Compare Cloud Mail and Migadu on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Google Workspace, Microsoft 365, Zoho Mail
Italy· Email Services
Needs review
Shortlist Cloud Mail when you need Italian-operated, managed domain email with Plesk, Roundcube, CalDAV/CardDAV, and pre-delivery antispam on Seeweb infrastructure. Skip when you need end-to-end encrypted / zero-access mail (consider Proton Mail or Tuta) or a full Workspace/365 productivity suite (Google Workspace / Microsoft 365).
Switzerland· Email Services
Needs review
Shortlist Migadu when you need Swiss-operated, standards IMAP/SMTP hosting with unlimited addresses across many domains under flat account quotas—especially agencies and multi-domain SMEs. Skip when you need provider E2EE defaults, contractual SLA on the default offer, mailbox 2FA, or bulk/transactional sending; consider Proton Mail/Tuta for E2EE, or mailbox.org/Mailfence/Posteo/Runbox for other European professional-mail tradeoffs.
Highlighted rows differ between the two products.
| Feature | Cloud Mail | Migadu |
|---|---|---|
| Country of origin | Italy | Switzerland |
| Category | Email Services | Email Services |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Italy | Switzerland |
| Legal entity | Seeweb S.r.l. (VAT IT02043220603), Via Armando Vona 66, 03100 Frosinone | Migadu-Mail GmbH |
| Governing law | Italy / EU (forum of Frosinone referenced in general conditions) | Canton of Appenzell Ausserrhoden, Swiss Confederation (terms) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Medium |
| Hosting / residency | Seeweb-operated European infrastructure (proprietary DCs in Milan and Frosinone; group facilities also listed in Lugano, Zurich, Sofia). Cloud Mail backups: daily off-site to another Seeweb data center using IBM Spectrum Protect software. CISPE materials claim European territorial storage for covered cloud services. No public AWS/GCP/Azure hosting path found for this product. | Mail servers stated in France (EU). Payment subprocessors Stripe and PayPal (US) for billing data. Full mail infrastructure/backup subprocessor list not published by name on primary pages. |
| Summary | Seeweb’s managed professional domain email: Plesk admin, Roundcube webmail, CalDAV/CardDAV, pre-delivery antispam, and daily off-site backups on Italian/EU infrastructure. | Swiss-operated, standards-based email hosting for custom domains: unlimited addresses and multi-domain accounts priced by usage quotas, not per mailbox. |
| Tags |
| At a glance | Cloud Mail | Migadu |
|---|---|---|
| HQ | Frosinone, Italy (Seeweb S.r.l.) | Not listed |
| Group | DHH (Euronext Growth Milan) since 2020 | Not listed |
| Product type | Managed domain email hosting | Not listed |
| Admin / webmail | Plesk + Roundcube | Not listed |
| Protocols | IMAP, POP3, SMTP, CalDAV, CardDAV | Not listed |
| Open source product | No (managed service; Roundcube is the webmail UI) | No — built on open-source stack; service is proprietary SaaS |
| Self-hosted product | No | Not listed |
| Commercial model | Paid storage/mailbox packs; domain required; WhiteLabel available | Flat per-account plans by daily message quotas + soft storage |
| HQ / entity | Not listed | Migadu-Mail GmbH, Switzerland |
| Founded | Not listed | 2014 (vendor About) |
| Mail hosting | Not listed | Data centers in France (vendor Pro/Cons) |
| Self-host | Not listed | No |
| Ownership | Not listed | Bootstrapped; no outside capital (vendor claim) |
| Key capabilities | Cloud Mail | Migadu |
|---|---|---|
| Managed domain email | Yes | Not listed |
| Plesk administration | Yes | Not listed |
| CalDAV / CardDAV | Yes | Not listed |
| ISO 27001 (claimed) | Yes | Not listed |
| CISPE CoC (claimed) | Yes | Not listed |
| Italian / EU operator | Yes | Not listed |
| Swiss operator | Not listed | Yes |
| Usage-priced multi-domain | Not listed | Yes |
| SMTP/IMAP/POP3 | Not listed | Yes |
| Mail hosted in France | Not listed | Yes |
| Multi-admin + API | Not listed | Yes |
| No ads / no tracking | Not listed | Yes |
Plesk domain mail admin (mailboxes, aliases, forwards)
One admin account manages mailboxes, passwords, aliases, forwards, and auto-replies in Plesk, with quota/usage visibility per account. Suited to SMEs and resellers who want classic hosting-style control without running their own MTA.
Roundcube webmail + IMAP/POP3/SMTP on mail.truemail.it
Users access mail via Roundcube (webmail.truemail.it) or standard clients. Docs publish IMAP/POP3/SMTP endpoints with STARTTLS and SSL port options for Outlook, Thunderbird, Apple Mail, and mobile. CalDAV and CardDAV cover calendar and contacts sync.
Managed pre-delivery antispam/antivirus (no default spam folder)
Centralized filters check sender IP/domain behaviour and content before the message is accepted. Rejected spam is returned to the sender rather than filed in a default spam mailbox; false positives are handled via ticket or report@postmaster.seeweb.it. Accuracy is not claimed to be 100%.
Daily off-site backups (IBM Spectrum Protect, 30-day history)
Incremental daily backups run to a remote Seeweb data center using IBM Spectrum Protect software. Deleted mail can be requested for recovery within about 30 days; restores recover the backed-up set rather than individual selected messages, so IMAP is recommended.
Scalable domain packs + WhiteLabel resale
Plans scale from small 5 GB / 5-mailbox packs through large multi-hundred-GB packs with matching mailbox counts (up to on the order of 1,280 mailboxes). A domain is required at activation. WhiteLabel supports partners who resell branded mail on Seeweb’s managed stack.
Usage-metered accounts with unlimited addresses
Plans are flat per Migadu account. Within daily in/out quotas and soft storage guidance, create large numbers of mailboxes and host many domains without per-address fees—useful for agencies and multi-project teams. Soft storage does not hard-bounce mail; sustained over-quota use can force upgrades or limits.
Standards SMTP, IMAP4, POP3, and webmail
No proprietary client protocol. Connect Thunderbird, Apple Mail, Outlook, mutt, and others over TLS (typical endpoints imap.migadu.com:993, smtp.migadu.com:465, pop.migadu.com:995). ManageSieve filtering, aliases, pattern rewrites, identities, footers, auto-responders, and optional catch-alls cover classic postmaster needs. Data remains portable via standard protocols.
Multi-domain admin, multi-admin, and beta API
Agencies can hold many client domains under one roof, open multiple administrators (domain-scoped on higher plans), set per-domain/mailbox limits, and monitor traffic. A REST API (documented as early beta) manages domains, mailboxes, identities, forwardings, aliases, and rewrites for automation. Domain deletion stays UI-only as a safety measure.
DNS helpers and postmaster-style support
Optional built-in DNS ships mail records preconfigured; Migadu also offers DNS setup help at no extra fee and publishes diagnostics/activation flows. Support is ticket-based from people who operate the mail stack—not outsourced chat—with plan-dependent urgency outside office hours.
No ads, no product analytics cookies
Vendor policy states no advertising, no tracking of mailbox content for ads, and no website analytics cookies beyond session needs. Processing is framed for service delivery, abuse prevention, and legal obligations. Payment data still goes to Stripe and PayPal under separate processor terms.
| Assurance & compliance | Cloud Mail | Migadu |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party no-logs or mail-specific penetration audit PDF found for Cloud Mail; ISO ISMS certs are separate. | Not found Vendor claims no ad scanning/sharing of mail content; no public third-party audit PDF located. |
| ISO 27001 | Vendor claimed Vendor certifications page: ISO/IEC 27001:2022, scope includes mail services; AXE REGISTER cert IT18-27702D (listed valid until 28 Nov 2027). Not independently re-verified in a public registry by this draft. | Not found Data centers described as internationally certified; no Migadu-organization ISO 27001 certificate found on primary pages. |
| ISO 27017 / 27018 (cloud) | Vendor claimed Published on certifications page as appendices to the ISO 27001 certificate; mail services in process scope. | Not listed |
| SOC 2 / SOC 3 | Not found Not listed on the public certifications page. | Not found |
| GDPR / EU data protection | Vendor claimed Italian controller entity, named DPO, privacy policy under GDPR; product marketed as GDPR-oriented; CISPE CoC adherence claimed. | Vendor claimed Privacy policy asserts GDPR and Swiss DPA compliance; mail hosted in France per vendor. |
| CISPE Code of Conduct | Vendor claimed Certifications page: Seeweb cloud services adhere to CISPE; claims storage exclusively within European territories for covered services. | Not listed |
| US CLOUD Act exposure (indicative) | Partial EuropeanStack assessment: EU entity, DHH European group, no known US parent; public hosting story is Seeweb EU DCs and CISPE EU territory claim; backups on Seeweb off-site DCs (Spectrum Protect software, not described as US cloud mailbox SaaS). Residual gaps: no full public subprocessor list; antispam uses external reputation services not named on the docs page. Not legal advice. | Partial Swiss entity, no known US parent, mail in France; Stripe and PayPal process payments with US transfers. Infrastructure subprocessors not fully named. EuropeanStack assessment—not a vendor certification. Not legal advice. |
| Data processing agreement (B2B) | Not found No downloadable product DPA found on the marketing site; general conditions reference GDPR processing and the privacy notice. Request Art. 28 terms for mail content before go-live. | Vendor claimed Privacy page states it serves as privacy policy and DPA; confirm suitability with counsel. |
| EU AI Act | Not applicable Cloud Mail is conventional email hosting, not an AI product. | Not applicable Email hosting product; not an AI system offering. |
| Considerations & known limitations | Cloud Mail | Migadu |
|---|---|---|
| Subprocessor / antispam feed list not public | Medium Docs mention reputation services for antispam but do not publish a complete subprocessor table. Procurement should request the current list and transfer safeguards. | Not listed |
| Backup restore is set-based, not single-message | Low 30-day off-site history is useful, but restores recover the backed-up set; plan operational recovery expectations and prefer IMAP. | Not listed |
| Pre-delivery reject without default spam folder | Low Strong filtering can block legitimate senders; there is no user-visible spam quarantine by default—use tickets/reporting workflows. | Not listed |
| Not zero-access / E2EE-first mail | Medium Provider-managed conventional mail. Choose encrypted peers if the threat model assumes a compromised host provider. | Not listed |
| B2B DPA not prominent on site | Medium Treat contract/DPA negotiation as a gate for regulated workloads until Art. 28 terms and roles (controller/processor for mailbox content) are signed. | Not listed |
| US payment subprocessors (Stripe, PayPal) | Not listed | Medium Billing-related personal data can transfer to US processors under Migadu’s privacy policy. Mail content path is France/EU per vendor, but payment data is a separate CLOUD Act / transfer surface. |
| Incomplete public infrastructure subprocessor list | Not listed | Medium Primary pages name France hosting and certified DCs without a full vendor inventory for compute, storage, and backups. Procurement should request the current list and regions in writing. |
| No E2EE product default; no classic mailbox 2FA | Not listed | Medium Standards mail with TLS; vendor recommends user-side OpenPGP for strong content secrecy. IMAP 2FA is not offered; app-specific-style identities are not second-factor MFA. |
| Daily quotas and human-mail policy | Not listed | Medium Account-wide daily in/out caps and anti-bulk rules make Migadu unsuitable as a transactional/marketing ESP. Over-limit mail can be deferred or rejected after tolerance. |
| No default SLA on standard plans | Not listed | Low Vendor states standard offers lack SLAs; email is treated as asynchronous and occasionally disrupted. Enterprise SLA only via separate commercial discussion. |
| No public independent security audit | Not listed | Medium Privacy and no-ad-scanning claims are first-party. No independent audit report found for no-logs or security controls. |
When: You need zero-access / end-to-end encrypted mailboxes as the primary control
Consider: Proton Mail or Tuta
Different product class: E2EE-first vs conventional managed IMAP hosting
When: You need mail plus full productivity suite and global enterprise ecosystem
Consider: Google Workspace or Microsoft 365
Trade EU-operator focus for suite breadth and US-jurisdiction diligence
When: You want another European professional domain-mail host for comparison
Consider: Migadu, Mailfence, or Combell E-mail
Compare admin model, spam handling, restore RPO, and contract artifacts
When: You need provider-managed end-to-end encryption as the default product promise
Consider: Proton Mail or Tuta
Migadu is standards hosting with TLS; content secrecy against the operator is not the design center.
When: You want another European professional host with a different admin/encryption/residency package
Consider: mailbox.org, Mailfence, Posteo, or Runbox
Compare DPA detail, audit packaging, and whether multi-domain usage pricing still wins for your address sprawl.
When: You need full workspace suite (docs, meet, identity) rather than email hosting alone
Consider: Google Workspace, Microsoft 365, or Infomaniak-style European suites
Migadu deliberately stays postmaster-focused.
When: You need bulk or high-rate application email
Consider: A dedicated ESP (not Migadu); Amazon SES is the common Big Tech baseline—pair with EU ESPs if residency matters
Migadu rate-limits and bans intentional bulk use.