Compare Inbox.eu and mailbox (formerly mailbox.org) on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Microsoft 365
Latvia· Email Services
Needs review
Shortlist Inbox.eu when you need Latvia-hosted, ad-free SME email with large included storage, custom domains, IMAP clients, and business SSO under an EU operator. Skip when you require zero-knowledge E2E crypto or published ISO/SOC audits—consider Proton Mail, Tuta, Posteo, or mailbox.org instead.
Germany· Office Productivity Suite
Needs review
Shortlist mailbox when you need a German-operated email-plus-collaboration suite (Mail, Drive, Office, Meet, Admin/API) on dual Berlin sites with published BSI C5 Type 1 and ISO 27001 claims. Skip when you require free forever mail or default zero-knowledge for all messages—consider Proton Mail or Tuta instead.
Highlighted rows differ between the two products.
| Feature | mailbox (formerly mailbox.org) | |
|---|---|---|
| Country of origin | Latvia | Germany |
| Category | Email Services | Office Productivity Suite |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Latvia | Germany |
| Legal entity | SIA INBOKSS (Inbokss Ltd), reg. no. 40003560720, Matrozu street 15-2, Riga, LV-1048 | Heinlein Hosting GmbH (Berlin; CEO Peer Heinlein) |
| Governing law | Republic of Latvia / EU GDPR | Not listed |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Low |
| Hosting / residency | Mailbox/file data: vendor claims own servers in Latvia (Riga DC, EN 50600-3) with live multi-copy backups and no EU exit. Web property privacy policy lists Google Analytics, Meta Pixel, Gemius, AdBox, InMobi CMP, and hCaptcha—US/global SaaS for analytics, ads, consent, and bot defence. No public full mail-path subprocessor register found. | Core mailbox, Drive, and Meet on Heinlein-operated servers in German data centres in Berlin (two independent locations). Website analytics: self-hosted Matomo. Marketing site may embed Vimeo/YouTube. No public AWS/GCP/Azure product hosting region found for customer mail data. |
| Summary | Latvia-based hosted email from SIA INBOKSS with ad-free personal and business mailboxes, custom domains, large integrated file storage, calendar/contacts, and mobile apps. | German paid digital workplace from Heinlein Hosting GmbH: secure email with PGP/S/MIME, Drive, browser Office, Meet, and business Admin on dual Berlin data centres. |
| Tags |
| At a glance | mailbox (formerly mailbox.org) | |
|---|---|---|
| HQ | Riga, Latvia (EU) | Berlin, Germany |
| Legal entity | SIA INBOKSS (reg. 40003560720) | Heinlein Hosting GmbH |
| Product since | Inbokss 1998; Inbox.eu brand from 2011 | Not listed |
| Hosting | Vendor-claimed own servers in Latvia; multi-server backups | Own servers, dual independent Berlin sites |
| Open source | No | Not listed |
| Self-host | No | No (managed SaaS) |
| Commercial model | Prepaid personal/business premium; time-limited trial | Not listed |
| Model | Not listed | Paid subscription SaaS; trial available; no permanent free tier |
| Open standards | Not listed | IMAP/SMTP, CalDAV/CardDAV, WebDAV, PGP, S/MIME |
| Key capabilities | mailbox (formerly mailbox.org) | |
|---|---|---|
| EU-operated (Latvia) | Yes | Yes |
| 100 GB mail + files | Yes | Not listed |
| Custom domains | Yes | Not listed |
| IMAP / SMTP | Yes | Not listed |
| SAML / LDAP SSO | Yes | Not listed |
| TLS, not ZK E2E | Yes | Not listed |
| Berlin dual-site hosting | Not listed | Yes |
| PGP + S/MIME | Not listed | Yes |
| BSI C5 Type 1 (claimed) | Not listed | Yes |
| ISO 27001 (claimed) | Not listed | Yes |
| Mail + Drive + Meet + Office | Not listed | Yes |
100 GB mailbox plus integrated Files storage
Premium accounts include a large combined email-and-files quota (business adds domain-level shared storage). Files supports multi-gigabyte uploads, share links, parallel downloads, and WebDAV mounting on desktop—useful for SMEs that want drive-like sharing without a separate vendor.
Custom domains with business admin panel
Business email lets you host unlimited domain mailboxes after DNS/MX validation, with admin controls for users, aliases, catch-all, and domain settings. A public demo of the admin experience is available for evaluation before signup.
Standard protocols plus mobile apps
Full IMAP, POP3, and SMTP (with TLS) for Thunderbird, Outlook, and other clients; calendar and contacts sync; official apps on iOS and Android. Fits teams that refuse webmail lock-in.
TLS, 2FA, spam filtering, and business SSO
Transport encryption with TLS 1.2+, optional two-factor authentication, multi-filter spam/malware scanning, and Business SSO via SAML 2.0 or LDAP (including common IdPs such as Azure AD and Google Workspace). This is hosted-email security, not zero-knowledge E2E.
Migration support and human multilingual help
Documented IMAP/CSV migration paths from Gmail and other providers, plus real-person support in English and Baltic languages rather than chatbot-only queues—material for SMEs without a dedicated mail ops team.
PGP Guard, S/MIME, and hardened mail transport
Webmail Guard for PGP without extra software (or Mailvelope with local keys), S/MIME for sign/encrypt, 2FA and app passwords, multi-stage spam/virus rejection, plus public transport controls (DNSSEC, DANE, MTA-STS, DMARC/DKIM/SPF, TLS checker, @secure.mailbox.org aliases). Benefits security-minded teams that still need interoperable IMAP/SMTP; content is not zero-knowledge by default unless you encrypt.
Drive on dual independent Berlin sites
Cloud files on the provider's own German infrastructure with two independent Berlin locations, WebDAV, mobile apps, guest share links, expandable quota, and optional client-side OpenPGP encryption of stored files. Fits teams replacing consumer cloud drives while keeping residency claims concrete; confirm plan quotas on the official site.
Browser Office with CalDAV and CardDAV
Edit common office formats in the browser, share calendars and contacts via open CalDAV/CardDAV standards, plus tasks, notes, polls, and TLS-secured XMPP chat. Aimed at SMEs and schools that want collaboration without a full Microsoft desktop stack; advanced Excel macros and deep Office add-ins are not the target.
Meet video hosted in German data centres
Browser-based conferencing integrated with calendar and mail: link invites for external guests, breakout rooms, screen share, chat, surveys, and moderator controls. Privacy documentation references the OpenTalk stack; sessions run through mailbox's German data centres. Evaluate E2EE defaults and recording policies against your meeting compliance needs.
Business Admin console and automation API
Central management of domains, mailboxes, quotas, spam/virus settings, IP allowlists, and backups, with an HTTP API for larger orgs and resellers (api.mailbox.org). Supports onboarding help and partner-assisted migration. Better for multi-seat German operations than pure consumer inboxes; not a full IdP replacement without SSO design work.
| Assurance & compliance | mailbox (formerly mailbox.org) | |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party audit PDF or no-logs attestation located on security/help pages. | Not found No public independent no-logs audit PDF found; operational transparency reports and BSI/ISO artefacts instead |
| ISO 27001 | Not found No ISO 27001 certificate or registry entry found on official site. | Vendor claimed Vendor states ISO/IEC 27001:2022 on certified-quality and press pages; request current certificate in diligence |
| SOC 2 / SOC 3 | Not found No SOC 2/3 report referenced on official site. | Not found No SOC 2/3 claim found on primary security/cert pages |
| GDPR / EU data protection | Vendor claimed EU (Latvia) controller SIA INBOKSS; vendor states 100% GDPR compliance and Latvia hosting. Confirm DPA and subprocessors for your workload. | Vendor claimed German controller Heinlein Hosting GmbH; DE hosting; detailed privacy notice; DPO privacy@mailbox.org |
| US CLOUD Act exposure (indicative) | Partial EU entity / no known US parent; mail claimed on own Latvia servers. Residual medium exposure via US-group web SaaS in privacy policy (Google Analytics, Meta Pixel, hCaptcha, InMobi). Not legal advice. | Partial EU/German entity, no known US parent, self-operated Berlin hosting for core data—no AWS/GCP/Azure product region found. Residual: marketing embeds (Vimeo/YouTube) and possible external payment services. Indicative assessment only, not legal advice. |
| Data processing agreement (B2B) | Not found TOS mentions controller/processor roles under GDPR, but no standalone public DPA download found—request in writing. | Vendor claimed Business knowledge base: customers can conclude a DPA online; historic AVV portal for business accounts |
| EU AI Act | Not applicable Conventional email hosting; not an AI-system product. | Not applicable Email/collaboration suite, not an AI product core |
| BSI C5 | Not listed | Vendor claimed Vendor press (7 Jan 2026): BSI C5 Type 1 attestation for mailbox; confirm type, scope, and period |
| Considerations & known limitations | mailbox (formerly mailbox.org) | |
|---|---|---|
| No public ISO/SOC or independent audit | Medium Enterprise RFPs that require cert packs will stall until the vendor supplies private assurance materials. | Not listed |
| Not zero-knowledge E2E mail | Medium Operator-controlled storage with TLS in transit; legal-process access is acknowledged. Do not shortlist as a Proton/Tuta crypto peer. | Not listed |
| US-group tools on website privacy path | Medium Google Analytics, Meta Pixel, hCaptcha, and InMobi appear in the privacy policy even while mail is marketed as Latvia-only—align transfer assessments and cookies consent with this split. | Not listed |
| Public DPA / subprocessor list gap | Medium Processor language exists in TOS, but buyers still need a signed DPA and current subprocessors for regulated personal data. | Not listed |
| Operator also runs ad-supported portals | Low Inbokss group products include advertising-supported regional portals; verify contractually that paid Inbox.eu mailboxes stay ad-free and outside portal ad profiling. | Not listed |
| Mail is not zero-knowledge by default | Not listed | Medium Without PGP/S/MIME, stored message content remains operator-accessible under legal process. Practical impact: train users or mandate Guard/S/MIME for confidential traffic. |
| C5 Type 1 is point-in-time | Not listed | Low Type 1 attestations describe design/implementation at a point in time. Re-check type (1 vs 2), scope, and renewal dates for public-sector RFPs. |
| Payment and edge processors need confirmation | Not listed | Low Core hosting is self-operated DE, but privacy text references external payment services; marketing embeds US video hosts. Ask for the current processor list with the DPA. |
| Not a full Microsoft 365 ecosystem substitute | Not listed | Medium Browser Office and Meet cover common collaboration; deep desktop macros, Graph automations, and third-party M365 marketplaces will not map 1:1. |
| No customer self-host option | Not listed | Low Organisations that must operate mail on their own iron need another stack; mailbox is multi-tenant SaaS. |
When: You need open or heavily audited zero-knowledge end-to-end encrypted mail
Consider: Proton Mail or Tuta
Different crypto posture than TLS-hosted conventional mail
When: You prefer German jurisdiction and a long-standing privacy-host reputation
Consider: Posteo or mailbox.org
Often leaner storage; strong EU privacy positioning
When: You already depend on Docs/Drive/Meet or full Microsoft 365 collaboration
Consider: Google Workspace or Microsoft 365
Inbox.eu is not a suite replacement
When: You want Belgian dual-key / open-source-oriented secure mail
Consider: Mailfence
Different feature and crypto tradeoffs
When: You need default end-to-end encrypted mail as the primary product
Consider: Proton Mail or Tuta
Stronger E2EE-first posture; lighter full workplace suite than mailbox
When: You want minimal German privacy email without Drive/Office/Meet
Consider: Posteo
Leaner mailbox; fewer collaboration modules
When: You need full desktop Office parity and global SaaS integrations
Consider: Microsoft 365 (incumbent) with separate residency controls
Different risk and ecosystem tradeoff—not an EU peer