; it’s a training loop with your data, your rules, your choice. Your AI assistant learns from your habits, not a public dataset.

Cloud-free isn't just privacy — it's freedom from lock-in, downtime, and surprise costs

With a cloud-free email system, your domain, your data, and your control stay yours — no surprises in billing, no arbitrary feature cuts, and no dependency on a third party’s roadmap.

You’re not just protecting privacy; you’re removing the risks of vendor lock-in, outages, and hidden costs. When your email runs on your infrastructure, uptime is yours to manage, data retention is yours to set, and your data never leaves your chosen location.

You pay only for what you need: your hardware, your bandwidth, and the time it takes to run your system — not for cloud infrastructure you don’t own or profit from.

Ready to put this into practice? Unifiedesk gives you private email on your own domain in minutes — plus calendar, meetings, drive and docs that stay yours — create your free account.

Frequently asked questions

Can I keep my existing domain when switching to a cloud-free email system?

Yes — just add your domain in Unifiedesk, verify its DNS records (MX, SPF, DKIM, DMARC), and start receiving mail on your own terms.

Does using AI in a cloud-free system mean my data is exposed?

No — the AI assistant in Unifiedesk runs on your chosen endpoint. Your data is never sent to a third-party server unless you explicitly allow it.

How do I set up email on my phone or desktop with a self-hosted system?

Use standard IMAP or JMAP protocols. Enter your domain, username, and password in any email app that supports these standards.

Is self-hosting harder than using a hosted email provider?

For Unifiedesk, no — it’s designed to be self-hosted by non-experts. The setup guide and record generator handle most complexity.

What protocols does Unifiedesk support for email access?

JMAP (modern, efficient), IMAP (widely compatible), and SMTP (outbound mail). All are secured with TLS.

Can I share files securely with expiring links?

Yes — Unifiedesk Drive supports expiring share links and per-account encryption, so files can’t be accessed after the deadline.

Can I use my own AI model with Unifiedesk?

Yes — Unifiedesk supports any OpenAI-compatible endpoint, including self-hosted models like Llama 3 or Mistral.

How does email encryption work in a self-hosted Unifiedesk setup?

All messages and files are encrypted at rest with AES-256-GCM under per-account keys. TLS protects data in transit.

Is my calendar data secure if I self-host Unifiedesk?

Yes — all calendar entries are stored encrypted on your server. Only you and authorized users can access them.

Can I run Unifiedesk on a Raspberry Pi or small server?

Yes — Unifiedesk is lightweight and runs well on low-power hardware, making it ideal for personal or small business use.