OXCS GmbH

Germany · www.oxcs.net · 4 vendors

Open-Xchange GmbH is a German software company that develops open-source email, collaboration, and productivity solutions for service providers, telecommunications companies, and enterprises. Its flagship product, OX App Suite, powers hosted email and groupware services, emphasizing data sovereignty and user control through open-source architectures. The company's infrastructure solutions include robust, scalable backend technologies tailored for high-volume email and communication services.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 4 sub-vendors.

Insights

Last updated 2026-08-16 · revision 8

4 direct vendors, 82 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 8/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

OXCS GmbH exhibits a high degree of migration readiness, predominantly due to its cutting-edge, cloud-native, and containerized technical architecture. The company's tech stack, built on Docker, Kubernetes, microservices, and Infrastructure as Code (Terraform, Ansible), provides exceptional portability and flexibility, significantly reducing technical barriers to migrating platforms or services across different cloud environments. Their strong focus on open-source software (e.g., Dovecot, PowerDNS) inherently minimizes proprietary vendor lock-in at the software level, offering greater freedom in technology choices during migration. Additionally, OXCS's offering of 'Telco Email Transition' services to its clients demonstrates internal expertise and established processes for managing complex, large-scale migrations, which is a valuable asset for its own infrastructure transitions. Nevertheless, significant challenges exist, primarily stemming from the complex regulatory and data residency landscape. As a German-headquartered entity, GDPR Chapter V (international data transfers) is a critical consideration, particularly with US-based sub-processors (HubSpot, Juxo LLC) requiring ongoing Transfer Impact Assessments. Furthermore, stringent data residency requirements for German public sector and certain telco clients mandate data processing and storage within Germany or the EU/EEA, which can restrict choices for cloud providers and regions during migration. The 'Assessment Required' status for NIS2 Directive compliance means future migrations must integrate robust supply chain security and risk management measures. While ISO 27001 certification provides a strong security foundation, the lack of public SOC 2 or ISAE 3000 reports could complicate migrations if new environments or vendors need to meet these specific assurance standards for enterprise clients. Financial clarity is limited due to sparse revenue data, making it difficult to assess the capacity to fund large migration projects. The 'Vendor Lock-in Risk' is 'Unknown', though the technical flexibility mitigates internal lock-in, external vendor dependencies (e.g., IONOS, Rackspace) would require careful management during any transition.

Compliance

8 in-scope frameworks identified; showing 3.

LkSG (source) — Assessment Required

The LkSG applies to companies with 1,000+ employees in Germany (threshold reduced from 3,000 in 2024). Open-Xchange's employee count is not publicly confirmed, but as an international technology company with global operations and multiple product lines, it may approach or exceed this threshold. If applicable, the LkSG requires human rights and environmental due diligence across the supply chain, a complaints mechanism, and annual reporting to BAFA. Risk is Low because: (1) the technology sector generally has lower supply chain human rights risks than manufacturing; (2) the company already has an Ethics & Compliance program (via equeo CompCor/Grant Thornton) that partially addresses LkSG requirements; (3) if below the 1,000-employee threshold, the law does not apply.

Evidence: https://ox.io/ethics-compliance, https://oxethics-compliance.equeo-compcor.de/

ISO 27001 (source) — Compliant

Open-Xchange has publicly confirmed ISO/IEC 27001:2022 certification issued by TÜV Rheinland of North America, with the certificate publicly available for download. This is the most current version of the standard (2022 revision). ISO 27001 certification demonstrates that the company has implemented a formal Information Security Management System (ISMS) that has been independently audited and verified. Risk is Low because: (1) active certification is confirmed with documentary evidence; (2) the 2022 version of the standard is the most current, indicating up-to-date compliance; (3) TÜV Rheinland is a globally recognised and accredited certification body; (4) the certification covers the company's products and services as a technology provider. Ongoing surveillance audits are required to maintain certification, providing continuous assurance.

Evidence: https://ox.io/hubfs/0010_Main_EN_27001_2026.pdf, https://www.open-xchange.com/about-ox/why-open-xchange/ox-trust-center/, https://ox.io/hubfs/Imported%20files/TOMs_TrustCenter.pdf

NIS2 (source) — Assessment Required

Open-Xchange provides cloud-based email, collaboration, and DNS infrastructure (PowerDNS) to telecommunications companies, internet service providers, and public sector entities across the EU. Under NIS2, 'digital infrastructure' providers (including DNS service providers, cloud computing service providers, and managed ICT service providers) are classified as Essential or Important Entities. PowerDNS is a widely deployed authoritative DNS product used by carriers and ISPs — DNS service providers are explicitly listed as Essential Entities under NIS2 Annex I. OX App Suite serves as critical communication infrastructure for telcos. The company almost certainly meets the size threshold (medium/large enterprise based on its international operations, multiple product lines, and global customer base including IONOS and Rackspace). Risk is Medium because: (1) NIS2 applicability is highly likely given the digital infrastructure/DNS/cloud services profile; (2) non-compliance with NIS2 carries fines up to €10M or 2% of global turnover for Important Entities, and up to €10M or 2% of global turnover for Essential Entities; (3) Germany's NIS2 transposition (NIS2UmsuCG) entered into force in 2024, creating immediate obligations; (4) no public NIS2 compliance assessment or registration with BSI (Bundesamt für Sicherheit in der Informationstechnik) was found. Risk is not High because the company's ISO 27001:2022 certification provides a strong security baseline that overlaps significantly with NIS2 technical requirements.

Evidence: https://www.open-xchange.com/about-ox/why-open-xchange/ox-trust-center/, https://ox.io/hubfs/0010_Main_EN_27001_2026.pdf, https://www.powerdns.com/, https://www.dovecotpro.com/, https://ox.io/ox-app-suite-for-public-sector

Financials

Three-year financials

Financial Resilience Score: 5/10

OXCS GmbH appears to be a small subsidiary or service vehicle of Open-Xchange AG (Cologne, HRB 95366), a privately held German technology company backed by VC investors eCAPITAL and Iris Capital. No standalone financial disclosures are publicly available for OXCS GmbH, and as a likely 'small' GmbH under §267 HGB it may only file abbreviated balance sheets without a P&L. Group-level revenue has historically been cited in trade press at approximately €30–40 million (2018–2020), but no verified recent audited figures are available. The parent group demonstrates qualitative strengths including a long-established niche position in open-source email/collaboration since 2005, sticky recurring revenue from large telco/ISP customers (Deutsche Telekom, 1&1/IONOS), and a diversified product stack (OX App Suite, Dovecot Pro, PowerDNS). The 2025 Schleswig-Holstein migration win (~40,000 users) provides a strong reference for the European digital sovereignty tailwind. However, significant risks weigh on resilience: customer concentration among a few large telco/hosting partners, competitive pressure from Microsoft 365 and Google Workspace, private-company opacity limiting external assessment, and potential VC exit pressures. As OXCS GmbH specifically is likely a small operating entity whose economics reflect intercompany arrangements rather than standalone performance, an independent resilience assessment is not feasible from available sources.

Key strengths: Long-established niche leader in open-source email/collaboration since 2005, Sticky recurring revenue from large telco/ISP multi-year contracts, Diversified product stack: OX App Suite, Dovecot Pro, PowerDNS, European digital sovereignty tailwind (Schleswig-Holstein openDesk win 2025), Experienced VC backers (eCAPITAL, Iris Capital) on Supervisory Board, Claims hundreds of millions of end-users via telco/hoster partners

Risk factors: Customer concentration among small number of very large telco/hosting customers, Competitive pressure from Microsoft 365 and Google Workspace, Private-company opacity limits external credit/counterparty assessment, VC-backed capital structure creates potential exit/liquidity event pressures, OXCS GmbH likely small operating vehicle reflecting intercompany arrangements, not standalone economics, Sector consolidation with several OX competitors rolled up recently

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report