Docs / Obsidian Suite / Start here
Overview
Obsidian Suite is a hosted email security service. It checks every message for spam, viruses, phishing and business email compromise before it reaches Microsoft 365, Google Workspace or Exchange, and gives your administrators and users a portal to manage what it holds back.
Larström Technologies runs the service for you: the servers, the mail gateway, the antivirus and reputation data, the AI model, certificates and updates. There is nothing to install on your side. Mail is processed in the United States on servers Larström Technologies owns and operates.
What it checks
- Connection screening - senders on the Spamhaus ZEN blocklist are turned away before they can send anything.
- Sender authentication - SPF, DKIM, DMARC and ARC. Mail that pretends to come from your own domains is caught.
- Reputation - Spamhaus lists for IP addresses, domains, brand-new domains and known-bad file hashes.
- Antivirus - ClamAV with additional phishing and scam signatures.
- Attachments - dangerous file types, disguised executables, macros, password-protected archives, PDF scripts and HTML smuggling.
- Links and impersonation - lookalike domains, fake display names, executive impersonation, and link text that shows one site but opens another.
- Content - phishing, payment fraud, scams, sextortion, QR-code and call-back lures.
- Learning - a Bayesian filter that learns from what you and your users report.
- AI review - an AI model reviews borderline mail and explains its reasoning. It runs on servers Larström Technologies owns and operates; message content is never sent to an outside AI provider.
Every check adds points to a score, and the score and the kind of threat decide what happens. See How filtering works.
Two ways to protect your mail
Gateway mode. Your domain's MX record points at mx1.obsidiansuite.net. Every message is scanned on its way in, before your mail platform sees it, and spam can be refused outright. This is the strongest protection.
API mode. No DNS change. Obsidian Suite connects to your mailboxes through Microsoft Graph, a Google Workspace service account or Exchange Web Services, reads new mail every two minutes and moves threats out of the mailbox. Use it for a trial, for mail you cannot re-route, or together with gateway mode.
The two work together: with both, the API connection adds user sync, sign-in with work accounts and clawback - pulling a delivered message back out of every mailbox it reached. Mail that already passed the gateway is recognized by its X-Obsidian-ID header and is not scanned twice.
Who uses what
| Role | Can do | Start at |
|---|---|---|
| Organization administrator | Your organization in the admin console: messages, quarantine, domains, connectors, users, policies, allow and block lists, learning and the audit log. | Dashboard, Quarantine |
| User | Their own mailbox in the user portal: their quarantine, their recent mail, personal allow and block lists, password and two-factor sign-in. | User portal |
Everyone signs in at https://portal.obsidiansuite.net. Your organization is separate from every other customer: its own domains, policies, lists, connectors and quarantine. Your administrators see only your mail.
Where to go next
- New customer: Getting started.
- Connecting your platform: Microsoft 365, Google Workspace or Exchange Server.
- Understanding a decision: How filtering works and the detection rule reference.
- For your users: User portal.