GMX Mail vs Proton Mail

Compare GMX Mail and Proton Mail on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Outlook.com, Yahoo Mail

GMX Mail

Germany· Email Services

Needs review

Shortlist GMX Mail for consumer or light-professional freemail when you want a German United Internet operator, claimed German mailbox data centers, large free storage, and standard IMAP/POP—with optional OpenPGP. Skip when you need zero-access encryption by default, enterprise DPA/audit packs, or an ad-free architecture as the baseline; consider Proton Mail instead.

German operatorMailbox in DE (claimed)IMAP / POP3 / SMTPOptional OpenPGPFree ad-supportedSaaS only

View listing Visit Website

Proton Mail

Switzerland· Email Services

Needs review

Shortlist Proton Mail when you want Swiss-jurisdiction, zero-access encrypted email with open-source clients, custom domains, Bridge for desktop mailers, and a public DPA. Skip when you need free-tier IMAP Bridge, fully self-hosted FOSS mail on your own servers, or Workspace-class collaboration depth—consider Tuta, Posteo, or Mailfence among EU peers, or stay on Google/Microsoft if suite lock-in wins.

E2EE + zero-accessSwiss-operatedBridge (IMAP/SMTP)Open-source clientsISO 27001 & SOC 2 (claimed)Public B2B DPA

View listing Visit Website

Highlighted rows differ between the two products.

GMX Mail vs Proton Mail: Snapshot
Feature	GMX Mail	Proton Mail
Country of origin	Germany	Switzerland
Category	Email Services	Email Services
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	Switzerland
Legal entity	1&1 Mail & Media GmbH (Zweigniederlassung Karlsruhe; Hauptsitz Montabaur)	Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland (EU representative: Proton Europe sàrl, Luxembourg)
Governing law	German law (international T&Cs); GDPR applies as EU controller	Swiss law (Terms; Geneva courts for business/non-US consumer disputes as stated in Terms)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Vendor privacy (EN): FreeMail emails, address book, and calendar processed in secure data centers in Germany. Product security pages: European data centers for stored mail. Group United Internet AG (DE). Named non-mail paths: Google Analytics/GTM on portal; Google/Yahoo search partnership; international ad partners under consent; DE privacy allows third-country transfers with Chapter V safeguards when used. No public exhaustive mail-infra subprocessor list found.	Primary mail storage on Proton-owned servers in Switzerland (vendor security pages). Not marketed as AWS/GCP/Azure inbox hosting. Public privacy policy lists US-group processors for support and payments (Zendesk; Chargebee, Stripe, PayPal) and group support processing in North Macedonia and Taiwan; HubSpot noted for business sales inquiries.
Summary	German FreeMail from 1&1 Mail & Media GmbH (United Internet): large free storage, IMAP/POP/SMTP, optional OpenPGP and 2FA, ad-supported consumer webmail.	Swiss end-to-end encrypted email from Proton AG: zero-access inbox storage, open-source clients, custom domains, and Bridge for desktop IMAP clients.
Tags	freemail webmail germany imap openpgp united-internet ad-supported consumer	privacy encryption e2ee switzerland business free-tier saas open-source-clients

At a glance: GMX Mail vs Proton Mail
At a glance	GMX Mail	Proton Mail
HQ / entity	1&1 Mail & Media GmbH, Montabaur (DE)	Not listed
Parent group	United Internet AG (DE)	Not listed
Product type	Consumer FreeMail + optional paid tiers	Not listed
Hosting (claimed)	Mailbox/calendar data in German data centers	Not listed
Protocols	Webmail; POP3/IMAP/SMTP (opt-in)	Not listed
Open source	No	Not listed
Self-hosted	No	Not listed
HQ	Not listed	Plan-les-Ouates (Geneva), Switzerland
Legal entity	Not listed	Proton AG (CHE-354.686.492); Proton Foundation supervision
Hosting model	Not listed	Proton-owned hardware in Switzerland (vendor claim)
Self-host	Not listed	No (SaaS); clients open source
Commercial model	Not listed	Freemium + paid consumer and business seats
Bridge	Not listed	Paid plans that include Mail

Key capabilities: GMX Mail vs Proton Mail
Key capabilities	GMX Mail	Proton Mail
German operator	Yes	Not listed
Mailbox in DE (claimed)	Yes	Not listed
IMAP / POP3 / SMTP	Yes	Not listed
Optional OpenPGP	Yes	Not listed
Free ad-supported	Yes	Not listed
SaaS only	Yes	Not listed
E2EE + zero-access	Not listed	Yes
Swiss-operated	Not listed	Yes
Bridge (IMAP/SMTP)	Not listed	Yes
Open-source clients	Not listed	Yes
ISO 27001 & SOC 2 (claimed)	Not listed	Yes
Public B2B DPA	Not listed	Yes

GMX Mail

Large free mailbox storage with open protocols
gmx.com free accounts advertise up to 65 GB email storage and 50 MB attachments. POP3, IMAP, and SMTP are supported after you enable them in settings (TLS 1.2+; imap.gmx.com / mail.gmx.com). Suits users who want client choice (Thunderbird, Outlook, mobile) without Google or Microsoft as the mailbox host.
Optional OpenPGP end-to-end encryption (Mailvelope)
GMX offers free OpenPGP messaging via the Mailvelope browser extension: key generation, local key storage, key directory, and mobile recovery. Encryption is opt-in per message after setup—not whole-mailbox zero-access by default. Best for occasional sensitive threads when both parties can use OpenPGP.
Aliases, Mail Collector, and multi-account inbox
Create up to 10 alias addresses (including other GMX domains) managed in one inbox, and pull up to 10 external accounts via Mail Collector. Useful for freelancers and project mail without juggling multiple passwords or providers day-to-day.
Spam filtering, antivirus, and optional TOTP 2FA
Free accounts include automated spam filtering (user blacklist and optional improved detection) and antivirus scanning of mail and cloud files. Optional two-factor authentication uses an authenticator app (TOTP); third-party clients use app-specific passwords when 2FA is on.
Bundled Cloud, calendar, contacts, and Online Office
Accounts include contacts, calendar/organizer, about 2 GB GMX Cloud with share links, and Online Office for common document formats—enough for light personal productivity without a separate suite subscription.

Proton Mail

Zero-access inbox encryption by default
Bodies and attachments are encrypted so Proton states it lacks keys to read stored mail. Proton-to-Proton traffic is end-to-end encrypted automatically; external recipients need password-protected messages or PGP/WKD for comparable content protection. Subject lines are not fully E2EE under OpenPGP header rules.
Proton Mail Bridge for desktop IMAP clients
Paid plans that include Mail can run Bridge locally to connect Outlook, Thunderbird, or Apple Mail over IMAP/SMTP while encrypting and decrypting on the device. Free accounts use official web/mobile/desktop apps instead of Bridge.
Custom domains, aliases, and business admin
Paid and business tiers support custom domains, extra addresses, catch-all and groups, hide-my-email aliases, and org admin for seats, storage, and retention policies. Suits teams leaving Google/Microsoft who still need branded addresses.
Open-source clients with published audits
Web, mobile, and desktop clients are published on GitHub with third-party audit reports linked from Proton’s open-source page. The hosted mail backend is not offered as self-hosted FOSS—audit client trust, not full server reproducibility.
Tracker blocking, PhishGuard, and Sentinel
Built-in tracker protection, phishing heuristics, link confirmation, SPF/DKIM/DMARC for custom domains, hardware-key 2FA, and optional Proton Sentinel monitoring for high-risk accounts. Complements encryption with everyday abuse defenses.

Assurance & compliance: GMX Mail vs Proton Mail
Assurance & compliance	GMX Mail	Proton Mail
Independent security / no-logs audit	Not found OpenPGP/Mailvelope path described as externally reviewed; no public independent no-logs audit for FreeMail mailbox access found on product pages.	Vendor claimed Open-source clients with published third-party audit reports (web/desktop links on open-source page). Not a classic VPN no-logs court test; transparency report covers legal orders for accessible account data.
ISO 27001	Not found No GMX FreeMail-branded ISO 27001 certificate located on security/privacy pages in this research pass (group companies may hold certs under other brands).	Vendor claimed Vendor announces ISO 27001 certification after external audit completed 2 May 2024; Trust Center links a certificate download. Confirm scope and validity at procurement time.
SOC 2 / SOC 3	Not found No SOC 2/3 report found on GMX public security pages.	Vendor claimed Vendor announces first SOC 2 Type II attestation (July 2025 blog). Report typically under NDA—request from vendor for diligence files.
GDPR / EU data protection	Vendor claimed EU/German controller; public privacy notices under GDPR; DPO published; supervisory authorities named (BfDI / LfDI RLP).	Vendor claimed Swiss controller/processor with EU representative; public DPA; GDPR materials for business. Adequacy/transfer mechanisms documented for non-adequate destinations.
US CLOUD Act exposure (indicative)	Partial German entity and parent (United Internet AG); mailbox data claimed in German DCs. Partial/medium because portal analytics include Google LLC tools, freemail ads involve international partners, and no full public mail-infra subprocessor list. Not legal advice.	Partial Swiss entity / no known US parent; inbox content on Proton-owned Swiss hardware with zero-access design. Partial exposure remains via US SaaS subprocessors (Zendesk support; Stripe/Chargebee/PayPal payments) and any account metadata Proton can access under Swiss process. Not legal advice.
Data processing agreement (B2B)	Not found Product is primarily consumer FreeMail under GTCs/privacy policy; no public self-serve B2B DPA flow found for FreeMail shortlisting.	Vendor claimed Public DPA at proton.me/legal/dpa forms part of terms when Proton acts as processor; Swiss law, Geneva jurisdiction; general authorization for listed subprocessors.
EU AI Act	Not applicable Not an AI-centric product; optional assistive features may appear in product privacy text but FreeMail is not marketed as an AI system.	Not applicable Core product is encrypted email. Optional Scribe assistant is ancillary; not an AI-centric offering for this catalog entry.

Considerations & known limitations: GMX Mail vs Proton Mail
Considerations & known limitations	GMX Mail	Proton Mail
Advertising-funded free tier	Medium FreeMail depends on ads and (with consent) interest-based targeting and partner sharing. Privacy posture differs from paid privacy mail. Practical impact: expect consent UX, ad surfaces, and partner lists—not a zero-ads default.	Not listed
E2E encryption is optional, not default	Medium Without OpenPGP setup, mailbox content is accessible to the provider like conventional hosted mail. Practical impact: do not treat GMX FreeMail as zero-access encryption architecture.	Not listed
Incomplete public infrastructure subprocessors	Medium Residency for mail is claimed (Germany/EU), but there is no enterprise-style published subprocessor inventory for core mail infrastructure. Portal paths name Google Analytics and global ad partners. Practical impact: extra questionnaire work for high-assurance buyers.	Not listed
Inactivity and freemail operational policies	Low Terms/privacy allow deletion of free mailbox content after prolonged inactivity (about 180 days without login on FreeMail privacy text). Practical impact: inactive project addresses can disappear if not maintained.	Not listed
No public ISO/SOC package for FreeMail	Low Security pages emphasize product features (spam, AV, 2FA, PGP) rather than downloadable ISO/SOC evidence for FreeMail. Practical impact: may fail enterprise vendor security questionnaires without further vendor dialogue.	Not listed
Weaker defaults outside Proton	Not listed	Medium Mail to Gmail/Outlook/others is not E2EE unless password-protected or PGP/WKD is used. Subject lines are not fully E2EE. Train users or you only protect the Proton-stored copy.
US support and payment processors	Not listed	Medium Zendesk, Chargebee, Stripe, and PayPal appear in the public processor list. They should not see zero-access message bodies, but support content and billing data can touch US-group services—document this in DPIAs.
Bridge requires paid Mail	Not listed	Low Desktop IMAP/SMTP via Bridge is not available on free accounts. Budget seats for users who refuse the official apps.
Hosted service, not self-hosted FOSS mail	Not listed	Medium Open-source clients improve inspectability but you still depend on Proton’s operated backend, uptime, and Swiss legal process. Unsuitable if policy mandates customer-operated mail servers.
Swiss legal orders on accessible data	Not listed	Low Transparency reports show thousands of yearly legal orders for Mail with many complied. Bodies stay encrypted; recovery emails, IPs (when retained for abuse), and similar metadata may still be in scope. Align expectations with counsel.

Fit

GMX Mail

Best fit when

Individuals and freelancers who want a European freemail address with large free storage and IMAP client freedom
Users consolidating multiple addresses via aliases (up to 10) and Mail Collector
Buyers who prefer a German legal controller (1&1 Mail & Media GmbH / United Internet) over US Big Tech freemail
Teams that only need optional OpenPGP for specific sensitive threads, not zero-access by default
Users already familiar with GMX/WEB.DE in German-speaking markets who need international domains (e.g. gmx.com)

Poor fit when

Organizations that require default end-to-end / zero-access encryption for all mail
Procurement that needs a published independent security audit pack, ISO/SOC evidence, and a B2B DPA as standard shortlist inputs
Teams that cannot accept advertising-funded freemail economics or interest-based ad consent UX
Custom-domain corporate mail and admin controls at Microsoft 365 / Google Workspace depth
Self-hosted or open-source mail stack requirements

Consider instead when

When: You need zero-access encryption by default and a privacy-first paid model without ad-funded freemail as the core product
Consider: Proton Mail
Proton is the stronger shortlist peer in this catalog for E2E-first evaluation.
When: You need Google Workspace-class collaboration and are willing to accept US Big Tech jurisdiction
Consider: Gmail / Google Workspace
Richer suite integration; different sovereignty and ad/ecosystem tradeoffs.
When: You need Microsoft ecosystem mail, calendar, and compliance tooling
Consider: Outlook.com / Microsoft 365
Strong enterprise admin story; US parent and CLOUD Act path differ from GMX.

Proton Mail

Best fit when

Teams that need default end-to-end / zero-access encryption without running their own mail stack
Orgs that want Swiss legal venue and documented resistance to direct foreign data demands
Businesses migrating branded domains off Gmail/Outlook with Easy Switch and Bridge for desktop holdouts
Security-conscious professionals who value open-source clients, published audits, and hardware-key 2FA
Buyers who need a public DPA plus vendor-claimed ISO 27001 / SOC 2 Type II for questionnaires

Poor fit when

Fully self-hosted requirements (Proton Mail is SaaS; clients are open source, not a full on-prem mail server)
Desktop IMAP on free accounts only—Bridge needs a paid plan that includes Mail
Workflows that depend on unencrypted-looking mail to external parties who will not use password links or PGP
Teams that primarily need full Microsoft 365 / Google Workspace collaboration depth rather than encrypted mail first

Consider instead when

When: You want German E2EE email with a different crypto product surface and may not need Proton’s full ecosystem
Consider: Tuta
Compare desktop interoperability and business admin maturity side by side.
When: You want ad-free European mail with strong transport privacy but do not require zero-access E2EE for all stored content
Consider: Posteo
Different threat model: Posteo is privacy-forward without Proton’s zero-access default.
When: You need OpenPGP-centric mail with classic collaboration extras under Belgian operation
Consider: Mailfence
Weigh automatic Proton-to-Proton E2EE UX versus Mailfence’s model.
When: Collaboration suite depth and ecosystem lock-in outweigh encryption defaults
Consider: Google Workspace or Microsoft 365
Accept US-provider jurisdiction and scanning/processing models as tradeoffs.

Open questions for due diligence

GMX Mail

Will 1&1 Mail & Media sign a B2B DPA and publish a current mail-infrastructure subprocessor list for our use case?
Are FreeMail mailbox systems solely on United Internet / 1&1 operated German DCs, or are any US-group cloud providers used for primary storage, backup, or DR?
What independent audits or certifications (if any) cover the FreeMail platform beyond the Mailvelope/OpenPGP path?
For paid/premium mailboxes: which advertising and tracking paths remain, and what contractual residency language is available?

Proton Mail

What exact data-center sites and any non-Swiss regions apply to your tenant’s mailbox replicas today?
Will Proton provide the full SOC 2 Type II report under NDA and confirm ISO 27001 certificate scope/expiry for your questionnaire?
For business orgs: which users will be private vs non-private, and how will admin recovery work with zero-access constraints?
Which external partners must receive E2EE content, and will they accept password-protected messages or PGP?