Compare ArkiaSuite and mailbox (formerly mailbox.org) on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Microsoft 365
France· Office Productivity Suite
Needs review
Shortlist when you want a French all-in-one workspace on operator-owned servers in Savoie with a public Art. 28 DPA and frank security limits. Skip when you need SecNumCloud/HDS, E2EE, mature Apple clients, or multi-admin 24/7 operations. Consider mailbox.org, Kolab Now or Nextcloud instead in those cases.
Germany· Office Productivity Suite
Needs review
Shortlist mailbox when you need a German-operated email-plus-collaboration suite (Mail, Drive, Office, Meet, Admin/API) on dual Berlin sites with published BSI C5 Type 1 and ISO 27001 claims. Skip when you require free forever mail or default zero-knowledge for all messages—consider Proton Mail or Tuta instead.
Highlighted rows differ between the two products.
| Feature | ArkiaSuite | mailbox (formerly mailbox.org) |
|---|---|---|
| Country of origin | France | Germany |
| Category | Office Productivity Suite | Office Productivity Suite |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | France | Germany |
| Legal entity | GS Informatique EURL (SIREN 925 179 079, RCS Chambéry) | Heinlein Hosting GmbH (Berlin; CEO Peer Heinlein) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Low |
| EU-hosted status | EU hosted | Not listed |
| Hosting / residency | Content on GS Informatique hardware in Frontenex (primary) and Faverges (encrypted backup). Payments via Stripe Payments Europe (Ireland, US-group payment processor). Password checks via Have I Been Pwned k-anonymity API. TLS via Let's Encrypt. No AWS/GCP/Azure claimed for content. | Core mailbox, Drive, and Meet on Heinlein-operated servers in German data centres in Berlin (two independent locations). Website analytics: self-hosted Matomo. Marketing site may embed Vimeo/YouTube. No public AWS/GCP/Azure product hosting region found for customer mail data. |
| Summary | French-hosted all-in-one workspace: cloud files, email, browser office docs, calendar and photo backup on the operator's own servers in Savoie. | German paid digital workplace from Heinlein Hosting GmbH: secure email with PGP/S/MIME, Drive, browser Office, Meet, and business Admin on dual Berlin data centres. |
| Tags |
| At a glance | ArkiaSuite | mailbox (formerly mailbox.org) |
|---|---|---|
| HQ | Frontenex, Savoie, France | Berlin, Germany |
| Legal entity | GS Informatique EURL (SIREN 925 179 079) | Heinlein Hosting GmbH |
| Hosting model | Operator-owned servers (not AWS/GCP/Azure) | Not listed |
| Self-host | No (vendor-operated SaaS) | No (managed SaaS) |
| Open source | No | Not listed |
| Commercial model | Free tier + subscription storage/mail upgrades | Not listed |
| Hosting | Not listed | Own servers, dual independent Berlin sites |
| Model | Not listed | Paid subscription SaaS; trial available; no permanent free tier |
| Open standards | Not listed | IMAP/SMTP, CalDAV/CardDAV, WebDAV, PGP, S/MIME |
| Key capabilities | ArkiaSuite | mailbox (formerly mailbox.org) |
|---|---|---|
| EU-operated | Yes | Yes |
| Hosted in France | Yes | Not listed |
| Public Art. 28 DPA | Yes | Not listed |
| Free tier | Yes | Not listed |
| Files + mail + docs | Yes | Yes |
| Berlin dual-site hosting | Not listed | Yes |
| PGP + S/MIME | Not listed | Yes |
| BSI C5 Type 1 (claimed) | Not listed | Yes |
| ISO 27001 (claimed) | Not listed | Yes |
Operator-owned file sync in Savoie
ArkiaCloud stores and syncs files from Windows, browser or phone, with expiring password-protected share links, team spaces, trash and prior versions. Primary disks sit in Frontenex; nightly encrypted backups go to a second GS Informatique site in Faverges.
Email with optional custom-domain Pro
ArkiaMail provides ad-free mailboxes with spam filtering and optional two-factor authentication. Free accounts include a limited mailbox; larger boxes and ArkiaMail Pro on the customer's own domain are provisioned as paid add-ons (Pro is set up with the operator, not only self-serve).
Browser docs compatible with Office formats
ArkiaDocs offers word processing, spreadsheets and presentations in the browser with multi-user editing and claimed compatibility with Word, Excel and PowerPoint files, living on the same account as files and mail.
Calendar, contacts and photo backup
ArkiaAgenda syncs shared calendars, contacts and tasks with phone and desktop clients. ArkiaPhotos backs up phone photos and groups them by date, place and face; face templates are computed on Frontenex servers and can be disabled on request.
Windows desktop app shipping now
A native Windows 10/11 64-bit app (site lists version 1.6.0) auto-syncs chosen folders and opens mail, files, docs and calendar in one window. Android is described as in Play Store review; macOS and iOS clients are still in development.
PGP Guard, S/MIME, and hardened mail transport
Webmail Guard for PGP without extra software (or Mailvelope with local keys), S/MIME for sign/encrypt, 2FA and app passwords, multi-stage spam/virus rejection, plus public transport controls (DNSSEC, DANE, MTA-STS, DMARC/DKIM/SPF, TLS checker, @secure.mailbox.org aliases). Benefits security-minded teams that still need interoperable IMAP/SMTP; content is not zero-knowledge by default unless you encrypt.
Drive on dual independent Berlin sites
Cloud files on the provider's own German infrastructure with two independent Berlin locations, WebDAV, mobile apps, guest share links, expandable quota, and optional client-side OpenPGP encryption of stored files. Fits teams replacing consumer cloud drives while keeping residency claims concrete; confirm plan quotas on the official site.
Browser Office with CalDAV and CardDAV
Edit common office formats in the browser, share calendars and contacts via open CalDAV/CardDAV standards, plus tasks, notes, polls, and TLS-secured XMPP chat. Aimed at SMEs and schools that want collaboration without a full Microsoft desktop stack; advanced Excel macros and deep Office add-ins are not the target.
Meet video hosted in German data centres
Browser-based conferencing integrated with calendar and mail: link invites for external guests, breakout rooms, screen share, chat, surveys, and moderator controls. Privacy documentation references the OpenTalk stack; sessions run through mailbox's German data centres. Evaluate E2EE defaults and recording policies against your meeting compliance needs.
Business Admin console and automation API
Central management of domains, mailboxes, quotas, spam/virus settings, IP allowlists, and backups, with an HTTP API for larger orgs and resellers (api.mailbox.org). Supports onboarding help and partner-assisted migration. Better for multi-seat German operations than pure consumer inboxes; not a full IdP replacement without SSO design work.
| Assurance & compliance | ArkiaSuite | mailbox (formerly mailbox.org) |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party security or no-logs audit PDF found on the site. | Not found No public independent no-logs audit PDF found; operational transparency reports and BSI/ISO artefacts instead |
| ISO 27001 | Not found No ISO 27001 claim located on arkiasuite.fr. | Vendor claimed Vendor states ISO/IEC 27001:2022 on certified-quality and press pages; request current certificate in diligence |
| SOC 2 / SOC 3 | Not found | Not found No SOC 2/3 claim found on primary security/cert pages |
| GDPR / EU data protection | Vendor claimed French EURL controller/processor; public privacy policy and Art. 28 contract. Confirm fit for your processing roles. | Vendor claimed German controller Heinlein Hosting GmbH; DE hosting; detailed privacy notice; DPO privacy@mailbox.org |
| US CLOUD Act exposure (indicative) | Partial French entity with no known US parent; content on operator-owned FR servers. Residual exposure via Stripe (US-group payments) and Have I Been Pwned password API. Not legal advice. | Partial EU/German entity, no known US parent, self-operated Berlin hosting for core data—no AWS/GCP/Azure product region found. Residual: marketing embeds (Vimeo/YouTube) and possible external payment services. Indicative assessment only, not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Public Art. 28 subcontracting agreement accepted at signup/order; printable signature annex available. | Vendor claimed Business knowledge base: customers can conclude a DPA online; historic AVV portal for business accounts |
| EU AI Act | Not applicable Face grouping on photos is a biometric-adjacent feature for the account holder's own library; product is not marketed as a general-purpose AI system. | Not applicable Email/collaboration suite, not an AI product core |
| SecNumCloud / HDS | Not found Vendor materials do not claim SecNumCloud or HDS; submitter also stated none. | Not listed |
| BSI C5 | Not listed | Vendor claimed Vendor press (7 Jan 2026): BSI C5 Type 1 attestation for mailbox; confirm type, scope, and period |
| Considerations & known limitations | ArkiaSuite | mailbox (formerly mailbox.org) |
|---|---|---|
| No disk encryption at rest on site | Medium Vendor states Frontenex disks are protected by physical lock, not encryption at rest. Off-site backups are encrypted because they travel. Theft of powered-off disks or physical access is a different threat model than hyperscaler encrypted volumes. | Not listed |
| No end-to-end encryption | Medium Administrator access can technically read stored files. Fine for many SMEs that need server-side search and previews; incompatible with E2EE mandates. | Not listed |
| Single-operator support and admin | Medium Art. 28 text states only Gérald Sonzogni has admin access and answers support. Strong accountability, weak redundancy for holidays, illness or exit planning. | Not listed |
| Limited non-Windows clients | Medium Windows app ships; Android and Apple clients are not fully released. Browser access mitigates some gaps but not all mobile workflows. | Not listed |
| No SecNumCloud, HDS or public audit | High No independent audit, ISO 27001, SOC 2, SecNumCloud or HDS found. Public-sector and health buyers with those gates must look elsewhere. | Not listed |
| US-group payment subprocessor | Low Stripe Payments Europe processes cards. Content is said not to leave GS Informatique servers, but payment metadata still involves a US-group processor. | Not listed |
| Mail is not zero-knowledge by default | Not listed | Medium Without PGP/S/MIME, stored message content remains operator-accessible under legal process. Practical impact: train users or mandate Guard/S/MIME for confidential traffic. |
| C5 Type 1 is point-in-time | Not listed | Low Type 1 attestations describe design/implementation at a point in time. Re-check type (1 vs 2), scope, and renewal dates for public-sector RFPs. |
| Payment and edge processors need confirmation | Not listed | Low Core hosting is self-operated DE, but privacy text references external payment services; marketing embeds US video hosts. Ask for the current processor list with the DPA. |
| Not a full Microsoft 365 ecosystem substitute | Not listed | Medium Browser Office and Meet cover common collaboration; deep desktop macros, Graph automations, and third-party M365 marketplaces will not map 1:1. |
| No customer self-host option | Not listed | Low Organisations that must operate mail on their own iron need another stack; mailbox is multi-tenant SaaS. |
When: You need a mail-centric European suite with a longer public track record
Consider: mailbox.org or Proton Mail
Stronger mail heritage; less emphasis on operator-owned photo backup in Savoie
When: You want groupware with calendar/mail and more mature multi-platform clients
Consider: Kolab Now
Swiss/European groupware peer in the catalog
When: You want to operate the stack yourself on chosen EU infrastructure
Consider: Nextcloud
Self-host platform rather than GS Informatique-operated SaaS
When: You need default end-to-end encrypted mail as the primary product
Consider: Proton Mail or Tuta
Stronger E2EE-first posture; lighter full workplace suite than mailbox
When: You want minimal German privacy email without Drive/Office/Meet
Consider: Posteo
Leaner mailbox; fewer collaboration modules
When: You need full desktop Office parity and global SaaS integrations
Consider: Microsoft 365 (incumbent) with separate residency controls
Different risk and ecosystem tradeoff—not an EU peer