Organization brief
Provision mail for the whole organization.
Two plans. liber professional is the sync service hosted by us, with your identity provider signing people in. liber enterprise runs the whole deployment inside your perimeter. On any plan, what users save is sealed before it leaves their device and no admin can open it.
Summary
Members sign in with the identity provider you already run, over OpenID Connect. A signed account template fills in your mail server settings for each address, so the first sign-in produces a working mailbox. Later devices inherit the setup through sync.
Offboarding is one SCIM call from the identity provider. The seat is freed, the member's synced data is wiped, and the audit log records it. Access to mail is controlled at your mail server.
liber is free for personal use. Commercial use is licensed per organization, and both plans carry that license.
Provisioning and governance
| Sign in | OpenID Connect against your identity provider, such as Entra ID, Okta or Google Workspace. |
|---|---|
| User lifecycle | SCIM. Provision ahead of first sign-in, deactivate to offboard. Deactivation wipes the member's synced data and frees the seat. |
| Account templates | You define the organization's mail server settings once, with placeholders per address. Accounts come preconfigured, and managed fields are locked in the client. |
| Template signing | Templates are signed with a key only you hold, and clients verify the signature before applying anything. We cannot forge your policy. |
| Policy | Policy flags are part of the template. Remote images off by default, or credential sync disabled entirely. |
| Fleet rollout | MDM configuration on desktop and mobile delivers the realm and your signing key. Managed installs show only the organization sign-in. |
| Administration | A console at its own address, plus a command line tool for key custody, template signing and publishing. Administration never appears inside anyone's mail client. |
| Audit | Admin actions and device enrollments. Never user mail activity. |
Where an admin's reach ends
An admin can provision a member, reset a seat, and see the roster with device counts. An admin can never join a device to a member's vault and can never read what a member's devices sealed. There is no escrow key.
Removal is offboarding, not access control. Access to mail is controlled at your mail server and your identity provider. Removing a member wipes their synced configuration and frees the seat.
The two plans
| liber professional | liber enterprise | |
|---|---|---|
| Runs | On liber.sh. | On your infrastructure, behind your reverse proxy. |
| Mail path | From the apps, TLS runs straight from the device to your mail servers. From the browser at mail.liber.sh, the ciphertext goes through our forwarding service. | The client is served from your domain, so the browser relays through your own service. Mail ciphertext never leaves your network. |
| Sync data | Sealed documents on our service. | Sealed documents on your service, in one directory you back up. |
| License | Per seat, invoiced yearly. | A license file for your organization, verified offline. Nothing phones home. |
| Builds | The public releases. | Delivered to you directly. You deploy on your schedule. |
| Price | USD 48 / seat / year | By arrangement |
The perimeter deployment
liber enterprise is one service behind your existing reverse proxy and certificates. It serves the client on your domain, forwards encrypted mail streams it cannot read, and stores sealed sync documents in one directory. A client served from your domain relays through your service and nowhere else. That directory is the whole backup. Updating means replacing one binary. A deployed instance exchanges no traffic with liber.sh.
Deployment inside your infrastructure. TLS begins inside the engine's sandbox on each device and terminates at your mail servers.
Licensing and support
| License | Per organization. It covers your members' use of liber at work. |
|---|---|
| Verification | The license file verifies offline when the service starts. A license check can never become telemetry. |
| Renewal | Past expiry the service runs through a grace window, then sync goes read only. Reading data out always works. |
| Support | By email, with response times committed in the agreement. |
| Evaluation | The client at mail.liber.sh is the same client. The hosted service can stand in while you evaluate. |
Write with your requirements.
Seat count, identity provider, and whether the deployment must run on your infrastructure.