#cmail documentation

This page is the map for all cmail documentation. cmail is pre-1.0 software: operators should read the deployment and security guides before sending real mail through it.

#Use cmail

• User guide — for anyone reading and sending mail. First sign-in, navigation, reading, composing, folders, safety, and support.
• Calendar — for anyone sending or receiving meeting invitations. Accepting and declining, creating a meeting, cancelling, and what's not included yet.
• Mobile app and notifications — for anyone on iPhone, iPad, or Android. Installing cmail and turning on new-mail alerts, plus troubleshooting.
• Push notification reliability blueprint — for engineers planning ahead. A design, not yet built, for a more durable notification pipeline.
• Mail client connectivity architecture — for anyone asking "can I use Outlook or Gmail instead?". The current PWA-only boundary and the staged plan for JMAP and optional IMAP support.
• AI agents and MCP — for anyone connecting Claude or another AI assistant, and for Managers. Browser sign-in and consent, scopes, per-mailbox sharing, the organisation switch, revocation, audit, prompt-injection stance, threat model, and limits.
• Shared mailboxes — for anyone using a team address. Delegation, Send as, Full access, shared folders and read state, and lifecycle.
• Email signatures — for anyone who sends mail, and for Managers. Personal sign-offs, the optional organisation footer, locking, and safe formatting.
• Manager handbook — for the Manager role. People, Mailboxes, Organisation, Usage policy, Mail trace, Audit log, Settings, and safe operating practice.
• Travel approvals — for Managers. Restricting sign-in to approved countries, the notification and approval flow, and the bootstrap exemption.
• Inbox rules — for anyone who wants mail filed automatically. Outlook-style rules per mailbox: conditions, exceptions, actions, ordering, and running a rule on mail that already arrived.
• Spam and quarantine — for anyone whose mail lands in Spam, and for Managers. How scoring works, what quarantine means, releasing your own mail, and organisation-wide sender allow/block rules.
• Support process — for Managers and internal support staff. L1 triage, safe evidence handling, and when to escalate to RME Solutions Technology.

#Deploy cmail

For engineers and operators setting up a deployment, roughly in this order:

1. Getting started — choose resource names, install dependencies, create Cloudflare storage, and start local development.
2. Configuration reference — set the deployment origin, mail domain, OAuth providers, safety limits, and organisation defaults.
3. Email authentication and sender requirements — read before changing mail DNS or enabling external delivery.
4. Architecture and trust boundaries — read before changing authentication, authorisation, mail flow, public data, or storage.
5. Deployment and verification — the production sequence, including identity providers, DNS, bootstrap, and controlled mail tests.
6. Security checklist and Operations checklist — complete both for every environment.
7. Running cmail — upgrade, back up, restore, roll back, monitor, and rotate secrets on a live deployment.

For staff-portal links and optional provider-session reuse, see the staff sign-in contract, including the Cloudflare Access identity boundary and live configuration checks.

#Customisation and governance

• Security, privacy, and assurance — for managers, reviewers, and auditors. The public responsibility boundary, control matrix, limitations, and a deployment evidence checklist.
• ISO and ITIL alignment — for compliance reviewers. Applicable standards, current editions, service-management practices, and the evidence an operator or support provider must establish.
• Privacy and data-handling guide — for operators and privacy reviewers. Data inventory, provider boundary, public-directory, retention, rights, and a privacy-notice checklist.
• Branding and first customisation — for whoever brands the deployment.
• Downstream and private implementations — for teams maintaining a private fork. Keeping proprietary work separate while tracking public cmail.
• Acceptable-use policy template — for Managers publishing a usage policy. A starting point to adapt and have reviewed.
• Project roadmap — where cmail is headed.
• Maintainer release guide — for maintainers cutting a release.
• September 2026 dependency upgrade review — current toolchain, major-version migrations, and compatibility boundaries.
• Developer guide — for contributors. Running locally, tests, migrations, endpoints, the email Worker, the shared package, dependencies, previews, common errors, and releasing.
• Contributing, Support, Security policy, Code of Conduct — standard project files, for contributors.

#Command reference

Run commands from the repository root:

The README has the shortest deployment path. These guides give the operational and security context behind it.