GMX Mail vs Mailo

Compare GMX Mail and Mailo on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Outlook.com

GMX Mail

Germany· Email Services

Needs review

Shortlist GMX Mail for consumer or light-professional freemail when you want a German United Internet operator, claimed German mailbox data centers, large free storage, and standard IMAP/POP—with optional OpenPGP. Skip when you need zero-access encryption by default, enterprise DPA/audit packs, or an ad-free architecture as the baseline; consider Proton Mail instead.

German operatorMailbox in DE (claimed)IMAP / POP3 / SMTPOptional OpenPGPFree ad-supportedSaaS only

View listing Visit Website

Mailo

France· Email Services

Needs review

Shortlist Mailo when you want French-entity freemium webmail with classic IMAP/EAS clients, integrated calendar/cloud, supervised Mailo Junior for kids, or Pro custom domains for SMEs—without US Big Tech accounts. Skip when you need default zero-knowledge E2EE, open-source/self-host, or a full Workspace-class suite; consider Tuta, Proton Mail, or Infomaniak kMail instead.

France-hosted (claimed)Freemium webmailMailo JuniorIMAP / ActiveSyncPro custom domainsOptional PGP (server-side)

View listing Visit Website

Highlighted rows differ between the two products.

GMX Mail vs Mailo: Snapshot
Feature	GMX Mail	Mailo
Country of origin	Germany	France
Category	Email Services	Email Services
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	France
Legal entity	1&1 Mail & Media GmbH (Zweigniederlassung Karlsruhe; Hauptsitz Montabaur)	MAILO SAS (capital €75,000; RCS Créteil 851585547; VAT FR44851585547)
Governing law	German law (international T&Cs); GDPR applies as EU controller	French law (terms of use)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Vendor privacy (EN): FreeMail emails, address book, and calendar processed in secure data centers in Germany. Product security pages: European data centers for stored mail. Group United Internet AG (DE). Named non-mail paths: Google Analytics/GTM on portal; Google/Yahoo search partnership; international ad partners under consent; DE privacy allows third-country transfers with Chapter V safeguards when used. No public exhaustive mail-infra subprocessor list found.	Vendor states user personal data and content are stored/processed on servers in France; specialised French host centre (who-we-are); website hosted by Ecritel, Arradon, France. Named third parties: Verifone/Paybox (payment email), PayPal option, Gandi/Netim (domains), Sirdata + ad agencies (free-tier ads), optional Rainbow video and OnlyOffice. Full mail DC/backup subprocessor list not published.
Summary	German FreeMail from 1&1 Mail & Media GmbH (United Internet): large free storage, IMAP/POP/SMTP, optional OpenPGP and 2FA, ad-supported consumer webmail.	French freemium webmail and Mail&Cloud suite (MAILO SAS): email, calendar, cloud disk, Mailo Junior for children, and Pro custom domains—hosted in France, proprietary SaaS.
Tags	webmail freemail germany imap openpgp united-internet ad-supported consumer	webmail privacy freemium saas family french productivity

At a glance: GMX Mail vs Mailo
At a glance	GMX Mail	Mailo
HQ / entity	1&1 Mail & Media GmbH, Montabaur (DE)	MAILO SAS, France (RCS Créteil 851585547)
Parent group	United Internet AG (DE)	Not listed
Product type	Consumer FreeMail + optional paid tiers	Not listed
Hosting (claimed)	Mailbox/calendar data in German data centers	Servers in France; website host Ecritel (FR)
Protocols	Webmail; POP3/IMAP/SMTP (opt-in)	Not listed
Open source	No	No (proprietary MailObject®)
Self-hosted	No	Not listed
Model	Not listed	Freemium SaaS (Free / Premium / Pro / Junior / Edu)
Self-host	Not listed	No
Encryption default	Not listed	TLS + optional server-side PGP (not ZK E2EE)

Key capabilities: GMX Mail vs Mailo
Key capabilities	GMX Mail	Mailo
German operator	Yes	Not listed
Mailbox in DE (claimed)	Yes	Not listed
IMAP / POP3 / SMTP	Yes	Not listed
Optional OpenPGP	Yes	Yes
Free ad-supported	Yes	Not listed
SaaS only	Yes	Not listed
France-hosted (claimed)	Not listed	Yes
Freemium webmail	Not listed	Yes
Mailo Junior	Not listed	Yes
IMAP / ActiveSync	Not listed	Yes
Pro custom domains	Not listed	Yes

GMX Mail

Large free mailbox storage with open protocols
gmx.com free accounts advertise up to 65 GB email storage and 50 MB attachments. POP3, IMAP, and SMTP are supported after you enable them in settings (TLS 1.2+; imap.gmx.com / mail.gmx.com). Suits users who want client choice (Thunderbird, Outlook, mobile) without Google or Microsoft as the mailbox host.
Optional OpenPGP end-to-end encryption (Mailvelope)
GMX offers free OpenPGP messaging via the Mailvelope browser extension: key generation, local key storage, key directory, and mobile recovery. Encryption is opt-in per message after setup—not whole-mailbox zero-access by default. Best for occasional sensitive threads when both parties can use OpenPGP.
Aliases, Mail Collector, and multi-account inbox
Create up to 10 alias addresses (including other GMX domains) managed in one inbox, and pull up to 10 external accounts via Mail Collector. Useful for freelancers and project mail without juggling multiple passwords or providers day-to-day.
Spam filtering, antivirus, and optional TOTP 2FA
Free accounts include automated spam filtering (user blacklist and optional improved detection) and antivirus scanning of mail and cloud files. Optional two-factor authentication uses an authenticator app (TOTP); third-party clients use app-specific passwords when 2FA is on.
Bundled Cloud, calendar, contacts, and Online Office
Accounts include contacts, calendar/organizer, about 2 GB GMX Cloud with share links, and Online Office for common document formats—enough for light personal productivity without a separate suite subscription.

Mailo

French-hosted webmail with IMAP, EAS, and classic protocols
Webmail plus IMAP4 for clients, Exchange ActiveSync for mobile sync, and POP3 on paid tiers; SMTP relay with account credentials. Vendor states mail and content stay on servers in France. Free tier is ad-supported with lower quotas; Premium unlocks POP3, more aliases, and larger mail/cloud caps. Suits teams that need standard desktop/mobile clients rather than a closed proprietary app only.
Mailo Junior supervised email for children
Child accounts (about ages 6–14) only exchange mail with contacts a parent or teacher validates. Age-adapted mini/junior UIs, no ads on Junior, optional promotion to a standard account while keeping the address. Separate Junior mobile apps. Unique fit for families and schools versus generic consumer mail.
Calendar, virtual disk, and open sync protocols
Shared calendars and tasks, address book, photo albums, and a virtual disk for files with WebDAV/FTP access. CalDAV and CardDAV for external clients. Premium+ can unlock OnlyOffice in-browser editing. Better as an all-in-one Mail&Cloud for SMEs/families than bare IMAP-only privacy mail.
Mailo Pro spaces: custom domains and mutualised storage
Pro Start/5/Modulo style plans share mail+cloud quota across accounts, support custom domains (register, transfer, or declare external), distribution lists, mailbox sharing, resource calendars, and manager tooling. Priority Pro hotline with documented acknowledgement and restoration targets for Pro subscriptions. Aimed at TPE/PME, associations, and municipalities—not a full Google Workspace clone.
Optional server-side PGP and account security controls
Built-in PGP/MIME encrypt and sign in the webmail as a trusted third party (keys managed on Mailo for multi-device convenience). Two-factor authentication, application passwords, connection history, and guardianship-style access options. Not zero-knowledge E2EE by default—use external client crypto if the provider must never hold keys.

Assurance & compliance: GMX Mail vs Mailo
Assurance & compliance	GMX Mail	Mailo
Independent security / no-logs audit	Not found OpenPGP/Mailvelope path described as externally reviewed; no public independent no-logs audit for FreeMail mailbox access found on product pages.	Not found Charter claims no commercial reading of messages; automated AV/spam scanning on servers. No public third-party audit PDF found.
ISO 27001	Not found No GMX FreeMail-branded ISO 27001 certificate located on security/privacy pages in this research pass (group companies may hold certs under other brands).	Not found No ISO 27001 claim found on legal/security/primary pages researched.
SOC 2 / SOC 3	Not found No SOC 2/3 report found on GMX public security pages.	Not found No SOC 2/3 report referenced on public product pages.
GDPR / EU data protection	Vendor claimed EU/German controller; public privacy notices under GDPR; DPO published; supervisory authorities named (BfDI / LfDI RLP).	Vendor claimed French controller; privacy rules cite GDPR and French correspondence secrecy; DPO at dpo@mailo.com; France storage claim.
US CLOUD Act exposure (indicative)	Partial German entity and parent (United Internet AG); mailbox data claimed in German DCs. Partial/medium because portal analytics include Google LLC tools, freemail ads involve international partners, and no full public mail-infra subprocessor list. Not legal advice.	Partial EU entity / no known US parent / France-claimed mail hosting, but Verifone and PayPal (US-group) on payment path; full infra subprocessors unpublished. Assessment only—not legal advice.
Data processing agreement (B2B)	Not found Product is primarily consumer FreeMail under GTCs/privacy policy; no public self-serve B2B DPA flow found for FreeMail shortlisting.	Not found Privacy rules and terms cover processing; no standalone public B2B DPA download found—request via DPO or Pro channel.
EU AI Act	Not applicable Not an AI-centric product; optional assistive features may appear in product privacy text but FreeMail is not marketed as an AI system.	Not applicable Traditional email/cloud suite; not marketed as an AI system product.

Considerations & known limitations: GMX Mail vs Mailo
Considerations & known limitations	GMX Mail	Mailo
Advertising-funded free tier	Medium FreeMail depends on ads and (with consent) interest-based targeting and partner sharing. Privacy posture differs from paid privacy mail. Practical impact: expect consent UX, ad surfaces, and partner lists—not a zero-ads default.	Not listed
E2E encryption is optional, not default	Medium Without OpenPGP setup, mailbox content is accessible to the provider like conventional hosted mail. Practical impact: do not treat GMX FreeMail as zero-access encryption architecture.	Not listed
Incomplete public infrastructure subprocessors	Medium Residency for mail is claimed (Germany/EU), but there is no enterprise-style published subprocessor inventory for core mail infrastructure. Portal paths name Google Analytics and global ad partners. Practical impact: extra questionnaire work for high-assurance buyers.	Not listed
Inactivity and freemail operational policies	Low Terms/privacy allow deletion of free mailbox content after prolonged inactivity (about 180 days without login on FreeMail privacy text). Practical impact: inactive project addresses can disappear if not maintained.	Not listed
No public ISO/SOC package for FreeMail	Low Security pages emphasize product features (spam, AV, 2FA, PGP) rather than downloadable ISO/SOC evidence for FreeMail. Practical impact: may fail enterprise vendor security questionnaires without further vendor dialogue.	Not listed
PGP is server-side trusted third party	Not listed	Medium Webmail PGP holds keys on Mailo for multi-device use. Provider-access risk differs from zero-knowledge E2EE defaults at Tuta/Proton. Use external crypto if that is a hard requirement.
Incomplete public subprocessor inventory	Not listed	Medium Privacy rules name payments, domains, and free-tier ads, but not a full list of mail storage, backup, or anti-spam infrastructure vendors. Request annex for B2B risk review.
US-group payment processors	Not listed	Low Checkout shares email with Verifone/Paybox; PayPal is also offered. Limited to billing path per privacy rules, but relevant to CLOUD Act diligence.
Free tier third-party advertising	Not listed	Low Mailo Free shows ad banners via agencies under IAB TCF consent (Sirdata CMP). Premium removes ads. Ad cookies stated as not tied to Mailo profile.
No public ISO/SOC or independent security audit	Not listed	Medium Security posture relies on first-party statements and internal measures. Procurement teams may need questionnaires or NDA evidence.
Free accounts deleted after inactivity	Not listed	Low Mailo Free unused for 365 days can be deleted with content loss. Premium/Pro have different retention rules—plan backups and renewals.

Fit

GMX Mail

Best fit when

Individuals and freelancers who want a European freemail address with large free storage and IMAP client freedom
Users consolidating multiple addresses via aliases (up to 10) and Mail Collector
Buyers who prefer a German legal controller (1&1 Mail & Media GmbH / United Internet) over US Big Tech freemail
Teams that only need optional OpenPGP for specific sensitive threads, not zero-access by default
Users already familiar with GMX/WEB.DE in German-speaking markets who need international domains (e.g. gmx.com)

Poor fit when

Organizations that require default end-to-end / zero-access encryption for all mail
Procurement that needs a published independent security audit pack, ISO/SOC evidence, and a B2B DPA as standard shortlist inputs
Teams that cannot accept advertising-funded freemail economics or interest-based ad consent UX
Custom-domain corporate mail and admin controls at Microsoft 365 / Google Workspace depth
Self-hosted or open-source mail stack requirements

Consider instead when

When: You need zero-access encryption by default and a privacy-first paid model without ad-funded freemail as the core product
Consider: Proton Mail
Proton is the stronger shortlist peer in this catalog for E2E-first evaluation.
When: You need Google Workspace-class collaboration and are willing to accept US Big Tech jurisdiction
Consider: Gmail / Google Workspace
Richer suite integration; different sovereignty and ad/ecosystem tradeoffs.
When: You need Microsoft ecosystem mail, calendar, and compliance tooling
Consider: Outlook.com / Microsoft 365
Strong enterprise admin story; US parent and CLOUD Act path differ from GMX.

Mailo

Best fit when

EU individuals and families wanting French-hosted mail with calendar and cloud disk in one account
Parents/schools needing supervised child email (Mailo Junior) with contact allow-lists
French SMEs, associations, and municipalities needing custom domains and mutualised Pro storage
Teams that depend on IMAP, EAS, CalDAV, CardDAV, or WebDAV rather than a locked-in app
Buyers who accept freemium ads on free tier or low-cost Premium rather than pure prepaid anonymity mail

Poor fit when

Orgs that require default end-to-end encryption with zero-access provider architecture
Buyers that need open-source server code or official self-hosting
Enterprises needing SOC 2 / ISO 27001 evidence already published on a trust centre
Heavy Google Workspace / Microsoft 365 collaboration suites (docs/drive ecosystem depth)

Consider instead when

When: You need zero-knowledge / default E2EE webmail
Consider: Tuta or Proton Mail
Mailo PGP is optional and server-side trusted third party
When: You want German privacy mail with different encryption/product posture
Consider: Posteo or mailbox.org
Compare protocols, storage bundles, and business features side by side
When: You need Swiss multi-product cloud with mail plus broader suite
Consider: Infomaniak kMail
Different country stack and product breadth
When: You need US Big Tech ecosystem integration at any cost
Consider: Gmail or Microsoft 365 / Outlook.com
Trade EU entity and France residency claims for ecosystem depth

Open questions for due diligence

GMX Mail

Will 1&1 Mail & Media sign a B2B DPA and publish a current mail-infrastructure subprocessor list for our use case?
Are FreeMail mailbox systems solely on United Internet / 1&1 operated German DCs, or are any US-group cloud providers used for primary storage, backup, or DR?
What independent audits or certifications (if any) cover the FreeMail platform beyond the Mailvelope/OpenPGP path?
For paid/premium mailboxes: which advertising and tracking paths remain, and what contractual residency language is available?

Mailo

Will Mailo sign a GDPR Article 28 DPA with a full subprocessor and transfer annex for Pro customers?
What is the named primary data-centre operator and backup/DR location beyond the France and Ecritel website-host statements?
Is there an independent penetration test, ISO 27001 roadmap, or customer-available security whitepaper?
Where is Rainbow (video) and OnlyOffice data processed relative to the France mail claim?
Current UGAP / public procurement listing status for French public buyers?