Compare Cloud Mail and Runbox on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Outlook.com
Italy· Email Services
Needs review
Shortlist Cloud Mail when you need Italian-operated, managed domain email with Plesk, Roundcube, CalDAV/CardDAV, and pre-delivery antispam on Seeweb infrastructure. Skip when you need end-to-end encrypted / zero-access mail (consider Proton Mail or Tuta) or a full Workspace/365 productivity suite (Google Workspace / Microsoft 365).
Norway· Email Services
Needs review
Shortlist Runbox when you need Norwegian/EEA-hosted IMAP email with custom domains, ad-free subscription economics, and standard clients. Skip when you require default zero-access E2EE—consider Proton Mail or Tuta instead—or when you need a full Microsoft 365-style suite.
Highlighted rows differ between the two products.
| Feature | Cloud Mail | Runbox |
|---|---|---|
| Country of origin | Italy | Norway |
| Category | Email Services | Email Services |
| Open source | No | Yes |
| Self-hosted | No | No |
| Headquarters | Italy | Norway |
| Legal entity | Seeweb S.r.l. (VAT IT02043220603), Via Armando Vona 66, 03100 Frosinone | Runbox Solutions AS |
| Governing law | Italy / EU (forum of Frosinone referenced in general conditions) | Norwegian law; Personal Data Act implementing GDPR (EEA) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Medium |
| Hosting / residency | Seeweb-operated European infrastructure (proprietary DCs in Milan and Frosinone; group facilities also listed in Lugano, Zurich, Sofia). Cloud Mail backups: daily off-site to another Seeweb data center using IBM Spectrum Protect software. CISPE materials claim European territorial storage for covered cloud services. No public AWS/GCP/Azure hosting path found for this product. | Core email and account content: servers in Oslo (StackInfra) under Norwegian jurisdiction; systems management Copyleft Solutions AS (Norway). Optional third parties per privacy policy: Stripe, PayPal, Coinbase (US payments); Enom (US domains); Gandi (FR); Domeneshop (NO); JaguarPC (US default web hosting, Norway option); NodePing (US, status page). No known US parent. |
| Summary | Seeweb’s managed professional domain email: Plesk admin, Roundcube webmail, CalDAV/CardDAV, pre-delivery antispam, and daily off-site backups on Italian/EU infrastructure. | Norwegian subscription email hosting from Runbox Solutions AS: Oslo-hosted IMAP mailboxes, custom domains, CalDAV/CardDAV, and optional PGP. Ad-free; not default zero-access. |
| Tags |
| At a glance | Cloud Mail | Runbox |
|---|---|---|
| HQ | Frosinone, Italy (Seeweb S.r.l.) | Oslo, Norway |
| Group | DHH (Euronext Growth Milan) since 2020 | Not listed |
| Product type | Managed domain email hosting | Not listed |
| Admin / webmail | Plesk + Roundcube | Not listed |
| Protocols | IMAP, POP3, SMTP, CalDAV, CardDAV | Not listed |
| Open source product | No (managed service; Roundcube is the webmail UI) | Not listed |
| Self-hosted product | No | Not listed |
| Commercial model | Paid storage/mailbox packs; domain required; WhiteLabel available | Paid subscription + trial (no permanent free tier) |
| Legal entity | Not listed | Runbox Solutions AS (orgnr 996877027) |
| Founded | Not listed | Service since 2000; current AS form 2011 |
| Hosting | Not listed | Email: StackInfra Oslo; optional web hosting may default US |
| Open source | Not listed | Partial (Runbox 7 web app); not self-hosted |
| Key capabilities | Cloud Mail | Runbox |
|---|---|---|
| Managed domain email | Yes | Not listed |
| Plesk administration | Yes | Not listed |
| CalDAV / CardDAV | Yes | Not listed |
| ISO 27001 (claimed) | Yes | Not listed |
| CISPE CoC (claimed) | Yes | Not listed |
| Italian / EU operator | Yes | Not listed |
| Norwegian email hosting | Not listed | Yes |
| IMAP / POP / SMTP | Not listed | Yes |
| Custom domains | Not listed | Yes |
| 100% renewable (claimed) | Not listed | Yes |
| Runbox 7 open source | Not listed | Yes |
| Optional PGP / S/MIME | Not listed | Yes |
Plesk domain mail admin (mailboxes, aliases, forwards)
One admin account manages mailboxes, passwords, aliases, forwards, and auto-replies in Plesk, with quota/usage visibility per account. Suited to SMEs and resellers who want classic hosting-style control without running their own MTA.
Roundcube webmail + IMAP/POP3/SMTP on mail.truemail.it
Users access mail via Roundcube (webmail.truemail.it) or standard clients. Docs publish IMAP/POP3/SMTP endpoints with STARTTLS and SSL port options for Outlook, Thunderbird, Apple Mail, and mobile. CalDAV and CardDAV cover calendar and contacts sync.
Managed pre-delivery antispam/antivirus (no default spam folder)
Centralized filters check sender IP/domain behaviour and content before the message is accepted. Rejected spam is returned to the sender rather than filed in a default spam mailbox; false positives are handled via ticket or report@postmaster.seeweb.it. Accuracy is not claimed to be 100%.
Daily off-site backups (IBM Spectrum Protect, 30-day history)
Incremental daily backups run to a remote Seeweb data center using IBM Spectrum Protect software. Deleted mail can be requested for recovery within about 30 days; restores recover the backed-up set rather than individual selected messages, so IMAP is recommended.
Scalable domain packs + WhiteLabel resale
Plans scale from small 5 GB / 5-mailbox packs through large multi-hundred-GB packs with matching mailbox counts (up to on the order of 1,280 mailboxes). A domain is required at activation. WhiteLabel supports partners who resell branded mail on Seeweb’s managed stack.
Norwegian-hosted IMAP email with full-disk encryption
Mailboxes live on servers Runbox places in a StackInfra facility in Oslo under Norwegian jurisdiction, with full-disk encryption at rest and TLS (including PFS) in transit. Access via IMAP, POP, SMTP, or Runbox 7 webmail suits teams that need standard clients rather than a proprietary-only app.
Custom domains, aliases, and multi-account admin
Host mail on your own domain, manage sub-accounts from a main account, and use many aliases on Runbox domains plus unlimited aliases on customer domains. Plus-addressing and filters help separate identities without running separate mailboxes.
CalDAV/CardDAV plus optional PGP or S/MIME
Integrated calendar and contacts sync over CalDAV and CardDAV with common desktop and mobile apps. End-to-end confidentiality is user-controlled via PGP or S/MIME—not zero-access by default—so operators can still index mail for search and scan for malware.
Ad-free, subscription-funded privacy model
Runbox states it does not show ads, does not use third-party trackers such as Google Analytics, and only scans messages for spam/virus protection—not advertising. Revenue is subscription-based with a public trial period, aligning incentives away from data-mining free mail.
Runbox 7 open-source webmail on hydropowered infra
The Runbox 7 web client is published on GitHub for inspection; the hosted server stack remains largely proprietary. Email infrastructure is advertised as 100% certified renewable electricity in Norway, with additional company offset claims—useful for sustainability procurement checklists.
| Assurance & compliance | Cloud Mail | Runbox |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party no-logs or mail-specific penetration audit PDF found for Cloud Mail; ISO ISMS certs are separate. | Not found Vendor claims minimal logging and short retention windows; no public independent audit report found |
| ISO 27001 | Vendor claimed Vendor certifications page: ISO/IEC 27001:2022, scope includes mail services; AXE REGISTER cert IT18-27702D (listed valid until 28 Nov 2027). Not independently re-verified in a public registry by this draft. | Not found No Runbox ISO 27001 certificate found on primary pages (power supplier ISO 14001 is environmental, not info-sec) |
| ISO 27017 / 27018 (cloud) | Vendor claimed Published on certifications page as appendices to the ISO 27001 certificate; mail services in process scope. | Not listed |
| SOC 2 / SOC 3 | Not found Not listed on the public certifications page. | Not found No public SOC 2/3 report located |
| GDPR / EU data protection | Vendor claimed Italian controller entity, named DPO, privacy policy under GDPR; product marketed as GDPR-oriented; CISPE CoC adherence claimed. | Vendor claimed Norwegian entity; Personal Data Act implements GDPR; appointed DPO; privacy policy documents rights and retention |
| CISPE Code of Conduct | Vendor claimed Certifications page: Seeweb cloud services adhere to CISPE; claims storage exclusively within European territories for covered services. | Not listed |
| US CLOUD Act exposure (indicative) | Partial EuropeanStack assessment: EU entity, DHH European group, no known US parent; public hosting story is Seeweb EU DCs and CISPE EU territory claim; backups on Seeweb off-site DCs (Spectrum Protect software, not described as US cloud mailbox SaaS). Residual gaps: no full public subprocessor list; antispam uses external reputation services not named on the docs page. Not legal advice. | Partial No known US parent; core email in Norway. Medium/partial because privacy policy lists US third parties (Stripe, PayPal, Coinbase, Enom, JaguarPC web hosting default, NodePing). Not legal advice. |
| Data processing agreement (B2B) | Not found No downloadable product DPA found on the marketing site; general conditions reference GDPR processing and the privacy notice. Request Art. 28 terms for mail content before go-live. | Not found Processor DPA with Copyleft is mentioned; no public customer-facing B2B DPA template found—ask sales/support |
| EU AI Act | Not applicable Cloud Mail is conventional email hosting, not an AI product. | Not applicable Email hosting product; vendor states no intrusive AI for ad profiling |
| Considerations & known limitations | Cloud Mail | Runbox |
|---|---|---|
| Subprocessor / antispam feed list not public | Medium Docs mention reputation services for antispam but do not publish a complete subprocessor table. Procurement should request the current list and transfer safeguards. | Not listed |
| Backup restore is set-based, not single-message | Low 30-day off-site history is useful, but restores recover the backed-up set; plan operational recovery expectations and prefer IMAP. | Not listed |
| Pre-delivery reject without default spam folder | Low Strong filtering can block legitimate senders; there is no user-visible spam quarantine by default—use tickets/reporting workflows. | Not listed |
| Not zero-access / E2EE-first mail | Medium Provider-managed conventional mail. Choose encrypted peers if the threat model assumes a compromised host provider. | Not listed |
| B2B DPA not prominent on site | Medium Treat contract/DPA negotiation as a gate for regulated workloads until Art. 28 terms and roles (controller/processor for mailbox content) are signed. | Not listed |
| Not default zero-access encryption | Not listed | Medium Unlike Proton/Tuta, Runbox can access stored mail for spam/virus scanning, indexing, and lawful process. Use PGP/S/MIME when E2EE is required. |
| US vendors on optional product paths | Not listed | Medium Payments (Stripe/PayPal/Coinbase), domain registrar Enom, and default JaguarPC web hosting introduce US processors. Keep web hosting in Norway and minimize US payment data if policy requires. |
| No public ISO 27001 / SOC 2 / independent audit | Not listed | Medium Assurance relies on vendor policy, Norwegian law, and facility claims. Regulated buyers may need NDA evidence or on-site questionnaire. |
| Partial open source only | Not listed | Low Runbox 7 webmail is open source; mail backend is proprietary SaaS—no self-host path. |
| Post-closure and backup retention | Not listed | Low Privacy policy defines multi-month content retention and backup windows after closure (and longer account-info retention for bookkeeping). Request immediate deletion if policy requires faster wipe. |
When: You need zero-access / end-to-end encrypted mailboxes as the primary control
Consider: Proton Mail or Tuta
Different product class: E2EE-first vs conventional managed IMAP hosting
When: You need mail plus full productivity suite and global enterprise ecosystem
Consider: Google Workspace or Microsoft 365
Trade EU-operator focus for suite breadth and US-jurisdiction diligence
When: You want another European professional domain-mail host for comparison
Consider: Migadu, Mailfence, or Combell E-mail
Compare admin model, spam handling, restore RPO, and contract artifacts
When: You need default end-to-end / zero-access encryption for all messages
Consider: Proton Mail or Tuta
Runbox uses optional PGP/S/MIME; operator can access stored mail for filtering and lawful process
When: You want a German privacy-oriented host with similar sustainability positioning
Consider: Posteo
Compare jurisdiction (DE vs NO), domain limits, and feature depth
When: You need Belgian email with integrated collaboration extras
Consider: Mailfence
Different encryption defaults and product scope
When: You need global free-tier convenience and suite lock-in
Consider: Gmail or Outlook.com / Microsoft 365
Accept US jurisdiction and ad/suite economics tradeoffs