mailbox.org

If you are leaving Gmail or Google Workspace because you want your mail on a server a German court, not a US one, can reach, mailbox.org is one of the few providers that can show its work. It is run by Heinlein Hosting GmbH, a Berlin company, on hardware the company says it owns outright in two Berlin data centres, under a business that has held ISO 27001 certification and BSI’s cloud security attestation C5 since early 2026. That claim rests on a public company register entry, a documented ownership chain, and a paper trail on where the servers sit, which is more than most “European” email options offer.

None of that makes mailbox.org a Google replacement in the feature-for-feature sense. It has no polished mobile app, its free tier does not exist (only a 30-day trial), and its PGP encryption is server-side by default rather than end-to-end unless you add a browser plug-in. What it offers instead is jurisdiction you can check, a pricing model that starts at one euro a month, and an ownership structure without a disclosed parent outside the EU.

What mailbox.org actually is

mailbox.org bundles email with the groupware that used to require separate contracts: calendar, contacts, a cloud drive, a browser-based office suite for documents and spreadsheets, and a GDPR-compliant video conferencing tool called Meet. It works over standard IMAP, SMTP, CalDAV and CardDAV, so it slots into Thunderbird, Outlook or a phone’s built-in mail app rather than forcing a dedicated client, according to mailbox.org’s own security documentation. PGP and S/MIME are both supported for encrypting messages, and a companion browser extension called Mailvelope adds true end-to-end encryption for anyone who wants their keys to never touch the provider’s servers, per CyberInsider’s hands-on review.

The company rebranded from “mailbox.org” to simply “mailbox” during a 2025 relaunch that also introduced a redesigned product suite, though the domain and the legal entity behind it are unchanged, according to mailbox’s own company history page. In 2026 it added EVAC, a standby communications platform businesses can activate if their primary IT is knocked out by an attack or an outage, and picked up the “Cybersecurity Made in Europe” label along with a listing in what the company calls a “Tech Sovereignty Catalogue,” per the same page.

From a school newspaper to an encrypted inbox

The company’s roots go back further than most competitors admit to. Peer Heinlein, still the CEO, started what became the business in 1989 as JPBerlin, a school newspaper project that turned into one of Germany’s first internet access and web hosting providers, according to mailbox’s history page. PGP support and spam filtering were already standard by the late 1990s. The consulting and hosting arm was formalised as Heinlein Professional Linux Support GmbH in 2004, renamed Heinlein Support GmbH in 2012.

mailbox.org itself launched in 2014, and the company is explicit about why: Edward Snowden’s NSA disclosures the year before, which the founders point to directly as the trigger, per the same history page. It won a “very good” rating from the German consumer body Stiftung Warentest that same year and again in 2016, an early proof point that outlasted plenty of privacy-email startups launched in the same wave. The company marked its tenth anniversary in 2024 with a public beta programme for ongoing product changes, then picked up “Software made in Germany” and “Software hosted in Germany” marks in 2025, per mailbox’s history timeline, labels that speak to origin and hosting location rather than to any independent security testing.

Who owns it now

In January 2021, the mailbox.org and Heinlein Hosting business lines were carved out of Heinlein Support GmbH into a new, dedicated entity: Heinlein Hosting GmbH, described in the company’s own spin-off announcement. Heinlein Hosting GmbH is a 100 percent subsidiary of Heinlein Support GmbH, registered as HRB 220010 B at the Amtsgericht Charlottenburg in Berlin, per the same announcement (a registration the dossier above lists as verified against the company’s public imprint). No outside investor or non-EU parent is disclosed anywhere in that structure.

CyberInsider’s review adds a claim worth flagging as the company’s own account rather than an audited fact: that the business is privately funded and debt-free, which the company frames as protection from the kind of outside-investor pressure that has shaped some competitors, per CyberInsider’s review. The parent, Heinlein Support GmbH, employs more than 150 people and runs a separate Linux consulting, training and hosting business alongside the mailbox brand, according to mailbox’s about-us page.

Which law it actually answers to

mailbox.org is bound by German law and the GDPR, confirmed on the company’s data protection page. That is the headline pitch against Gmail, and it holds up: a German provider cannot be compelled to hand data to a foreign government the way a US CLOUD Act order can reach a US-headquartered provider’s overseas servers.

It is not, however, a jurisdiction free of state access. Under Section 113 of the German Telecommunications Act, police and prosecutors can obtain a subscriber’s basic account data with a simple request, without a judge’s order, and the law bars the provider from telling the affected customer, a provision CyberInsider quotes directly from mailbox.org’s own privacy policy in its review. Getting at message content or server logs takes a judicial order, except where investigators claim imminent danger. Germany also sits inside the so-called 14 Eyes intelligence-sharing arrangement, and its foreign intelligence service has a documented history of cooperation with the NSA, a point CyberInsider raises as worth weighing against your own threat model rather than a disqualifying flaw. mailbox.org publishes an annual transparency report; the 2025 edition states that a quarter of authority requests were rejected as formally unlawful, per the company’s news page.

Where the servers actually sit

mailbox.org runs its mail service on hardware in two physically separate Berlin data centres, using two different infrastructure providers so that a single-site failure does not take the service down, the company explains in a dedicated post. Heinlein Hosting owns and operates that hardware itself rather than renting virtual servers from a third-party cloud, per CyberInsider’s review, which the dossier above records as a self-declared claim rather than an independently audited one; there is no public site-visit report confirming it. Electricity for the data centres and offices comes from renewable sources, the company says, and unavoidable business travel emissions are offset through atmosfair, according to the about-us page.

Certifications, and what they do not cover

mailbox.org (now trading as mailbox) holds ISO 27001 certification and passed BSI’s C5 Type 2 cloud security audit, both confirmed in January 2026, alongside a BSI IT Security Label and a data protection officer with TÜV certification, as listed on the security page and reported in the company’s own certification news. These are real third-party audits against published standards, not self-graded marketing copy, and they are the kind of paper trail Gmail’s consumer tier simply does not publish.

They cover the security management system, not the code itself. mailbox describes most of its software as open source but is upfront that some of it is not: internal backend infrastructure, including the systems that glue everything together, anti-abuse detection, and maintenance scripts, is proprietary and developed in-house, as CyberInsider’s review quotes directly from the company. Anyone auditing the claim of openness should read that distinction before assuming the whole stack is inspectable.

What you actually get, and what it costs

For individuals, mailbox.org runs three named tiers rather than a confusing feature matrix: Light at roughly one euro a month with 2 GB of mail storage and no custom domain, Standard at around three euros a month with 10 GB of mail, 5 GB of drive storage, the office suite and video conferencing, and Premium at around nine euros a month with 25 GB of mail and 50 GB of drive space, per mailbox.org’s pricing page. Paying annually knocks the Standard and Premium tiers down by roughly a sixth. Every tier includes ad-free, tracking-free inboxes, TLS checking before a message is sent, two-factor authentication, and a “digital legacy” setting for naming who can access an account after death.

Business customers buy per-mailbox pricing on top of a monthly service package. Silver starts at 25 euros a month for up to 50 mailboxes, Gold at 75 euros for up to 250, and Platinum at 250 euros a month with unlimited mailboxes and a 24/7 emergency admin hotline, with larger deployments handled through a custom enterprise quote, per the same pricing page. Everyone gets a 30-day free trial; there is no permanently free plan.

mailbox.org against Gmail and Google Workspace

The practical differences from Gmail or Google Workspace start with the business model. mailbox.org carries no advertising and states plainly that it does not build an ad-targeting profile from your inbox, while Google’s consumer products are funded by exactly that kind of data use. Jurisdiction is the second difference, a German company register entry in place of Google’s US incorporation, which matters mechanically for anyone whose compliance obligations specify EU-only processing. The toolset itself overlaps almost feature for feature, calendar, contacts, drive, office documents, video calls, but arrives without Google’s dedicated native mobile apps. You connect through IMAP, CalDAV, and CardDAV to whatever mail app you already use instead, per CyberInsider’s review.

What Gmail still wins on is polish and integration depth. Google’s own apps, its spam filtering at Google’s scale, and its ecosystem of third-party integrations are harder to match for a company mailbox.org’s size. The trade a switcher is making is Google’s convenience for a jurisdiction and a data-handling story that can be checked against a public register rather than taken on faith.

Who it fits, and who should look elsewhere

mailbox.org fits a German or EU-based business, school, or public-sector body that wants provable German jurisdiction for staff mail, wants groupware bundled in, and does not need a headline consumer mobile app. It fits privacy-conscious individuals willing to pay a small, transparent monthly fee instead of trading their inbox for ad targeting; the customer references on the company’s own site skew toward exactly this crowd, IT security firms, schools, small manufacturers, visible on the about-us page.

It fits less well for anyone who needs a dedicated mobile client out of the box, wants a free tier, or has a threat model where Germany’s 14 Eyes membership and its TKG Section 113 disclosure rule are disqualifying on their own; Swiss or Icelandic providers sit outside that specific concern in a way Germany does not. And for teams already deep in Google’s ecosystem, migrating groupware and mail together is real work, even with mailbox.org’s own migration partner, Audriga, handling calendars, contacts, mail and cloud files during the move, as described on the pricing page.

The dossier above shows exactly what is verified against public registers and regulators and what rests on the company’s own word; read that alongside this profile before deciding whether the trade-off suits your organisation.

Sources

• mailbox: About us - our mission
• mailbox: Spin-off of mailbox.org into a custom limited liability company
• mailbox: Legal notice
• mailbox: Data Protection
• mailbox: Security
• mailbox: Our price plans
• mailbox: Why we have two data centres at mailbox.org
• CyberInsider: Mailbox.org Review, 2026 Test Results and Analysis