Compare Inbox.eu and web.de on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail
Latvia· Email Services
Needs review
Shortlist Inbox.eu when you need Latvia-hosted, ad-free SME email with large included storage, custom domains, IMAP clients, and business SSO under an EU operator. Skip when you require zero-knowledge E2E crypto or published ISO/SOC audits—consider Proton Mail, Tuta, Posteo, or mailbox.org instead.
Germany· Email Services
Needs review
Shortlist web.de when you need mass-market German freemail with DE-sited mail/cloud, E-Mail made in Germany TLS alliance markers, optional PGP/2FA, and a familiar DACH portal. Skip when you need default E2EE, no advertising data path, self-host, or enterprise admin—consider Posteo, mailbox.org, Tuta, or Proton Mail instead.
Highlighted rows differ between the two products.
| Feature | ||
|---|---|---|
| Country of origin | Latvia | Germany |
| Category | Email Services | Email Services |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Latvia | Germany |
| Legal entity | SIA INBOKSS (Inbokss Ltd), reg. no. 40003560720, Matrozu street 15-2, Riga, LV-1048 | 1&1 Mail & Media GmbH (United Internet AG group) |
| Governing law | Republic of Latvia / EU GDPR | Germany / EU GDPR |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Low |
| Hosting / residency | Mailbox/file data: vendor claims own servers in Latvia (Riga DC, EN 50600-3) with live multi-copy backups and no EU exit. Web property privacy policy lists Google Analytics, Meta Pixel, Gemius, AdBox, InMobi CMP, and hCaptcha—US/global SaaS for analytics, ads, consent, and bot defence. No public full mail-path subprocessor register found. | Vendor claims email and Online-Speicher stored exclusively in Germany in company-owned data centers (E-Mail/Cloud made in Germany). FreeMail monetized via advertising and IAB TCF consent partners; privacy notice allows EEA third-country transfers with Chapter V safeguards. Portal/optional features use additional processors (e.g. search partners, embeds, homepage builder DUDA Inc., ID vendors). No exhaustive public mail-stack subprocessor list found. |
| Summary | Latvia-based hosted email from SIA INBOKSS with ad-free personal and business mailboxes, custom domains, large integrated file storage, calendar/contacts, and mobile apps. | German freemail and portal from United Internet’s 1&1 Mail & Media GmbH: FreeMail with DE-sited mail and cloud, E-Mail made in Germany TLS alliance, optional PGP—consumer SaaS, not default-E2EE privacy mail. |
| Tags |
| At a glance | ||
|---|---|---|
| HQ | Riga, Latvia (EU) | Not listed |
| Legal entity | SIA INBOKSS (reg. 40003560720) | Not listed |
| Product since | Inbokss 1998; Inbox.eu brand from 2011 | Not listed |
| Hosting | Vendor-claimed own servers in Latvia; multi-server backups | Not listed |
| Open source | No | No |
| Self-host | No | No |
| Commercial model | Prepaid personal/business premium; time-limited trial | Ad-supported FreeMail; paid mailbox/cloud upgrades; Consent or Pay |
| HQ / operator | Not listed | 1&1 Mail & Media GmbH, Montabaur/Karlsruhe, Germany |
| Parent group | Not listed | United Internet AG (Germany) |
| Product type | Not listed | Consumer freemail + portal + cloud (SaaS) |
| Hosting (vendor claim) | Not listed | Company-owned data centers in Germany |
| Key capabilities | ||
|---|---|---|
| EU-operated (Latvia) | Yes | Yes |
| 100 GB mail + files | Yes | Not listed |
| Custom domains | Yes | Not listed |
| IMAP / SMTP | Yes | Not listed |
| SAML / LDAP SSO | Yes | Not listed |
| TLS, not ZK E2E | Yes | Not listed |
| E-Mail made in Germany | Not listed | Yes |
| Germany data centers (claimed) | Not listed | Yes |
| Optional PGP | Not listed | Yes |
| FreeMail + paid upgrades | Not listed | Yes |
| SaaS only | Not listed | Yes |
100 GB mailbox plus integrated Files storage
Premium accounts include a large combined email-and-files quota (business adds domain-level shared storage). Files supports multi-gigabyte uploads, share links, parallel downloads, and WebDAV mounting on desktop—useful for SMEs that want drive-like sharing without a separate vendor.
Custom domains with business admin panel
Business email lets you host unlimited domain mailboxes after DNS/MX validation, with admin controls for users, aliases, catch-all, and domain settings. A public demo of the admin experience is available for evaluation before signup.
Standard protocols plus mobile apps
Full IMAP, POP3, and SMTP (with TLS) for Thunderbird, Outlook, and other clients; calendar and contacts sync; official apps on iOS and Android. Fits teams that refuse webmail lock-in.
TLS, 2FA, spam filtering, and business SSO
Transport encryption with TLS 1.2+, optional two-factor authentication, multi-filter spam/malware scanning, and Business SSO via SAML 2.0 or LDAP (including common IdPs such as Azure AD and Google Workspace). This is hosted-email security, not zero-knowledge E2E.
Migration support and human multilingual help
Documented IMAP/CSV migration paths from Gmail and other providers, plus real-person support in English and Baltic languages rather than chatbot-only queues—material for SMEs without a dedicated mail ops team.
E-Mail made in Germany alliance transport
Founding member of the German provider alliance (WEB.DE, GMX, 1&1, STRATO, T-Online, freenet). TLS on paths inside the alliance, mail stored in Germany, and green checkmarks on alliance addresses in the compose UI. Does not encrypt content to non-alliance or non-PGP recipients end-to-end by default.
FreeMail + paid upgrades with intelligent inbox
Ad-supported FreeMail with integrated calendar, contacts, and Online-Speicher. Intelligent inbox categorizes newsletters, orders, social, and contracts/subscriptions without duplicating messages; optional package tracking via DHL, DPD, and GLS when consented. Paid tiers expand quotas and reduce ad/tracking friction under Consent or Pay.
Optional PGP and free 2FA
Optional PGP end-to-end encryption for sensitive mail (both parties need keys/compatible clients). Optional free two-factor authentication for account login. Baseline mailbox protection relies on account credentials, spam/virus filters, and TLS—not default E2EE for every message.
Cloud made in Germany Online-Speicher
Mailbox-integrated cloud with browser, app, and desktop access; link sharing and Online Office for documents. Vendor claims exclusive German data-center storage and TLS in transit under Cloud made in Germany. Free tier includes a starter cloud quota; larger capacities are paid add-ons. Not a full Google Drive/OneDrive collab suite.
German consumer portal on the same identity
News, services, WEB.Cent cashback, and optional Deutsche Post letter preview sit beside mail. Useful for personal DACH users; increases advertising and partner surface versus a pure mailbox product. Portal embeds and partners are consent-gated where required.
| Assurance & compliance | ||
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party audit PDF or no-logs attestation located on security/help pages. | Not found No public independent no-logs or full security audit package found for FreeMail; alliance pages claim oversight by data-protection function and independent Prüfstellen at a high level only. |
| ISO 27001 | Not found No ISO 27001 certificate or registry entry found on official site. | Not found No public ISO 27001 certificate page located for the web.de freemail product during research. |
| SOC 2 / SOC 3 | Not found No SOC 2/3 report referenced on official site. | Not found No public SOC 2/3 report found for web.de FreeMail. |
| GDPR / EU data protection | Vendor claimed EU (Latvia) controller SIA INBOKSS; vendor states 100% GDPR compliance and Latvia hosting. Confirm DPA and subprocessors for your workload. | Vendor claimed German controller (1&1 Mail & Media GmbH); detailed GDPR privacy notice; DE storage claims for mail/cloud. Not a legal certification. |
| US CLOUD Act exposure (indicative) | Partial EU entity / no known US parent; mail claimed on own Latvia servers. Residual medium exposure via US-group web SaaS in privacy policy (Google Analytics, Meta Pixel, hCaptcha, InMobi). Not legal advice. | Partial EU/German entity and parent; no known US parent; mail/cloud claimed on company-owned DE data centers. Partial because privacy notice allows third-country transfers with safeguards, FreeMail uses ad/TCF partners, and no exhaustive public subprocessor inventory. Not legal advice. |
| Data processing agreement (B2B) | Not found TOS mentions controller/processor roles under GDPR, but no standalone public DPA download found—request in writing. | Not found Consumer freemail focus; no clear self-serve public B2B DPA for FreeMail found. Request under contract if treating as processor for an organization. |
| EU AI Act | Not applicable Conventional email hosting; not an AI-system product. | Not applicable Consumer mail/portal with limited in-product assistants; not an AI-centric product for this checklist. |
| Considerations & known limitations | ||
|---|---|---|
| No public ISO/SOC or independent audit | Medium Enterprise RFPs that require cert packs will stall until the vendor supplies private assurance materials. | Not listed |
| Not zero-knowledge E2E mail | Medium Operator-controlled storage with TLS in transit; legal-process access is acknowledged. Do not shortlist as a Proton/Tuta crypto peer. | Not listed |
| US-group tools on website privacy path | Medium Google Analytics, Meta Pixel, hCaptcha, and InMobi appear in the privacy policy even while mail is marketed as Latvia-only—align transfer assessments and cookies consent with this split. | Not listed |
| Public DPA / subprocessor list gap | Medium Processor language exists in TOS, but buyers still need a signed DPA and current subprocessors for regulated personal data. | Not listed |
| Operator also runs ad-supported portals | Low Inbokss group products include advertising-supported regional portals; verify contractually that paid Inbox.eu mailboxes stay ad-free and outside portal ad profiling. | Not listed |
| Ad-financed FreeMail and consent surface | Not listed | Medium FreeMail uses advertising and Consent or Pay. With consent, content may feed interest profiles; FreeMail users cannot drop WEB.DE informiert like paid tiers. Unsuitable where ad-tech processors are banned. |
| No default end-to-end encryption | Not listed | Medium TLS and alliance transport protection are not content E2EE. Optional PGP only covers willing counterparties. Operator can process plaintext for spam, intelligent inbox, and consented ad analysis. |
| Limited public audit/cert artifacts | Not listed | Medium ISO 27001, SOC 2, and independent no-logs audits not found on public product pages. Trust rests on German entity, DE hosting claims, and first-party security copy. |
| Third-country transfers and portal partners | Not listed | Low Privacy notice contemplates non-EEA recipients under Chapter V safeguards. Portal/search/ID/ad features introduce extra processors beyond the mailbox DC story—review consent layer and purpose before sensitive use. |
| FreeMail inactivity content deletion | Not listed | Low Privacy notice: FreeMail email content may be deleted after more than 180 days without login. Not a durable archive without activity or export. |
When: You need open or heavily audited zero-knowledge end-to-end encrypted mail
Consider: Proton Mail or Tuta
Different crypto posture than TLS-hosted conventional mail
When: You prefer German jurisdiction and a long-standing privacy-host reputation
Consider: Posteo or mailbox.org
Often leaner storage; strong EU privacy positioning
When: You already depend on Docs/Drive/Meet or full Microsoft 365 collaboration
Consider: Google Workspace or Microsoft 365
Inbox.eu is not a suite replacement
When: You want Belgian dual-key / open-source-oriented secure mail
Consider: Mailfence
Different feature and crypto tradeoffs
When: You need default E2EE and a privacy-first paid mailbox
Consider: Tuta or Proton Mail
web.de PGP is optional and counterpart-dependent; FreeMail is ad-financed.
When: You want ad-free German/EU mail with strong consumer privacy posture and paid model only
Consider: Posteo or mailbox.org
Less portal monetization; clearer privacy-first product framing than mass freemail.
When: You prefer the same United Internet Mail & Media stack under another brand
Consider: GMX Mail
Nearly aligned trust and capability story; brand and portal mix differ.
When: You need Google/Microsoft-class workspace collab and enterprise compliance packs
Consider: Gmail (Google Workspace) or Outlook.com / Microsoft 365
Trade DE freemail residency story for US-group platforms and deeper admin tooling.