Bichon ships in three editions. Community is the open-source AGPLv3 build. Pro and Enterprise are a separate commercial build on the same core, shipped as one binary; the license you upload determines which of the two feature sets is active. GET /api/v1/features reports the active edition at runtime.
| Community | Pro | Enterprise | |
|---|---|---|---|
| Price | Free forever | TBD / license | TBD / license |
| License | AGPLv3 | Commercial | Commercial |
| Accounts (all types) | Unlimited | 5 (default) | 100 (default) |
One core, three editions
Community is the open-source AGPLv3 build — not a reduced demo. The core archiving engine (IMAP sync, storage, search, authentication, import/export) is developed in the open and shaped by community requirements. That is what keeps the core continuously evolving and stable.
Pro and Enterprise are a separate commercial codebase built on that same core, shipped as one binary and selected by license. They benefit from the core's evolution rather than being a closed, separately maintained fork: fixes and improvements that land in Community flow into the commercial builds, and the storage and data model remain compatible. Commercial surfaces — audit integrity, analytics, the built-in IMAP server, journaling, SSO, and the compliance suite — sit on top of the core.
Because the core is shared, moving from Community to Pro or Enterprise is a binary swap against the same data root, not a data migration; existing accounts, mail and indices are used as they are.
Core Archiving — all editions
- Multi-account IMAP download (password + OAuth 2.0 with Gmail, Outlook, Yahoo presets)
- Per-account SOCKS5 proxy, SSL/TLS, STARTTLS
- UID-based incremental sync with UIDVALIDITY rebuilds
- Fetch scoping, cron schedules, server auto-configuration
- Full-text search (subject, body, sender, recipients)
- Advanced filters, faceted tags, thread grouping, contacts view
- Saved searches (50 per user)
- Permission-gated, permanent message delete (no trash); bulk restore of archived messages back to their source IMAP server; remote content blocking
- Source-mailbox cleanup: scheduled or on-demand move of archived mail into
bichon_auto_created_trash(reversible; never a permanent delete) - Three-layer storage: Tantivy + bichon-blob + memdb (zero external dependencies)
- BLAKE3 content deduplication, Zstd compression
- Native incremental backup & restore (AWS S3, MinIO, R2, or a local directory)
- Multi-user RBAC: 5 built-in roles, custom roles, 27 permissions
- TOTP two-factor authentication, API tokens
- CLI import: EML, MBOX, Gmail MBOX, Thunderbird, PST; MBOX and attachment-ZIP export
- WebUI batch export: MBOX from an email search, ZIP from an attachment search — from a saved search or the current result set
- WebUI import: EML, MBOX, PST
- Embedded SMTP receiver (receive only)
- In-place message repair: re-fetch a message's missing content blobs from its source server
- REST API + OpenAPI 3.0 (
/api-docs: Swagger UI, ReDoc, Scalar, Explorer) - Dashboard analytics, 18-language WebUI, dark/light themes
Feature Matrix
| Feature | Community | Pro | Enterprise |
|---|---|---|---|
| Audit & Integrity | |||
| Audit log with tamper-evident hash chain | — | ✓ | ✓ |
| Email integrity checks & CSV reports | — | ✓ | ✓ |
| Compliance export verification | — | ✓ | ✓ |
| Runtime compliance configuration | — | ✓ | ✓ |
| Search & Analytics | |||
| Attachment metadata search | ✓ | ✓ | ✓ |
| PDF / Word attachment full-text search | — | ✓ | ✓ |
| Cross-account analytics engine + saved views | — | ✓ | ✓ |
| Access & Integrations | |||
| OIDC single sign-on | — | ✓ | ✓ |
| LDAP / Active Directory sign-in | — | — | ✓ |
| Built-in read-only IMAP server | — | ✓ | ✓ |
| View accounts (read-only, filter-scoped access) | — | ✓ | ✓ |
| SMTP journaling (archive a mail system's journal rule) | — | ✓ | ✓ |
| MCP server for AI assistants | — | ✓ | ✓ |
| White-label branding | — | ✓ | ✓ |
| Backup & Recovery | |||
| Native incremental backup & restore (S3 or local directory) | ✓ | ✓ | ✓ |
| Message repair (re-fetch missing content blobs) | ✓ | ✓ | ✓ |
| Audit log backup (delta chain) | — | ✓ | ✓ |
| Audit log export (JSONL / CSV) | — | ✓ | ✓ |
| Integrity & timestamp-anchor snapshots | — | ✓ | ✓ |
| Restore drills (verify-only) | — | ✓ | ✓ |
| Audit replayer on restore | — | ✓ | ✓ |
| Compliance Suite | |||
| Legal hold (case records, multiple active cases) | — | — | ✓ |
| Minimum retention / deletion lock | — | — | ✓ |
| Evidence pack (audit + holds + retention + anchors) | — | — | ✓ |
| GDPR erasure requests (Art. 17) | — | — | ✓ |
| RFC 3161 timestamp anchoring | — | — | ✓ |
| SIEM webhook forwarding | — | — | ✓ |
| Dual-control approvals & break-glass | — | — | ✓ |
| Compliance officer role (SoD) | — | — | ✓ |
| Compliance dashboard | — | — | ✓ |
| Time-limited role delegation | — | — | ✓ |
Upgrades and third-party forks
As described above, moving from Community to Pro or Enterprise is a binary swap, not a data migration: run the Pro/Enterprise server against the existing data root and upload the license. Existing accounts, mail and indices are used as they are.
The data model also carries edition-specific records — audit chains, legal-hold cases, minimum-retention locks and compliance configuration — that only Pro and Enterprise write. Third-party forks built from the Community codebase are independent projects and are not validated against those records. Moving an instance between a fork and Pro/Enterprise, in either direction, is therefore unsupported: the fork may not understand those fields or records, and writing the affected data through it can silently drop them.
Before moving any instance to or from a third-party fork, take a full backup of the data root — plus the index and blob directories if they are overridden — and confirm compatibility with the fork's maintainers for your exact versions. This matters most for instances with legal hold or a minimum-retention lock enabled, where losing or misreading the record can break a compliance obligation. See Migration & Upgrade.
Licensing
Pro and Enterprise licenses are Ed25519-signed certificates bound to a machine ID. Upload via POST /api/v1/license/upload; check status at GET /api/v1/license/status. The license file (license.txt) lives in the data root and can be replaced offline for disaster recovery. Trial limits, the full status list, and what happens when a license lapses are covered in Licensing & Trials.
- A 30-day trial runs the Pro edition with a 2-account limit.
- The account limit (
alcclaim) caps every account, not just IMAP sync accounts —NoSyncaccounts, a journal archive and View accounts all count. The limit is a commercial boundary, so leaving any account type outside it would make it meaningless. - A license is perpetual for the release you purchase. The first 12 months include updates; from year two, an annual update subscription is required to receive new releases.
- Builds released after the updates-expiry date (
updclaim) refuse to start until the license's update coverage is renewed. The release you are already running keeps working. - During early access, update and renewal terms are confirmed with each customer before purchase.
Note: Trial and licensing details apply to the Pro server (
bichon-pro-server). The Community edition requires no license.
Source Mailbox Cleanup
Scheduled or on-demand movement of archived mail out of the source IMAP mailbox into bichon_auto_created_trash — eligibility, verification, runs, reports, and limits
Licensing & Trials
Trial limits, machine-bound licenses, activation, status states, and what happens when a license lapses