Compare Inbox.eu and Runbox on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail
Latvia· Email Services
Needs review
Shortlist Inbox.eu when you need Latvia-hosted, ad-free SME email with large included storage, custom domains, IMAP clients, and business SSO under an EU operator. Skip when you require zero-knowledge E2E crypto or published ISO/SOC audits—consider Proton Mail, Tuta, Posteo, or mailbox.org instead.
Norway· Email Services
Needs review
Shortlist Runbox when you need Norwegian/EEA-hosted IMAP email with custom domains, ad-free subscription economics, and standard clients. Skip when you require default zero-access E2EE—consider Proton Mail or Tuta instead—or when you need a full Microsoft 365-style suite.
Highlighted rows differ between the two products.
| Feature | Runbox | |
|---|---|---|
| Country of origin | Latvia | Norway |
| Category | Email Services | Email Services |
| Open source | No | Yes |
| Self-hosted | No | No |
| Headquarters | Latvia | Norway |
| Legal entity | SIA INBOKSS (Inbokss Ltd), reg. no. 40003560720, Matrozu street 15-2, Riga, LV-1048 | Runbox Solutions AS |
| Governing law | Republic of Latvia / EU GDPR | Norwegian law; Personal Data Act implementing GDPR (EEA) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Mailbox/file data: vendor claims own servers in Latvia (Riga DC, EN 50600-3) with live multi-copy backups and no EU exit. Web property privacy policy lists Google Analytics, Meta Pixel, Gemius, AdBox, InMobi CMP, and hCaptcha—US/global SaaS for analytics, ads, consent, and bot defence. No public full mail-path subprocessor register found. | Core email and account content: servers in Oslo (StackInfra) under Norwegian jurisdiction; systems management Copyleft Solutions AS (Norway). Optional third parties per privacy policy: Stripe, PayPal, Coinbase (US payments); Enom (US domains); Gandi (FR); Domeneshop (NO); JaguarPC (US default web hosting, Norway option); NodePing (US, status page). No known US parent. |
| Summary | Latvia-based hosted email from SIA INBOKSS with ad-free personal and business mailboxes, custom domains, large integrated file storage, calendar/contacts, and mobile apps. | Norwegian subscription email hosting from Runbox Solutions AS: Oslo-hosted IMAP mailboxes, custom domains, CalDAV/CardDAV, and optional PGP. Ad-free; not default zero-access. |
| Tags |
| At a glance | Runbox | |
|---|---|---|
| HQ | Riga, Latvia (EU) | Oslo, Norway |
| Legal entity | SIA INBOKSS (reg. 40003560720) | Runbox Solutions AS (orgnr 996877027) |
| Product since | Inbokss 1998; Inbox.eu brand from 2011 | Not listed |
| Hosting | Vendor-claimed own servers in Latvia; multi-server backups | Email: StackInfra Oslo; optional web hosting may default US |
| Open source | No | Partial (Runbox 7 web app); not self-hosted |
| Self-host | No | Not listed |
| Commercial model | Prepaid personal/business premium; time-limited trial | Paid subscription + trial (no permanent free tier) |
| Founded | Not listed | Service since 2000; current AS form 2011 |
| Key capabilities | Runbox | |
|---|---|---|
| EU-operated (Latvia) | Yes | Not listed |
| 100 GB mail + files | Yes | Not listed |
| Custom domains | Yes | Yes |
| IMAP / SMTP | Yes | Not listed |
| SAML / LDAP SSO | Yes | Not listed |
| TLS, not ZK E2E | Yes | Not listed |
| Norwegian email hosting | Not listed | Yes |
| IMAP / POP / SMTP | Not listed | Yes |
| 100% renewable (claimed) | Not listed | Yes |
| Runbox 7 open source | Not listed | Yes |
| Optional PGP / S/MIME | Not listed | Yes |
100 GB mailbox plus integrated Files storage
Premium accounts include a large combined email-and-files quota (business adds domain-level shared storage). Files supports multi-gigabyte uploads, share links, parallel downloads, and WebDAV mounting on desktop—useful for SMEs that want drive-like sharing without a separate vendor.
Custom domains with business admin panel
Business email lets you host unlimited domain mailboxes after DNS/MX validation, with admin controls for users, aliases, catch-all, and domain settings. A public demo of the admin experience is available for evaluation before signup.
Standard protocols plus mobile apps
Full IMAP, POP3, and SMTP (with TLS) for Thunderbird, Outlook, and other clients; calendar and contacts sync; official apps on iOS and Android. Fits teams that refuse webmail lock-in.
TLS, 2FA, spam filtering, and business SSO
Transport encryption with TLS 1.2+, optional two-factor authentication, multi-filter spam/malware scanning, and Business SSO via SAML 2.0 or LDAP (including common IdPs such as Azure AD and Google Workspace). This is hosted-email security, not zero-knowledge E2E.
Migration support and human multilingual help
Documented IMAP/CSV migration paths from Gmail and other providers, plus real-person support in English and Baltic languages rather than chatbot-only queues—material for SMEs without a dedicated mail ops team.
Norwegian-hosted IMAP email with full-disk encryption
Mailboxes live on servers Runbox places in a StackInfra facility in Oslo under Norwegian jurisdiction, with full-disk encryption at rest and TLS (including PFS) in transit. Access via IMAP, POP, SMTP, or Runbox 7 webmail suits teams that need standard clients rather than a proprietary-only app.
Custom domains, aliases, and multi-account admin
Host mail on your own domain, manage sub-accounts from a main account, and use many aliases on Runbox domains plus unlimited aliases on customer domains. Plus-addressing and filters help separate identities without running separate mailboxes.
CalDAV/CardDAV plus optional PGP or S/MIME
Integrated calendar and contacts sync over CalDAV and CardDAV with common desktop and mobile apps. End-to-end confidentiality is user-controlled via PGP or S/MIME—not zero-access by default—so operators can still index mail for search and scan for malware.
Ad-free, subscription-funded privacy model
Runbox states it does not show ads, does not use third-party trackers such as Google Analytics, and only scans messages for spam/virus protection—not advertising. Revenue is subscription-based with a public trial period, aligning incentives away from data-mining free mail.
Runbox 7 open-source webmail on hydropowered infra
The Runbox 7 web client is published on GitHub for inspection; the hosted server stack remains largely proprietary. Email infrastructure is advertised as 100% certified renewable electricity in Norway, with additional company offset claims—useful for sustainability procurement checklists.
| Assurance & compliance | Runbox | |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party audit PDF or no-logs attestation located on security/help pages. | Not found Vendor claims minimal logging and short retention windows; no public independent audit report found |
| ISO 27001 | Not found No ISO 27001 certificate or registry entry found on official site. | Not found No Runbox ISO 27001 certificate found on primary pages (power supplier ISO 14001 is environmental, not info-sec) |
| SOC 2 / SOC 3 | Not found No SOC 2/3 report referenced on official site. | Not found No public SOC 2/3 report located |
| GDPR / EU data protection | Vendor claimed EU (Latvia) controller SIA INBOKSS; vendor states 100% GDPR compliance and Latvia hosting. Confirm DPA and subprocessors for your workload. | Vendor claimed Norwegian entity; Personal Data Act implements GDPR; appointed DPO; privacy policy documents rights and retention |
| US CLOUD Act exposure (indicative) | Partial EU entity / no known US parent; mail claimed on own Latvia servers. Residual medium exposure via US-group web SaaS in privacy policy (Google Analytics, Meta Pixel, hCaptcha, InMobi). Not legal advice. | Partial No known US parent; core email in Norway. Medium/partial because privacy policy lists US third parties (Stripe, PayPal, Coinbase, Enom, JaguarPC web hosting default, NodePing). Not legal advice. |
| Data processing agreement (B2B) | Not found TOS mentions controller/processor roles under GDPR, but no standalone public DPA download found—request in writing. | Not found Processor DPA with Copyleft is mentioned; no public customer-facing B2B DPA template found—ask sales/support |
| EU AI Act | Not applicable Conventional email hosting; not an AI-system product. | Not applicable Email hosting product; vendor states no intrusive AI for ad profiling |
| Considerations & known limitations | Runbox | |
|---|---|---|
| No public ISO/SOC or independent audit | Medium Enterprise RFPs that require cert packs will stall until the vendor supplies private assurance materials. | Not listed |
| Not zero-knowledge E2E mail | Medium Operator-controlled storage with TLS in transit; legal-process access is acknowledged. Do not shortlist as a Proton/Tuta crypto peer. | Not listed |
| US-group tools on website privacy path | Medium Google Analytics, Meta Pixel, hCaptcha, and InMobi appear in the privacy policy even while mail is marketed as Latvia-only—align transfer assessments and cookies consent with this split. | Not listed |
| Public DPA / subprocessor list gap | Medium Processor language exists in TOS, but buyers still need a signed DPA and current subprocessors for regulated personal data. | Not listed |
| Operator also runs ad-supported portals | Low Inbokss group products include advertising-supported regional portals; verify contractually that paid Inbox.eu mailboxes stay ad-free and outside portal ad profiling. | Not listed |
| Not default zero-access encryption | Not listed | Medium Unlike Proton/Tuta, Runbox can access stored mail for spam/virus scanning, indexing, and lawful process. Use PGP/S/MIME when E2EE is required. |
| US vendors on optional product paths | Not listed | Medium Payments (Stripe/PayPal/Coinbase), domain registrar Enom, and default JaguarPC web hosting introduce US processors. Keep web hosting in Norway and minimize US payment data if policy requires. |
| No public ISO 27001 / SOC 2 / independent audit | Not listed | Medium Assurance relies on vendor policy, Norwegian law, and facility claims. Regulated buyers may need NDA evidence or on-site questionnaire. |
| Partial open source only | Not listed | Low Runbox 7 webmail is open source; mail backend is proprietary SaaS—no self-host path. |
| Post-closure and backup retention | Not listed | Low Privacy policy defines multi-month content retention and backup windows after closure (and longer account-info retention for bookkeeping). Request immediate deletion if policy requires faster wipe. |
When: You need open or heavily audited zero-knowledge end-to-end encrypted mail
Consider: Proton Mail or Tuta
Different crypto posture than TLS-hosted conventional mail
When: You prefer German jurisdiction and a long-standing privacy-host reputation
Consider: Posteo or mailbox.org
Often leaner storage; strong EU privacy positioning
When: You already depend on Docs/Drive/Meet or full Microsoft 365 collaboration
Consider: Google Workspace or Microsoft 365
Inbox.eu is not a suite replacement
When: You want Belgian dual-key / open-source-oriented secure mail
Consider: Mailfence
Different feature and crypto tradeoffs
When: You need default end-to-end / zero-access encryption for all messages
Consider: Proton Mail or Tuta
Runbox uses optional PGP/S/MIME; operator can access stored mail for filtering and lawful process
When: You want a German privacy-oriented host with similar sustainability positioning
Consider: Posteo
Compare jurisdiction (DE vs NO), domain limits, and feature depth
When: You need Belgian email with integrated collaboration extras
Consider: Mailfence
Different encryption defaults and product scope
When: You need global free-tier convenience and suite lock-in
Consider: Gmail or Outlook.com / Microsoft 365
Accept US jurisdiction and ad/suite economics tradeoffs