Compare Inbox.eu and Migadu on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Google Workspace, Microsoft 365
Latvia· Email Services
Needs review
Shortlist Inbox.eu when you need Latvia-hosted, ad-free SME email with large included storage, custom domains, IMAP clients, and business SSO under an EU operator. Skip when you require zero-knowledge E2E crypto or published ISO/SOC audits—consider Proton Mail, Tuta, Posteo, or mailbox.org instead.
Switzerland· Email Services
Needs review
Shortlist Migadu when you need Swiss-operated, standards IMAP/SMTP hosting with unlimited addresses across many domains under flat account quotas—especially agencies and multi-domain SMEs. Skip when you need provider E2EE defaults, contractual SLA on the default offer, mailbox 2FA, or bulk/transactional sending; consider Proton Mail/Tuta for E2EE, or mailbox.org/Mailfence/Posteo/Runbox for other European professional-mail tradeoffs.
Highlighted rows differ between the two products.
| Feature | Migadu | |
|---|---|---|
| Country of origin | Latvia | Switzerland |
| Category | Email Services | Email Services |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Latvia | Switzerland |
| Legal entity | SIA INBOKSS (Inbokss Ltd), reg. no. 40003560720, Matrozu street 15-2, Riga, LV-1048 | Migadu-Mail GmbH |
| Governing law | Republic of Latvia / EU GDPR | Canton of Appenzell Ausserrhoden, Swiss Confederation (terms) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Mailbox/file data: vendor claims own servers in Latvia (Riga DC, EN 50600-3) with live multi-copy backups and no EU exit. Web property privacy policy lists Google Analytics, Meta Pixel, Gemius, AdBox, InMobi CMP, and hCaptcha—US/global SaaS for analytics, ads, consent, and bot defence. No public full mail-path subprocessor register found. | Mail servers stated in France (EU). Payment subprocessors Stripe and PayPal (US) for billing data. Full mail infrastructure/backup subprocessor list not published by name on primary pages. |
| Summary | Latvia-based hosted email from SIA INBOKSS with ad-free personal and business mailboxes, custom domains, large integrated file storage, calendar/contacts, and mobile apps. | Swiss-operated, standards-based email hosting for custom domains: unlimited addresses and multi-domain accounts priced by usage quotas, not per mailbox. |
| Tags |
| At a glance | Migadu | |
|---|---|---|
| HQ | Riga, Latvia (EU) | Not listed |
| Legal entity | SIA INBOKSS (reg. 40003560720) | Not listed |
| Product since | Inbokss 1998; Inbox.eu brand from 2011 | Not listed |
| Hosting | Vendor-claimed own servers in Latvia; multi-server backups | Not listed |
| Open source | No | Not listed |
| Self-host | No | No |
| Commercial model | Prepaid personal/business premium; time-limited trial | Flat per-account plans by daily message quotas + soft storage |
| HQ / entity | Not listed | Migadu-Mail GmbH, Switzerland |
| Founded | Not listed | 2014 (vendor About) |
| Mail hosting | Not listed | Data centers in France (vendor Pro/Cons) |
| Open source product? | Not listed | No — built on open-source stack; service is proprietary SaaS |
| Ownership | Not listed | Bootstrapped; no outside capital (vendor claim) |
| Key capabilities | Migadu | |
|---|---|---|
| EU-operated (Latvia) | Yes | Not listed |
| 100 GB mail + files | Yes | Not listed |
| Custom domains | Yes | Not listed |
| IMAP / SMTP | Yes | Not listed |
| SAML / LDAP SSO | Yes | Not listed |
| TLS, not ZK E2E | Yes | Not listed |
| Swiss operator | Not listed | Yes |
| Usage-priced multi-domain | Not listed | Yes |
| SMTP/IMAP/POP3 | Not listed | Yes |
| Mail hosted in France | Not listed | Yes |
| Multi-admin + API | Not listed | Yes |
| No ads / no tracking | Not listed | Yes |
100 GB mailbox plus integrated Files storage
Premium accounts include a large combined email-and-files quota (business adds domain-level shared storage). Files supports multi-gigabyte uploads, share links, parallel downloads, and WebDAV mounting on desktop—useful for SMEs that want drive-like sharing without a separate vendor.
Custom domains with business admin panel
Business email lets you host unlimited domain mailboxes after DNS/MX validation, with admin controls for users, aliases, catch-all, and domain settings. A public demo of the admin experience is available for evaluation before signup.
Standard protocols plus mobile apps
Full IMAP, POP3, and SMTP (with TLS) for Thunderbird, Outlook, and other clients; calendar and contacts sync; official apps on iOS and Android. Fits teams that refuse webmail lock-in.
TLS, 2FA, spam filtering, and business SSO
Transport encryption with TLS 1.2+, optional two-factor authentication, multi-filter spam/malware scanning, and Business SSO via SAML 2.0 or LDAP (including common IdPs such as Azure AD and Google Workspace). This is hosted-email security, not zero-knowledge E2E.
Migration support and human multilingual help
Documented IMAP/CSV migration paths from Gmail and other providers, plus real-person support in English and Baltic languages rather than chatbot-only queues—material for SMEs without a dedicated mail ops team.
Usage-metered accounts with unlimited addresses
Plans are flat per Migadu account. Within daily in/out quotas and soft storage guidance, create large numbers of mailboxes and host many domains without per-address fees—useful for agencies and multi-project teams. Soft storage does not hard-bounce mail; sustained over-quota use can force upgrades or limits.
Standards SMTP, IMAP4, POP3, and webmail
No proprietary client protocol. Connect Thunderbird, Apple Mail, Outlook, mutt, and others over TLS (typical endpoints imap.migadu.com:993, smtp.migadu.com:465, pop.migadu.com:995). ManageSieve filtering, aliases, pattern rewrites, identities, footers, auto-responders, and optional catch-alls cover classic postmaster needs. Data remains portable via standard protocols.
Multi-domain admin, multi-admin, and beta API
Agencies can hold many client domains under one roof, open multiple administrators (domain-scoped on higher plans), set per-domain/mailbox limits, and monitor traffic. A REST API (documented as early beta) manages domains, mailboxes, identities, forwardings, aliases, and rewrites for automation. Domain deletion stays UI-only as a safety measure.
DNS helpers and postmaster-style support
Optional built-in DNS ships mail records preconfigured; Migadu also offers DNS setup help at no extra fee and publishes diagnostics/activation flows. Support is ticket-based from people who operate the mail stack—not outsourced chat—with plan-dependent urgency outside office hours.
No ads, no product analytics cookies
Vendor policy states no advertising, no tracking of mailbox content for ads, and no website analytics cookies beyond session needs. Processing is framed for service delivery, abuse prevention, and legal obligations. Payment data still goes to Stripe and PayPal under separate processor terms.
| Assurance & compliance | Migadu | |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party audit PDF or no-logs attestation located on security/help pages. | Not found Vendor claims no ad scanning/sharing of mail content; no public third-party audit PDF located. |
| ISO 27001 | Not found No ISO 27001 certificate or registry entry found on official site. | Not found Data centers described as internationally certified; no Migadu-organization ISO 27001 certificate found on primary pages. |
| SOC 2 / SOC 3 | Not found No SOC 2/3 report referenced on official site. | Not found |
| GDPR / EU data protection | Vendor claimed EU (Latvia) controller SIA INBOKSS; vendor states 100% GDPR compliance and Latvia hosting. Confirm DPA and subprocessors for your workload. | Vendor claimed Privacy policy asserts GDPR and Swiss DPA compliance; mail hosted in France per vendor. |
| US CLOUD Act exposure (indicative) | Partial EU entity / no known US parent; mail claimed on own Latvia servers. Residual medium exposure via US-group web SaaS in privacy policy (Google Analytics, Meta Pixel, hCaptcha, InMobi). Not legal advice. | Partial Swiss entity, no known US parent, mail in France; Stripe and PayPal process payments with US transfers. Infrastructure subprocessors not fully named. EuropeanStack assessment—not a vendor certification. Not legal advice. |
| Data processing agreement (B2B) | Not found TOS mentions controller/processor roles under GDPR, but no standalone public DPA download found—request in writing. | Vendor claimed Privacy page states it serves as privacy policy and DPA; confirm suitability with counsel. |
| EU AI Act | Not applicable Conventional email hosting; not an AI-system product. | Not applicable Email hosting product; not an AI system offering. |
| Considerations & known limitations | Migadu | |
|---|---|---|
| No public ISO/SOC or independent audit | Medium Enterprise RFPs that require cert packs will stall until the vendor supplies private assurance materials. | Not listed |
| Not zero-knowledge E2E mail | Medium Operator-controlled storage with TLS in transit; legal-process access is acknowledged. Do not shortlist as a Proton/Tuta crypto peer. | Not listed |
| US-group tools on website privacy path | Medium Google Analytics, Meta Pixel, hCaptcha, and InMobi appear in the privacy policy even while mail is marketed as Latvia-only—align transfer assessments and cookies consent with this split. | Not listed |
| Public DPA / subprocessor list gap | Medium Processor language exists in TOS, but buyers still need a signed DPA and current subprocessors for regulated personal data. | Not listed |
| Operator also runs ad-supported portals | Low Inbokss group products include advertising-supported regional portals; verify contractually that paid Inbox.eu mailboxes stay ad-free and outside portal ad profiling. | Not listed |
| US payment subprocessors (Stripe, PayPal) | Not listed | Medium Billing-related personal data can transfer to US processors under Migadu’s privacy policy. Mail content path is France/EU per vendor, but payment data is a separate CLOUD Act / transfer surface. |
| Incomplete public infrastructure subprocessor list | Not listed | Medium Primary pages name France hosting and certified DCs without a full vendor inventory for compute, storage, and backups. Procurement should request the current list and regions in writing. |
| No E2EE product default; no classic mailbox 2FA | Not listed | Medium Standards mail with TLS; vendor recommends user-side OpenPGP for strong content secrecy. IMAP 2FA is not offered; app-specific-style identities are not second-factor MFA. |
| Daily quotas and human-mail policy | Not listed | Medium Account-wide daily in/out caps and anti-bulk rules make Migadu unsuitable as a transactional/marketing ESP. Over-limit mail can be deferred or rejected after tolerance. |
| No default SLA on standard plans | Not listed | Low Vendor states standard offers lack SLAs; email is treated as asynchronous and occasionally disrupted. Enterprise SLA only via separate commercial discussion. |
| No public independent security audit | Not listed | Medium Privacy and no-ad-scanning claims are first-party. No independent audit report found for no-logs or security controls. |
When: You need open or heavily audited zero-knowledge end-to-end encrypted mail
Consider: Proton Mail or Tuta
Different crypto posture than TLS-hosted conventional mail
When: You prefer German jurisdiction and a long-standing privacy-host reputation
Consider: Posteo or mailbox.org
Often leaner storage; strong EU privacy positioning
When: You already depend on Docs/Drive/Meet or full Microsoft 365 collaboration
Consider: Google Workspace or Microsoft 365
Inbox.eu is not a suite replacement
When: You want Belgian dual-key / open-source-oriented secure mail
Consider: Mailfence
Different feature and crypto tradeoffs
When: You need provider-managed end-to-end encryption as the default product promise
Consider: Proton Mail or Tuta
Migadu is standards hosting with TLS; content secrecy against the operator is not the design center.
When: You want another European professional host with a different admin/encryption/residency package
Consider: mailbox.org, Mailfence, Posteo, or Runbox
Compare DPA detail, audit packaging, and whether multi-domain usage pricing still wins for your address sprawl.
When: You need full workspace suite (docs, meet, identity) rather than email hosting alone
Consider: Google Workspace, Microsoft 365, or Infomaniak-style European suites
Migadu deliberately stays postmaster-focused.
When: You need bulk or high-rate application email
Consider: A dedicated ESP (not Migadu); Amazon SES is the common Big Tech baseline—pair with EU ESPs if residency matters
Migadu rate-limits and bans intentional bulk use.