For banks and finance
Filtering that stays inside the perimeter.
Klar for servers is a Postfix milter. It scores every message before delivery, on hardware you already operate, so customer correspondence never reaches a vendor's cloud.
Talk to usThe duty
A cloud filter is an ICT third party, and DORA counts them.
Since 17 January 2025, DORA has applied. A cloud email filter is an ICT service under art. 3(21), supplied by an ICT third-party service provider under art. 3(19), and that is not a borderline reading. Every such contract belongs in your register of information (art. 28(3)) and has to carry the minimum contractual terms of art. 30(2), whether or not the function is critical or important. Where it is, exit strategies (art. 28(8)) and audit and access rights (art. 30(3)(e)) come on top.
None of that makes cloud filtering unlawful. It makes it administered, and the administration grows with what the vendor touches. Klar does not zero your obligations either: buy it and we are a supplier like any other. What changes is the thing underneath. No third party processes your customers' mail, because the classifier runs in your own SMTP path.
Regulation (EU) 2022/2554 (DORA)How Klar answers it
The classifier, in your SMTP path.
Klar for servers is a Postfix milter wrapping the same classifier that ships in the Mac app. It scores messages before delivery, so spam is rejected at the door instead of landing in mailboxes. The engine is AGPLv3, so your security team can read exactly what it does before it goes near a mail flow.
The part of Klar that reads your mail is an Apple-sandboxed Mail extension shipped without the network entitlement. It is not that we promise not to send your mail anywhere. It is that macOS refuses the connection, because the permission was never requested. Classification happens on your Mac, instantly.
What that means in practice
- No network access
- The free App Store app and its Mail extension ship without the network entitlement. macOS refuses any connection they try to open. This is a permission the app does not hold, not a policy it promises to follow.
- The model ships with the app
- The classifier is a multilingual transformer inside the app bundle. Nothing is fetched when a message arrives, so it works the same on a train as it does in the office.
- No account
- There is nothing to sign up for and no licence server the free app calls. We do not know who you are, which is the only durable way to hold no data about you.
- The engine is open source
- The scoring engine is AGPLv3. Your IT people do not have to take our word for any of this. They can read it, build it, and watch what it does.
Questions your compliance officer will ask
Is it production ready?
Not as something you can buy and deploy tomorrow. The milter is built and passes its suite, including replay and stress runs, but packaging is unfinished and we are rolling it out with design partners rather than selling a download. If you need turnkey this quarter, we are not it. If you want to shape it, this is the moment.
Where does it sit relative to our existing gateway?
In the SMTP path as a milter, behind whatever authenticates your mail. Klar reads the Authentication-Results header that your DKIM, SPF and DMARC checks already stamped rather than verifying them itself, so it has to run after them, not instead of them.
Does anything at all leave the machine?
Not from the free App Store app: it has no network permission. Klar Plus, the paid companion you install yourself, uses the network in two places, a licence check and model updates. Neither one carries your mail. Sending spam samples back to improve the filter is a separate switch, and it is off until you turn it on. The full list is on the local-first page.
Do we need a data processing agreement with you?
That is a question for your own counsel, and it depends on which part of Klar you run. The free App Store app sends us nothing, so there is nothing for us to process on your behalf. Our privacy policy sets out what we hold, which for the app is nothing at all. If you turn on spam sample contributions in Klar Plus, that changes, and you should treat it as a decision to review rather than a default.
Being precise
What we are not claiming.
We are not offering legal advice, and a spam filter does not make anyone compliant. Your obligations are yours, and your bar, your regulator or your DPO is the right place to test them. What we can tell you is exactly where the software runs and what it is permitted to do, which is the part most vendors leave you to infer.
We are also not claiming perfect filtering. No filter is, and any vendor quoting you a single accuracy number is quoting a number from their corpus, not your inbox. What we will say is that being wrong about a message on your Mac and being wrong about it on someone else's server are not the same kind of wrong.
Read the whole local-first argumentEarly access
Run it on your own mail servers.
Klar for servers is a Postfix milter. It is built and tested, and we are rolling it out with design partners rather than shipping a download. If that fits how you buy, we should talk.