Hostpoint E-Mail & Cloud Office vs mailbox (formerly mailbox.org)

Compare Hostpoint E-Mail & Cloud Office and mailbox (formerly mailbox.org) on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Microsoft 365

Hostpoint E-Mail & Cloud Office

Switzerland· Email Services

Needs review

Shortlist Hostpoint E-Mail & Cloud Office when you need Swiss-hosted custom-domain IMAP mail plus Open-Xchange calendars, Drive, and optional browser docs under Hostpoint AG—with Swiss human support and free mailbox migration. Skip when you require end-to-end zero-access mail (consider Proton Mail) or a full Microsoft 365 / Google Workspace admin stack; for another Swiss multi-product cloud suite, compare Infomaniak kMail.

Swiss-hosted mailCustom domain IMAPOpen-Xchange Cloud OfficeDrive + CalDAV/CardDAV7-day Swiss supportB2B DPA (GTC annex)

View listing Visit Website

mailbox (formerly mailbox.org)

Germany· Office Productivity Suite

Needs review

Shortlist mailbox when you need a German-operated email-plus-collaboration suite (Mail, Drive, Office, Meet, Admin/API) on dual Berlin sites with published BSI C5 Type 1 and ISO 27001 claims. Skip when you require free forever mail or default zero-knowledge for all messages—consider Proton Mail or Tuta instead.

German-operatedBerlin dual-site hostingPGP + S/MIMEBSI C5 Type 1 (claimed)ISO 27001 (claimed)Mail + Drive + Meet + Office

View listing Visit Website

Highlighted rows differ between the two products.

Hostpoint E-Mail & Cloud Office vs mailbox (formerly mailbox.org): Snapshot
Feature	Hostpoint E-Mail & Cloud Office	mailbox (formerly mailbox.org)
Country of origin	Switzerland	Germany
Category	Email Services	Office Productivity Suite
Open source	No	No
Self-hosted	No	No
Headquarters	Switzerland	Germany
Legal entity	Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil-Jona, Switzerland	Heinlein Hosting GmbH (Berlin; CEO Peer Heinlein)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Low
Hosting / residency	Primary: Hostpoint-operated servers and NetApp storage at Digital Realty (ex-Interxion) Glattbrugg, CH; Swiss e-mail/Drive residency claimed, dual backups, hourly snapshots. swiss hosting label (rankingCoach exception). Migration: Audriga (DE). Full public Sub-Processor List not found—DPA references list. Site analytics: Google Analytics, reCAPTCHA, Hotjar (not mailbox storage).	Core mailbox, Drive, and Meet on Heinlein-operated servers in German data centres in Berlin (two independent locations). Website analytics: self-hosted Matomo. Marketing site may embed Vimeo/YouTube. No public AWS/GCP/Azure product hosting region found for customer mail data.
Summary	Swiss custom-domain email and Open-Xchange Cloud Office (calendar, Drive, docs) from Hostpoint AG, with mailboxes and data hosted in Switzerland.	German paid digital workplace from Heinlein Hosting GmbH: secure email with PGP/S/MIME, Drive, browser Office, Meet, and business Admin on dual Berlin data centres.
Tags	email productivity swiss-hosting cloud-office open-xchange custom-domain sme imap groupware fadp	email productivity privacy gdpr german-hosting bsi-c5 iso-27001 collaboration

At a glance: Hostpoint E-Mail & Cloud Office vs mailbox (formerly mailbox.org)
At a glance	Hostpoint E-Mail & Cloud Office	mailbox (formerly mailbox.org)
HQ	Rapperswil-Jona, Switzerland	Berlin, Germany
Legal entity	Hostpoint AG (CHE-101.974.997)	Heinlein Hosting GmbH
Product	Custom-domain email + Cloud Office (Open-Xchange)	Not listed
Hosting	Hostpoint servers, Digital Realty Glattbrugg (CH)	Own servers, dual independent Berlin sites
Self-host / OSS	Neither (managed SaaS)	Not listed
Commercial model	Paid per-mailbox tiers; domain required; no free tier	Not listed
Model	Not listed	Paid subscription SaaS; trial available; no permanent free tier
Self-host	Not listed	No (managed SaaS)
Open standards	Not listed	IMAP/SMTP, CalDAV/CardDAV, WebDAV, PGP, S/MIME

Key capabilities: Hostpoint E-Mail & Cloud Office vs mailbox (formerly mailbox.org)
Key capabilities	Hostpoint E-Mail & Cloud Office	mailbox (formerly mailbox.org)
Swiss-hosted mail	Yes	Not listed
Custom domain IMAP	Yes	Not listed
Open-Xchange Cloud Office	Yes	Not listed
Drive + CalDAV/CardDAV	Yes	Not listed
7-day Swiss support	Yes	Not listed
B2B DPA (GTC annex)	Yes	Not listed
German-operated	Not listed	Yes
Berlin dual-site hosting	Not listed	Yes
PGP + S/MIME	Not listed	Yes
BSI C5 Type 1 (claimed)	Not listed	Yes
ISO 27001 (claimed)	Not listed	Yes
Mail + Drive + Meet + Office	Not listed	Yes

Hostpoint E-Mail & Cloud Office

Custom-domain mailboxes with IMAP and free migration
Each plan is one inbox on a domain you control (new or external), with webmail plus IMAP/POP3/SMTP, unlimited forwards, aliases, out-of-office replies, server-side search, and spam/virus filters. Hostpoint’s free migration path (including Audriga-assisted moves from Gmail, GMX, Bluewin, Yahoo, and other hosts) is designed so teams keep historical mail when leaving FreeMail. Requires a domain; not a freemail brand address.
Open-Xchange Cloud Office: calendar, contacts, tasks
Browser suite for multi-calendar scheduling, shared address books, tasks, and appointment booking with free/busy style team scheduling. CalDAV/CardDAV sync targets Outlook, Thunderbird, Apple Calendar, and similar clients. Fits SMEs that want groupware next to IMAP without a full Microsoft 365 tenant.
Hostpoint Drive with desktop and mobile clients
Swiss-hosted file storage included per tier (upgradeable within product limits), with share links, e-mail shares, access controls, and local clients for Windows, macOS, iOS, and Android (Open-Xchange-powered). Business tier adds managing shared folders in teams. This is conventional cloud storage under Hostpoint—not zero-knowledge Drive.
Browser documents and real-time collaboration (Plus/Business)
From Cloud Office Plus upward, edit text, spreadsheets, and presentations in the browser with Microsoft Office file compatibility, real-time multi-user editing, and version history. Basic is mail-plus-calendar oriented; teams that live in shared docs should shortlist Plus or Business rather than Basic.
Swiss ops: dual backups, monitoring, seven-day support
Product pages claim Swiss data location, 24/7 monitoring, DDoS protection, hourly snapshots, daily mail backups with tiered retention (longer on higher tiers), and backup copies in two locations. Support is Swiss-based Mon–Sun daytime via phone, e-mail, WhatsApp, and form—useful for SMEs that need humans, not only tickets.

mailbox (formerly mailbox.org)

PGP Guard, S/MIME, and hardened mail transport
Webmail Guard for PGP without extra software (or Mailvelope with local keys), S/MIME for sign/encrypt, 2FA and app passwords, multi-stage spam/virus rejection, plus public transport controls (DNSSEC, DANE, MTA-STS, DMARC/DKIM/SPF, TLS checker, @secure.mailbox.org aliases). Benefits security-minded teams that still need interoperable IMAP/SMTP; content is not zero-knowledge by default unless you encrypt.
Drive on dual independent Berlin sites
Cloud files on the provider's own German infrastructure with two independent Berlin locations, WebDAV, mobile apps, guest share links, expandable quota, and optional client-side OpenPGP encryption of stored files. Fits teams replacing consumer cloud drives while keeping residency claims concrete; confirm plan quotas on the official site.
Browser Office with CalDAV and CardDAV
Edit common office formats in the browser, share calendars and contacts via open CalDAV/CardDAV standards, plus tasks, notes, polls, and TLS-secured XMPP chat. Aimed at SMEs and schools that want collaboration without a full Microsoft desktop stack; advanced Excel macros and deep Office add-ins are not the target.
Meet video hosted in German data centres
Browser-based conferencing integrated with calendar and mail: link invites for external guests, breakout rooms, screen share, chat, surveys, and moderator controls. Privacy documentation references the OpenTalk stack; sessions run through mailbox's German data centres. Evaluate E2EE defaults and recording policies against your meeting compliance needs.
Business Admin console and automation API
Central management of domains, mailboxes, quotas, spam/virus settings, IP allowlists, and backups, with an HTTP API for larger orgs and resellers (api.mailbox.org). Supports onboarding help and partner-assisted migration. Better for multi-seat German operations than pure consumer inboxes; not a full IdP replacement without SSO design work.

Assurance & compliance: Hostpoint E-Mail & Cloud Office vs mailbox (formerly mailbox.org)
Assurance & compliance	Hostpoint E-Mail & Cloud Office	mailbox (formerly mailbox.org)
Independent security / no-logs audit	Not found No public third-party no-logs or product security audit PDF for Cloud Office located on official pages.	Not found No public independent no-logs audit PDF found; operational transparency reports and BSI/ISO artefacts instead
ISO 27001	Not found Company page describes the Glattbrugg data center as ISO- and FINMA-certified (facility). No Hostpoint-organization ISO 27001 certificate page found in this pass.	Vendor claimed Vendor states ISO/IEC 27001:2022 on certified-quality and press pages; request current certificate in diligence
SOC 2 / SOC 3	Not found No public SOC 2/3 report for Hostpoint Cloud Office found.	Not found No SOC 2/3 claim found on primary security/cert pages
GDPR / EU data protection	Vendor claimed Swiss FADP primary; privacy states GDPR may apply in some processing. EU representative: Hostpoint Limited, Malta. Swiss–EU adequacy eases transfers. Customer remains controller for hosted content.	Vendor claimed German controller Heinlein Hosting GmbH; DE hosting; detailed privacy notice; DPO privacy@mailbox.org
US CLOUD Act exposure (indicative)	Partial EuropeanStack assessment: Swiss AG, no known US parent, Swiss product residency claims → relatively low ownership exposure vs US SaaS mail. Residual factors: US-listed Digital Realty facility owner (colocation), possible US-group tools on full subprocessor/marketing stack, privacy exceptional-transfer language. Not a clean bill; not legal advice.	Partial EU/German entity, no known US parent, self-operated Berlin hosting for core data—no AWS/GCP/Azure product region found. Residual: marketing embeds (Vimeo/YouTube) and possible external payment services. Indicative assessment only, not legal advice.
Data processing agreement (B2B)	Vendor claimed Annex 2 DPA + TOMs published with web-hosting GTC PDF; sub-processor engagement rules and audit rights described. Confirm applicability to your E-Mail & Cloud Office order and obtain current Sub-Processor List.	Vendor claimed Business knowledge base: customers can conclude a DPA online; historic AVV portal for business accounts
EU AI Act	Not applicable Not an AI product.	Not applicable Email/collaboration suite, not an AI product core
swiss hosting label	Vendor claimed Company states Hostpoint bears the swiss hosting label (HQ + data location in Switzerland), with rankingCoach exceptions noted.	Not listed
BSI C5	Not listed	Vendor claimed Vendor press (7 Jan 2026): BSI C5 Type 1 attestation for mailbox; confirm type, scope, and period

Considerations & known limitations: Hostpoint E-Mail & Cloud Office vs mailbox (formerly mailbox.org)
Considerations & known limitations	Hostpoint E-Mail & Cloud Office	mailbox (formerly mailbox.org)
Not zero-access / E2E mail	Medium Standard hosted mail: provider can access mailbox content for operations, spam filtering, and legal process. Unsuitable if your threat model requires only client-held keys.	Not listed
Full subprocessor inventory not self-serve	Medium DPA references a Sub-Processor List and change notifications, but a complete public e-mail-path inventory was not found on the marketing site. Request it (and any US-group vendors) before procurement sign-off.	Not listed
Facility ISO/FINMA vs org certification	Low ISO/FINMA language on public pages refers to the data center facility. Do not treat that as a verified Hostpoint ISMS ISO 27001 without a certificate.	Not listed
Docs collaboration only on higher tiers	Low Browser Office documents and real-time collab start at Plus; team shared-folder management is Business-oriented. Basic is intentionally limited.	Not listed
Customer still owns backup duty	Low GTC state customers remain responsible for their own backups; Hostpoint packages are supplementary and do not guarantee zero data loss.	Not listed
Mail is not zero-knowledge by default	Not listed	Medium Without PGP/S/MIME, stored message content remains operator-accessible under legal process. Practical impact: train users or mandate Guard/S/MIME for confidential traffic.
C5 Type 1 is point-in-time	Not listed	Low Type 1 attestations describe design/implementation at a point in time. Re-check type (1 vs 2), scope, and renewal dates for public-sector RFPs.
Payment and edge processors need confirmation	Not listed	Low Core hosting is self-operated DE, but privacy text references external payment services; marketing embeds US video hosts. Ask for the current processor list with the DPA.
Not a full Microsoft 365 ecosystem substitute	Not listed	Medium Browser Office and Meet cover common collaboration; deep desktop macros, Graph automations, and third-party M365 marketplaces will not map 1:1.
No customer self-host option	Not listed	Low Organisations that must operate mail on their own iron need another stack; mailbox is multi-tenant SaaS.

Fit

Hostpoint E-Mail & Cloud Office

Best fit when

Swiss SMEs and freelancers replacing FreeMail with branded @domain mailboxes
Teams that want IMAP mail plus shared calendars, contacts, and Drive in one Swiss panel
Buyers already using Hostpoint domains/hosting who want same-vendor mail and support
Organizations that prioritize Swiss data location messaging and Swiss daytime phone support
Migrators from Gmail/GMX/Bluewin who need an included mailbox migration path

Poor fit when

Security programs that require zero-access / E2E encrypted mail by default
Enterprises needing SSO/SCIM-centric identity and deep SaaS compliance tooling out of the box
Teams that only want free freemail without a domain or paid plan
Self-host or fully open-source groupware mandates
Buyers who need a published independent security audit report before shortlisting

Consider instead when

When: You need end-to-end encrypted, zero-access mail as the primary control
Consider: Proton Mail or Tuta
Hostpoint is conventional hosted Open-Xchange mail, not a zero-knowledge mailbox.
When: You want a broader Swiss cloud suite (kDrive, Swiss Meet, etc.) under one multi-product vendor
Consider: Infomaniak kMail
Compare suite breadth vs Hostpoint’s registrar/hosting + Cloud Office focus.
When: You need Microsoft/Google admin ecosystems, global collaboration defaults, or advanced DLP
Consider: Microsoft 365 or Google Workspace
Trade Swiss-operator simplicity for global SaaS depth and US-group jurisdiction.
When: You want German privacy-oriented hosted mail with OpenPGP-centric workflows
Consider: mailbox.org or Mailfence
Different legal HQ and crypto posture; Hostpoint is Swiss SME groupware-first.

mailbox (formerly mailbox.org)

Best fit when

German or EU orgs replacing Gmail/Microsoft 365 for mail and light collaboration under German law
Teams that need IMAP/SMTP plus CalDAV/CardDAV and optional custom domains
Buyers that will use PGP Guard or S/MIME deliberately for sensitive mail
SMEs and schools wanting Drive, browser Office, and Meet without a US hyperscaler
Organisations that need multi-seat Admin, DPA, and an automation API

Poor fit when

Users who need a permanent free tier
Buyers requiring default zero-knowledge mail for every user without crypto setup
Teams that must self-host the full stack on their own infrastructure
Enterprises whose workflows depend on deep Microsoft Graph or Google Workspace add-ons

Consider instead when

When: You need default end-to-end encrypted mail as the primary product
Consider: Proton Mail or Tuta
Stronger E2EE-first posture; lighter full workplace suite than mailbox
When: You want minimal German privacy email without Drive/Office/Meet
Consider: Posteo
Leaner mailbox; fewer collaboration modules
When: You need full desktop Office parity and global SaaS integrations
Consider: Microsoft 365 (incumbent) with separate residency controls
Different risk and ecosystem tradeoff—not an EU peer

Open questions for due diligence

Hostpoint E-Mail & Cloud Office

What is the current Sub-Processor List for E-Mail & Cloud Office (including spam/AV engines, backup tooling, Audriga, any CDN)?
Does your contract package explicitly attach the web-hosting DPA annex to standalone Cloud Office mailboxes?
Any US-group processors in the live list that would change a CLOUD Act or transfer assessment?
Is there a customer-facing ISO/SOC report for Hostpoint operations beyond data-center facility claims?
Data residency guarantees in writing for dual backup locations (both fully in Switzerland)?

mailbox (formerly mailbox.org)

What is the exact current BSI C5 scope, type, and validity period on the attestation document?
Which payment processors and any other subprocessors appear in the live AVV annex?
What is the default Meet encryption mode (TLS-only vs optional E2EE) for your plan, and is recording available?
Which SSO/IdP integrations are supported for your business tier beyond generic SSO mentions?