GMX Mail vs Runbox

Compare GMX Mail and Runbox on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Outlook.com

GMX Mail

Germany· Email Services

Needs review

Shortlist GMX Mail for consumer or light-professional freemail when you want a German United Internet operator, claimed German mailbox data centers, large free storage, and standard IMAP/POP—with optional OpenPGP. Skip when you need zero-access encryption by default, enterprise DPA/audit packs, or an ad-free architecture as the baseline; consider Proton Mail instead.

German operatorMailbox in DE (claimed)IMAP / POP3 / SMTPOptional OpenPGPFree ad-supportedSaaS only

View listing Visit Website

Runbox

Norway· Email Services

Needs review

Shortlist Runbox when you need Norwegian/EEA-hosted IMAP email with custom domains, ad-free subscription economics, and standard clients. Skip when you require default zero-access E2EE—consider Proton Mail or Tuta instead—or when you need a full Microsoft 365-style suite.

Norwegian email hostingIMAP / POP / SMTPCustom domains100% renewable (claimed)Runbox 7 open sourceOptional PGP / S/MIME

View listing Visit Website

Highlighted rows differ between the two products.

GMX Mail vs Runbox: Snapshot
Feature	GMX Mail	Runbox
Country of origin	Germany	Norway
Category	Email Services	Email Services
Open source	No	Yes
Self-hosted	No	No
Headquarters	Germany	Norway
Legal entity	1&1 Mail & Media GmbH (Zweigniederlassung Karlsruhe; Hauptsitz Montabaur)	Runbox Solutions AS
Governing law	German law (international T&Cs); GDPR applies as EU controller	Norwegian law; Personal Data Act implementing GDPR (EEA)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Vendor privacy (EN): FreeMail emails, address book, and calendar processed in secure data centers in Germany. Product security pages: European data centers for stored mail. Group United Internet AG (DE). Named non-mail paths: Google Analytics/GTM on portal; Google/Yahoo search partnership; international ad partners under consent; DE privacy allows third-country transfers with Chapter V safeguards when used. No public exhaustive mail-infra subprocessor list found.	Core email and account content: servers in Oslo (StackInfra) under Norwegian jurisdiction; systems management Copyleft Solutions AS (Norway). Optional third parties per privacy policy: Stripe, PayPal, Coinbase (US payments); Enom (US domains); Gandi (FR); Domeneshop (NO); JaguarPC (US default web hosting, Norway option); NodePing (US, status page). No known US parent.
Summary	German FreeMail from 1&1 Mail & Media GmbH (United Internet): large free storage, IMAP/POP/SMTP, optional OpenPGP and 2FA, ad-supported consumer webmail.	Norwegian subscription email hosting from Runbox Solutions AS: Oslo-hosted IMAP mailboxes, custom domains, CalDAV/CardDAV, and optional PGP. Ad-free; not default zero-access.
Tags	freemail webmail germany imap openpgp united-internet ad-supported consumer	privacy email-hosting gdpr norway renewable-energy open-source-webmail

At a glance: GMX Mail vs Runbox
At a glance	GMX Mail	Runbox
HQ / entity	1&1 Mail & Media GmbH, Montabaur (DE)	Not listed
Parent group	United Internet AG (DE)	Not listed
Product type	Consumer FreeMail + optional paid tiers	Not listed
Hosting (claimed)	Mailbox/calendar data in German data centers	Not listed
Protocols	Webmail; POP3/IMAP/SMTP (opt-in)	Not listed
Open source	No	Partial (Runbox 7 web app); not self-hosted
Self-hosted	No	Not listed
HQ	Not listed	Oslo, Norway
Legal entity	Not listed	Runbox Solutions AS (orgnr 996877027)
Founded	Not listed	Service since 2000; current AS form 2011
Hosting	Not listed	Email: StackInfra Oslo; optional web hosting may default US
Commercial model	Not listed	Paid subscription + trial (no permanent free tier)

Key capabilities: GMX Mail vs Runbox
Key capabilities	GMX Mail	Runbox
German operator	Yes	Not listed
Mailbox in DE (claimed)	Yes	Not listed
IMAP / POP3 / SMTP	Yes	Not listed
Optional OpenPGP	Yes	Yes
Free ad-supported	Yes	Not listed
SaaS only	Yes	Not listed
Norwegian email hosting	Not listed	Yes
IMAP / POP / SMTP	Not listed	Yes
Custom domains	Not listed	Yes
100% renewable (claimed)	Not listed	Yes
Runbox 7 open source	Not listed	Yes

GMX Mail

Large free mailbox storage with open protocols
gmx.com free accounts advertise up to 65 GB email storage and 50 MB attachments. POP3, IMAP, and SMTP are supported after you enable them in settings (TLS 1.2+; imap.gmx.com / mail.gmx.com). Suits users who want client choice (Thunderbird, Outlook, mobile) without Google or Microsoft as the mailbox host.
Optional OpenPGP end-to-end encryption (Mailvelope)
GMX offers free OpenPGP messaging via the Mailvelope browser extension: key generation, local key storage, key directory, and mobile recovery. Encryption is opt-in per message after setup—not whole-mailbox zero-access by default. Best for occasional sensitive threads when both parties can use OpenPGP.
Aliases, Mail Collector, and multi-account inbox
Create up to 10 alias addresses (including other GMX domains) managed in one inbox, and pull up to 10 external accounts via Mail Collector. Useful for freelancers and project mail without juggling multiple passwords or providers day-to-day.
Spam filtering, antivirus, and optional TOTP 2FA
Free accounts include automated spam filtering (user blacklist and optional improved detection) and antivirus scanning of mail and cloud files. Optional two-factor authentication uses an authenticator app (TOTP); third-party clients use app-specific passwords when 2FA is on.
Bundled Cloud, calendar, contacts, and Online Office
Accounts include contacts, calendar/organizer, about 2 GB GMX Cloud with share links, and Online Office for common document formats—enough for light personal productivity without a separate suite subscription.

Runbox

Norwegian-hosted IMAP email with full-disk encryption
Mailboxes live on servers Runbox places in a StackInfra facility in Oslo under Norwegian jurisdiction, with full-disk encryption at rest and TLS (including PFS) in transit. Access via IMAP, POP, SMTP, or Runbox 7 webmail suits teams that need standard clients rather than a proprietary-only app.
Custom domains, aliases, and multi-account admin
Host mail on your own domain, manage sub-accounts from a main account, and use many aliases on Runbox domains plus unlimited aliases on customer domains. Plus-addressing and filters help separate identities without running separate mailboxes.
CalDAV/CardDAV plus optional PGP or S/MIME
Integrated calendar and contacts sync over CalDAV and CardDAV with common desktop and mobile apps. End-to-end confidentiality is user-controlled via PGP or S/MIME—not zero-access by default—so operators can still index mail for search and scan for malware.
Ad-free, subscription-funded privacy model
Runbox states it does not show ads, does not use third-party trackers such as Google Analytics, and only scans messages for spam/virus protection—not advertising. Revenue is subscription-based with a public trial period, aligning incentives away from data-mining free mail.
Runbox 7 open-source webmail on hydropowered infra
The Runbox 7 web client is published on GitHub for inspection; the hosted server stack remains largely proprietary. Email infrastructure is advertised as 100% certified renewable electricity in Norway, with additional company offset claims—useful for sustainability procurement checklists.

Assurance & compliance: GMX Mail vs Runbox
Assurance & compliance	GMX Mail	Runbox
Independent security / no-logs audit	Not found OpenPGP/Mailvelope path described as externally reviewed; no public independent no-logs audit for FreeMail mailbox access found on product pages.	Not found Vendor claims minimal logging and short retention windows; no public independent audit report found
ISO 27001	Not found No GMX FreeMail-branded ISO 27001 certificate located on security/privacy pages in this research pass (group companies may hold certs under other brands).	Not found No Runbox ISO 27001 certificate found on primary pages (power supplier ISO 14001 is environmental, not info-sec)
SOC 2 / SOC 3	Not found No SOC 2/3 report found on GMX public security pages.	Not found No public SOC 2/3 report located
GDPR / EU data protection	Vendor claimed EU/German controller; public privacy notices under GDPR; DPO published; supervisory authorities named (BfDI / LfDI RLP).	Vendor claimed Norwegian entity; Personal Data Act implements GDPR; appointed DPO; privacy policy documents rights and retention
US CLOUD Act exposure (indicative)	Partial German entity and parent (United Internet AG); mailbox data claimed in German DCs. Partial/medium because portal analytics include Google LLC tools, freemail ads involve international partners, and no full public mail-infra subprocessor list. Not legal advice.	Partial No known US parent; core email in Norway. Medium/partial because privacy policy lists US third parties (Stripe, PayPal, Coinbase, Enom, JaguarPC web hosting default, NodePing). Not legal advice.
Data processing agreement (B2B)	Not found Product is primarily consumer FreeMail under GTCs/privacy policy; no public self-serve B2B DPA flow found for FreeMail shortlisting.	Not found Processor DPA with Copyleft is mentioned; no public customer-facing B2B DPA template found—ask sales/support
EU AI Act	Not applicable Not an AI-centric product; optional assistive features may appear in product privacy text but FreeMail is not marketed as an AI system.	Not applicable Email hosting product; vendor states no intrusive AI for ad profiling

Considerations & known limitations: GMX Mail vs Runbox
Considerations & known limitations	GMX Mail	Runbox
Advertising-funded free tier	Medium FreeMail depends on ads and (with consent) interest-based targeting and partner sharing. Privacy posture differs from paid privacy mail. Practical impact: expect consent UX, ad surfaces, and partner lists—not a zero-ads default.	Not listed
E2E encryption is optional, not default	Medium Without OpenPGP setup, mailbox content is accessible to the provider like conventional hosted mail. Practical impact: do not treat GMX FreeMail as zero-access encryption architecture.	Not listed
Incomplete public infrastructure subprocessors	Medium Residency for mail is claimed (Germany/EU), but there is no enterprise-style published subprocessor inventory for core mail infrastructure. Portal paths name Google Analytics and global ad partners. Practical impact: extra questionnaire work for high-assurance buyers.	Not listed
Inactivity and freemail operational policies	Low Terms/privacy allow deletion of free mailbox content after prolonged inactivity (about 180 days without login on FreeMail privacy text). Practical impact: inactive project addresses can disappear if not maintained.	Not listed
No public ISO/SOC package for FreeMail	Low Security pages emphasize product features (spam, AV, 2FA, PGP) rather than downloadable ISO/SOC evidence for FreeMail. Practical impact: may fail enterprise vendor security questionnaires without further vendor dialogue.	Not listed
Not default zero-access encryption	Not listed	Medium Unlike Proton/Tuta, Runbox can access stored mail for spam/virus scanning, indexing, and lawful process. Use PGP/S/MIME when E2EE is required.
US vendors on optional product paths	Not listed	Medium Payments (Stripe/PayPal/Coinbase), domain registrar Enom, and default JaguarPC web hosting introduce US processors. Keep web hosting in Norway and minimize US payment data if policy requires.
No public ISO 27001 / SOC 2 / independent audit	Not listed	Medium Assurance relies on vendor policy, Norwegian law, and facility claims. Regulated buyers may need NDA evidence or on-site questionnaire.
Partial open source only	Not listed	Low Runbox 7 webmail is open source; mail backend is proprietary SaaS—no self-host path.
Post-closure and backup retention	Not listed	Low Privacy policy defines multi-month content retention and backup windows after closure (and longer account-info retention for bookkeeping). Request immediate deletion if policy requires faster wipe.

Fit

GMX Mail

Best fit when

Individuals and freelancers who want a European freemail address with large free storage and IMAP client freedom
Users consolidating multiple addresses via aliases (up to 10) and Mail Collector
Buyers who prefer a German legal controller (1&1 Mail & Media GmbH / United Internet) over US Big Tech freemail
Teams that only need optional OpenPGP for specific sensitive threads, not zero-access by default
Users already familiar with GMX/WEB.DE in German-speaking markets who need international domains (e.g. gmx.com)

Poor fit when

Organizations that require default end-to-end / zero-access encryption for all mail
Procurement that needs a published independent security audit pack, ISO/SOC evidence, and a B2B DPA as standard shortlist inputs
Teams that cannot accept advertising-funded freemail economics or interest-based ad consent UX
Custom-domain corporate mail and admin controls at Microsoft 365 / Google Workspace depth
Self-hosted or open-source mail stack requirements

Consider instead when

When: You need zero-access encryption by default and a privacy-first paid model without ad-funded freemail as the core product
Consider: Proton Mail
Proton is the stronger shortlist peer in this catalog for E2E-first evaluation.
When: You need Google Workspace-class collaboration and are willing to accept US Big Tech jurisdiction
Consider: Gmail / Google Workspace
Richer suite integration; different sovereignty and ad/ecosystem tradeoffs.
When: You need Microsoft ecosystem mail, calendar, and compliance tooling
Consider: Outlook.com / Microsoft 365
Strong enterprise admin story; US parent and CLOUD Act path differ from GMX.

Runbox

Best fit when

Teams that want Oslo-hosted mailboxes under Runbox Solutions AS and Norwegian law, with full IMAP client freedom
Organizations needing custom domains, multi-account admin, and generous alias patterns without self-hosting an MTA
Buyers who prioritize subscription-funded, ad-free email over free ad-supported Gmail/Outlook tiers
Procurement that values renewable-energy data-center claims and Ethical Consumer Best Buy style ESG signals
Users comfortable managing optional PGP/S/MIME when message-level E2EE is needed for specific threads

Poor fit when

Requirements for default zero-access encryption where the provider cannot read mailbox content (prefer Proton Mail or Tuta)
Need for a fully self-hosted or fully open-source mail server stack
Heavy dependence on Microsoft 365 collaboration (Teams, SharePoint, advanced Exchange) rather than plain email hosting
Mandatory public ISO 27001 or SOC 2 evidence before shortlist—none found on public Runbox pages in this research pass
Optional product paths (default US web hosting via JaguarPC) when a strict no-US-vendor rule covers every SKU

Consider instead when

When: You need default end-to-end / zero-access encryption for all messages
Consider: Proton Mail or Tuta
Runbox uses optional PGP/S/MIME; operator can access stored mail for filtering and lawful process
When: You want a German privacy-oriented host with similar sustainability positioning
Consider: Posteo
Compare jurisdiction (DE vs NO), domain limits, and feature depth
When: You need Belgian email with integrated collaboration extras
Consider: Mailfence
Different encryption defaults and product scope
When: You need global free-tier convenience and suite lock-in
Consider: Gmail or Outlook.com / Microsoft 365
Accept US jurisdiction and ad/suite economics tradeoffs

Open questions for due diligence

GMX Mail

Will 1&1 Mail & Media sign a B2B DPA and publish a current mail-infrastructure subprocessor list for our use case?
Are FreeMail mailbox systems solely on United Internet / 1&1 operated German DCs, or are any US-group cloud providers used for primary storage, backup, or DR?
What independent audits or certifications (if any) cover the FreeMail platform beyond the Mailvelope/OpenPGP path?
For paid/premium mailboxes: which advertising and tracking paths remain, and what contractual residency language is available?

Runbox

Will Runbox sign a customer-facing B2B DPA listing all subprocessors for your tenant configuration?
Can optional web hosting and domain registration be restricted to EEA-only providers for your account?
Is any independent penetration test or SOC/ISO report available under NDA?
What is the current employee ownership share and any non-EU shareholding since the 2018 figure on the About page?
Confirm backup geography (privacy policy: secure servers separate from main system—are they also Norway-only?)