eclipso Mail Europe vs mailbox (formerly mailbox.org)

Compare eclipso Mail Europe and mailbox (formerly mailbox.org) on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Microsoft 365

eclipso Mail Europe

Germany· Email Services

Needs review

Shortlist when you want German-hosted mail with direct IMAP/SMTP, optional OpenPGP/S/MIME free on all tiers, prepaid freemium cost control, and a small business suite (drive, calendar, hybrid SMS/fax/post). Skip when you need zero-access defaults, published ISO/SOC audits, or large-enterprise identity—consider Posteo, Tuta, Proton Mail, or mailbox.org instead.

Germany-hosted (claimed)OpenPGP + S/MIMEIMAP/SMTP nativePrepaid freemiumOwner-operated DEBusiness DPA (Art. 28)

View listing Visit Website

mailbox (formerly mailbox.org)

Germany· Office Productivity Suite

Needs review

Shortlist mailbox when you need a German-operated email-plus-collaboration suite (Mail, Drive, Office, Meet, Admin/API) on dual Berlin sites with published BSI C5 Type 1 and ISO 27001 claims. Skip when you require free forever mail or default zero-knowledge for all messages—consider Proton Mail or Tuta instead.

German-operatedBerlin dual-site hostingPGP + S/MIMEBSI C5 Type 1 (claimed)ISO 27001 (claimed)Mail + Drive + Meet + Office

View listing Visit Website

Highlighted rows differ between the two products.

eclipso Mail Europe vs mailbox (formerly mailbox.org): Snapshot
Feature	eclipso Mail Europe	mailbox (formerly mailbox.org)
Country of origin	Germany	Germany
Category	Email Services	Office Productivity Suite
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	Germany
Legal entity	Claus-Peter Beringer (eclipso Mail Europe), Grubstr. 9b, 95445 Bayreuth	Heinlein Hosting GmbH (Berlin; CEO Peer Heinlein)
Governing law	German / EU law (GDPR, BDSG); BayLDA supervisory authority named in privacy notice	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Primary hosting claimed exclusively in Germany; privacy policy names Speedloc Datacenter (Görlitz) with AVV. Optional SMS/fax/post: Commify Germany, CM.com Germany, letterei.de (all DE). Payments: Stripe Payments Europe and PayPal (Europe). Site: Google reCAPTCHA; marketing ad partners documented; Matomo self-hosted analytics.	Core mailbox, Drive, and Meet on Heinlein-operated servers in German data centres in Berlin (two independent locations). Website analytics: self-hosted Matomo. Marketing site may embed Vimeo/YouTube. No public AWS/GCP/Azure product hosting region found for customer mail data.
Summary	Owner-operated German email and cloud suite with IMAP, optional OpenPGP/S/MIME, prepaid freemium, Drive/organizer, and hybrid SMS/fax/post—hosted in Germany.	German paid digital workplace from Heinlein Hosting GmbH: secure email with PGP/S/MIME, Drive, browser Office, Meet, and business Admin on dual Berlin data centres.
Tags	email privacy gdpr germany openpgp prepaid cloud-storage imap	email privacy gdpr productivity german-hosting bsi-c5 iso-27001 collaboration

At a glance: eclipso Mail Europe vs mailbox (formerly mailbox.org)
At a glance	eclipso Mail Europe	mailbox (formerly mailbox.org)
HQ	Bayreuth, Germany	Berlin, Germany
Legal entity	Claus-Peter Beringer (owner-operated)	Heinlein Hosting GmbH
Founded	2003 (vendor)	Not listed
Hosting	Germany; Speedloc Datacenter (Görlitz) named in privacy policy	Own servers, dual independent Berlin sites
Open source	No	Not listed
Self-hosted	No (SaaS)	Not listed
Commercial model	Freemail (ad-supported) + prepaid paid tiers	Not listed
Encryption	Optional OpenPGP + S/MIME; TLS in transit	Not listed
Model	Not listed	Paid subscription SaaS; trial available; no permanent free tier
Self-host	Not listed	No (managed SaaS)
Open standards	Not listed	IMAP/SMTP, CalDAV/CardDAV, WebDAV, PGP, S/MIME

Key capabilities: eclipso Mail Europe vs mailbox (formerly mailbox.org)
Key capabilities	eclipso Mail Europe	mailbox (formerly mailbox.org)
Germany-hosted (claimed)	Yes	Not listed
OpenPGP + S/MIME	Yes	Not listed
IMAP/SMTP native	Yes	Not listed
Prepaid freemium	Yes	Not listed
Owner-operated DE	Yes	Not listed
Business DPA (Art. 28)	Yes	Not listed
German-operated	Not listed	Yes
Berlin dual-site hosting	Not listed	Yes
PGP + S/MIME	Not listed	Yes
BSI C5 Type 1 (claimed)	Not listed	Yes
ISO 27001 (claimed)	Not listed	Yes
Mail + Drive + Meet + Office	Not listed	Yes

eclipso Mail Europe

Native OpenPGP and S/MIME in every plan
OpenPGP (RFC 4880/9580) key wizard and import work in webmail and apps, free from Freemail upward; S/MIME accepts user-supplied X.509 certificates for business clients. E2EE only applies when both sides use it—plain IMAP mail is not zero-access by default. Private keys for webmail PGP are held in the account under a passphrase for multi-device use.
Standard IMAP, POP3, SMTP plus CalDAV/CardDAV
Direct protocol access for Thunderbird, Outlook, Apple Mail, and mobile clients without a bridge product. Calendar and contacts sync via CalDAV/CardDAV; Premium and Business add WebDAV for the cloud drive. Suits teams that refuse locked-in web-only mail.
German-hosted suite: mail, drive, organizer
One account covers webmail, eclipso Drive file storage with link sharing, Media Center, calendar, address book, notes, and tasks. Vendor claims exclusive Germany data centres (privacy policy names Speedloc Datacenter, Görlitz). Storage and address limits scale by prepaid tariff; WebDAV and higher quotas need paid tiers.
Prepaid freemium with optional hybrid channels
Freemail signs up without credit card or phone number and is ad-supported; paid Connect/Premium/Business terms are prepaid and end automatically after a reminder. Credits enable SMS, fax, and hybrid physical post through named German gateways—useful for crafts and SMEs still on those channels.
Business domain and Art. 28 DPA on Business plan
Business includes a custom mail domain option, higher alias counts, daily send limits suitable for small campaigns, and an in-product Art. 28 GDPR DPA download per vendor docs. Not a full enterprise workspace: no public SCIM/SSO pack or multi-org admin model documented.

mailbox (formerly mailbox.org)

PGP Guard, S/MIME, and hardened mail transport
Webmail Guard for PGP without extra software (or Mailvelope with local keys), S/MIME for sign/encrypt, 2FA and app passwords, multi-stage spam/virus rejection, plus public transport controls (DNSSEC, DANE, MTA-STS, DMARC/DKIM/SPF, TLS checker, @secure.mailbox.org aliases). Benefits security-minded teams that still need interoperable IMAP/SMTP; content is not zero-knowledge by default unless you encrypt.
Drive on dual independent Berlin sites
Cloud files on the provider's own German infrastructure with two independent Berlin locations, WebDAV, mobile apps, guest share links, expandable quota, and optional client-side OpenPGP encryption of stored files. Fits teams replacing consumer cloud drives while keeping residency claims concrete; confirm plan quotas on the official site.
Browser Office with CalDAV and CardDAV
Edit common office formats in the browser, share calendars and contacts via open CalDAV/CardDAV standards, plus tasks, notes, polls, and TLS-secured XMPP chat. Aimed at SMEs and schools that want collaboration without a full Microsoft desktop stack; advanced Excel macros and deep Office add-ins are not the target.
Meet video hosted in German data centres
Browser-based conferencing integrated with calendar and mail: link invites for external guests, breakout rooms, screen share, chat, surveys, and moderator controls. Privacy documentation references the OpenTalk stack; sessions run through mailbox's German data centres. Evaluate E2EE defaults and recording policies against your meeting compliance needs.
Business Admin console and automation API
Central management of domains, mailboxes, quotas, spam/virus settings, IP allowlists, and backups, with an HTTP API for larger orgs and resellers (api.mailbox.org). Supports onboarding help and partner-assisted migration. Better for multi-seat German operations than pure consumer inboxes; not a full IdP replacement without SSO design work.

Assurance & compliance: eclipso Mail Europe vs mailbox (formerly mailbox.org)
Assurance & compliance	eclipso Mail Europe	mailbox (formerly mailbox.org)
Independent security / no-logs audit	Not found No public third-party security or no-logs audit PDF located on official pages	Not found No public independent no-logs audit PDF found; operational transparency reports and BSI/ISO artefacts instead
ISO 27001	Not found No ISO 27001 claim found on official security/about pages at research time	Vendor claimed Vendor states ISO/IEC 27001:2022 on certified-quality and press pages; request current certificate in diligence
SOC 2 / SOC 3	Not found No SOC 2/3 report referenced on official site	Not found No SOC 2/3 claim found on primary security/cert pages
GDPR / EU data protection	Vendor claimed German controller, DPO contact, BayLDA authority, GDPR rights language in privacy policy; servers claimed in Germany	Vendor claimed German controller Heinlein Hosting GmbH; DE hosting; detailed privacy notice; DPO privacy@mailbox.org
US CLOUD Act exposure (indicative)	Partial EU/DE owner-operated entity with DE hosting (Speedloc), but Stripe, PayPal, and Google reCAPTCHA/ad tooling introduce US-group processing paths for payment and website data. Not legal advice.	Partial EU/German entity, no known US parent, self-operated Berlin hosting for core data—no AWS/GCP/Azure product region found. Residual: marketing embeds (Vimeo/YouTube) and possible external payment services. Indicative assessment only, not legal advice.
Data processing agreement (B2B)	Vendor claimed Art. 28 DPA described as included and downloadable on Business plan; confirm for lower tiers	Vendor claimed Business knowledge base: customers can conclude a DPA online; historic AVV portal for business accounts
EU AI Act	Not applicable Email/cloud suite; not an AI system product	Not applicable Email/collaboration suite, not an AI product core
BSI C5	Not listed	Vendor claimed Vendor press (7 Jan 2026): BSI C5 Type 1 attestation for mailbox; confirm type, scope, and period

Considerations & known limitations: eclipso Mail Europe vs mailbox (formerly mailbox.org)
Considerations & known limitations	eclipso Mail Europe	mailbox (formerly mailbox.org)
Not zero-access by default	Medium Without OpenPGP/S/MIME, mailbox content is accessible to the operator like traditional IMAP hosts. Webmail PGP private keys are stored in-account under a passphrase—review threat model vs pure local keys.	Not listed
US-group payment and site tooling	Medium Stripe, PayPal, Google reCAPTCHA, and documented ad partners process personal data outside pure DE mailbox hosting. Material for CLOUD Act and transfer diligence even if mail servers stay in Germany.	Not listed
No public ISO/SOC or independent audit	Medium Security assurance is first-party documentation only. Regulated buyers will need questionnaires, AVVs, and possibly on-request evidence.	Not listed
Freemail is ad-supported	Low Free tier includes advertising as a service component. Paid tiers are marketed as ad-free; verify current footer/banner behaviour on the live product.	Not listed
Owner-operated scale limits	Low Independent DE operator (not VC-backed hyperscale). Expect SME-grade support hours and product depth rather than global enterprise SLAs.	Not listed
Mail is not zero-knowledge by default	Not listed	Medium Without PGP/S/MIME, stored message content remains operator-accessible under legal process. Practical impact: train users or mandate Guard/S/MIME for confidential traffic.
C5 Type 1 is point-in-time	Not listed	Low Type 1 attestations describe design/implementation at a point in time. Re-check type (1 vs 2), scope, and renewal dates for public-sector RFPs.
Payment and edge processors need confirmation	Not listed	Low Core hosting is self-operated DE, but privacy text references external payment services; marketing embeds US video hosts. Ask for the current processor list with the DPA.
Not a full Microsoft 365 ecosystem substitute	Not listed	Medium Browser Office and Meet cover common collaboration; deep desktop macros, Graph automations, and third-party M365 marketplaces will not map 1:1.
No customer self-host option	Not listed	Low Organisations that must operate mail on their own iron need another stack; mailbox is multi-tenant SaaS.

Fit

eclipso Mail Europe

Best fit when

Individuals and freelancers who want German mail with Thunderbird/Outlook IMAP and optional OpenPGP without a bridge
SMEs needing a custom domain, German server claims, and an Art. 28 DPA on the Business plan
Buyers who prefer prepaid terms that end automatically over auto-renewing Big Tech suites
Users who still send SMS, fax, or hybrid physical post from the same account
Teams migrating from Gmail/Outlook that value CalDAV/CardDAV and a bundled drive/organizer

Poor fit when

Orgs that require zero-access architecture where the provider never stores decryptable mailbox keys by default
Enterprises needing public ISO 27001/SOC 2 reports, SCIM/SSO, or multi-tenant admin
Buyers who refuse any US-group payment or website tooling (Stripe, PayPal, Google reCAPTCHA/ads)
Users seeking open-source or self-hosted mail only

Consider instead when

When: You want a simple paid-only German privacy mailbox without freemium advertising
Consider: Posteo
Posteo is ad-free paid; eclipso differentiates with freemail and hybrid channels
When: You prioritise always-on encryption over standard IMAP clients
Consider: Tuta or Proton Mail
Tuta uses proprietary E2EE clients; Proton needs Bridge for full IMAP-style access
When: You need a broader paid German workplace suite with stronger enterprise packaging
Consider: mailbox (formerly mailbox.org)
Compare admin, audit, and collaboration depth on current vendor docs
When: You need Google/Microsoft collaboration depth more than EU operator control
Consider: Gmail or Microsoft 365
Different jurisdiction and data-use models

mailbox (formerly mailbox.org)

Best fit when

German or EU orgs replacing Gmail/Microsoft 365 for mail and light collaboration under German law
Teams that need IMAP/SMTP plus CalDAV/CardDAV and optional custom domains
Buyers that will use PGP Guard or S/MIME deliberately for sensitive mail
SMEs and schools wanting Drive, browser Office, and Meet without a US hyperscaler
Organisations that need multi-seat Admin, DPA, and an automation API

Poor fit when

Users who need a permanent free tier
Buyers requiring default zero-knowledge mail for every user without crypto setup
Teams that must self-host the full stack on their own infrastructure
Enterprises whose workflows depend on deep Microsoft Graph or Google Workspace add-ons

Consider instead when

When: You need default end-to-end encrypted mail as the primary product
Consider: Proton Mail or Tuta
Stronger E2EE-first posture; lighter full workplace suite than mailbox
When: You want minimal German privacy email without Drive/Office/Meet
Consider: Posteo
Leaner mailbox; fewer collaboration modules
When: You need full desktop Office parity and global SaaS integrations
Consider: Microsoft 365 (incumbent) with separate residency controls
Different risk and ecosystem tradeoff—not an EU peer

Open questions for due diligence

eclipso Mail Europe

Can non-Business tariffs obtain a signed Art. 28 DPA and full subprocessor list on request?
Is Speedloc the sole host for mailbox content (not only the marketing site), and are backup/DR locations exclusively in Germany?
Are independent penetration tests or ISO plans available under NDA for enterprise buyers?
What exact data minimisation applies to freemail advertising versus paid ad-free tiers (inbox content vs account metadata)?
How are OpenPGP private keys encrypted at rest in the account store, and is export/deletion documented for offboarding?

mailbox (formerly mailbox.org)

What is the exact current BSI C5 scope, type, and validity period on the attestation document?
Which payment processors and any other subprocessors appear in the live AVV annex?
What is the default Meet encryption mode (TLS-only vs optional E2EE) for your plan, and is recording available?
Which SSO/IdP integrations are supported for your business tier beyond generic SSO mentions?