Infrastructure

Resilience: three nodes, and you in the middle

mochela.it does not live on a single machine. Mail, website, messaging (SimpleX) and video calls (Galène) run on three nodes, rented from three different providers in three countries of the European Union: Germany, Denmark and Spain.

• Every piece of data has three copies. Accounts and messages are on all three nodes: losing one loses nothing.
• Mail is served by two nodes together. Both receive, send and answer mail programs; if one stops, the other does everything alone, with nobody having to step in. The same for SimpleX: one server on each of the two, and the app uses both.
• Video calls, for now, on a single node. Galène runs in Germany: if that node stops, meetings wait for it to come back. A room lives on one server only, and for now that is enough.
• Decisions are taken democratically. When a node disappears, the two left agree on who takes the lead. The third node also acts as arbiter.
• Different providers, different risks. A fault, a fire in a data centre, a provider closing down: each hits one node only.
• Everything is written down. Each node is described by configuration files, not by clicks in a control panel. A lost node is rebuilt from scratch, with another provider, with one command.

Robustness: little exposed, always checked

• Ports closed on principle. From the Internet you can reach only the web, mail, SimpleX, video calls and remote access for whoever administers the server, which opens only with a digital key, never with a password. Everything else talks only inside the encrypted network between the nodes.
• The management panel is not on the Internet. The pages for administering mail open only through the encrypted remote access. From the Internet you can reach only the pages meant for users.
• Automatic security updates, on a stable operating system. The main programs, instead, are updated by hand, one node at a time, so the service does not stop.
• The nodes check each other every five minutes. At the first fault an alert goes to an external mailbox: if mail breaks, the alert still gets through.
• Offline backups. Every night the nodes prepare a copy of the data, which ends up on our own disks, encrypted and kept offline. No backups in someone else's cloud.
• Data encrypted on the nodes too. On every node the database, messages and logs live in an encrypted volume. The key is never written on the servers: after every reboot the node stays locked until whoever administers it unlocks it. Anyone who copies a disk, or finds it among discarded ones, reads nothing.

Privacy: encrypted, minimal, confidential

The rule is simple: encrypt everything that travels, collect as little as possible, go through nobody who is not needed.

• Every connection is encrypted. Between you and mochela.it, between the nodes (a private tunnel), and towards other mail servers whenever they accept it, which is almost always. If the receiving server publishes its signed identity (DANE), mail leaves only towards that server: nobody in between can pretend to be it. The same holds for whoever writes to us: the mochela.it servers publish theirs.
• Mail locked with your key. If you use OpenPGP you can give the server your public key: from then on every incoming message is encrypted before it is stored. Only the key that locks stays on the server, not the one that opens: not even whoever runs mochela.it can read those messages. How to do it.
• Chat without identity. SimpleX needs no phone number and no user name. The mochela.it servers only pass on encrypted messages, without knowing who sends them or to whom.
• Video calls with no surprises. Audio and video are encrypted between your browser and the server; a meeting is recorded only if the organiser tells everyone beforehand, and the recording disappears from the server after five days; the chat disappears after a few hours, and the video call server does not log your IP address. They are not encrypted end to end, though: see the limits.
• Ready for quantum computers. HTTPS connections to the website, the mail pages and the video calls use a hybrid key exchange, classical and post-quantum together: whoever records the traffic today will not be able to open it tomorrow with a quantum computer.
• No middleman for names. To deliver a mail, the server first has to ask the Internet's address book (the DNS) where the recipient's mail lives. Many servers ask a service run by a big company, which can then see which domains their users correspond with. The mochela.it nodes instead ask directly whoever answers for each domain: no middleman collects the list of domains you write to or receive from.
• The website does not record who visits it. Your IP address is not kept in the logs, and there are no cookies, hidden programs or content taken from other sites.
• Anti-spam without spies. To recognise spam, only the server delivering the mail is checked, never the content, the links or the addresses in the messages. No external artificial intelligence reads your mail.
• Nothing added on the way out. When you send, the server does not write into the mail the IP address you connected from.

Checked from outside

We don't ask you to take our word for it. On 1 October 2026 we had mochela.it's mail tested by MECSA (My Email Communications Security Assessment), the public tool of the European Commission's Joint Research Centre. MECSA doesn't just look at the configuration: it exchanges a real email with our server and checks how it travels, in both directions.

• STARTTLS: mail between servers travels encrypted 100
• Certificate (X.509): valid and issued to the right name 100
• SPF, DKIM, DMARC: mail sent in mochela.it's name really comes from us, signed; fake mail is rejected 100
• DNSSEC: the domain's records are signed, nobody can forge them 100
• DANE and MTA-STS: whoever writes to us can insist on encryption and check they are really talking to us 100

To check: go to mecsa.jrc.ec.europa.eu, enter the report number under Find Your Report and press Get Report. Or run the test yourself: it's free and open to everyone.

MECSA is a test, not a certification: the European Commission does not endorse or support mochela.it. The result holds for the day of the test; that's why we give the date and the number, so anyone can check it.

Why in Europe

Where data is stored decides which laws protect it, and which allow it to be taken. That is why everything that touches the data of mochela.it users is in the European Union: machines, providers, domain, certificates, backups.

• Laws on the side of people. In the Union privacy is a fundamental right: as little as possible is collected, and everyone can find out what is held about them, and have it corrected or deleted.
• Away from foreign laws. United States law allows its authorities to take data held by American companies, wherever the servers are, and to monitor people who are not American citizens. This is why the European Court of Justice has twice struck down the agreements for transferring data to the United States. With European providers, that road does not exist.
• Rights that can be enforced. Getting hold of this data takes a European judge, and the decision can be challenged before a European court.

Europe is not a perfect refuge: surveillance is debated here too, for example with the proposals for automatic scanning of messages. But there are laws, rights and courts to appeal to. And the less a service depends on providers outside the Union, the less a decision taken elsewhere can switch it off here.

Limits, stated plainly

Next steps

• Administration only inside a dedicated encrypted network: remote access for whoever administers the servers disappeared from the Internet on 14 October 2026 done
• The whole server configuration published as free software: anyone who wants a service like mochela.it can install it on their own servers, with the same files and the same instructions. The code is already public done; still to come, an installer that asks for the details and prepares everything by itself planned
• IPv6 on all nodes planned
• Encryption keys on a hardware token planned
• A second backup disk, in another place planned