Compare Infomaniak kMail and Mailfence on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Outlook.com
Switzerland· Email Services
Needs review
Shortlist when you need Swiss-hosted professional email with custom domains, IMAP/CalDAV, suite bundling (kSuite), and operator-owned DCs. Skip when zero-access client-side E2EE or full self-host is mandatory—consider Proton Mail (E2EE) or a self-hosted stack instead.
Belgium· Email Services
Needs review
Shortlist Mailfence when you want Belgian-operated webmail with interoperable OpenPGP, digital signatures, and a light calendar/documents suite—plus optional business private-label or on-prem license. Skip when you need automatic closed E2EE without key management (consider Tuta), a large Swiss privacy ecosystem (Proton Mail), or a minimalist German mailbox (Posteo / mailbox.org).
Highlighted rows differ between the two products.
| Feature | Infomaniak kMail | Mailfence |
|---|---|---|
| Country of origin | Switzerland | Belgium |
| Category | Email Services | Email Services |
| Open source | Yes | No |
| Self-hosted | No | No |
| Headquarters | Switzerland | Belgium |
| Legal entity | Infomaniak Network SA (Rue Eugène Marziano 25, 1227 Les Acacias, Geneva; CH-660.0.059.996-1; IDE CHE-103.167.648) | ContactOffice Group sa, Avenue Franklin Roosevelt 47b, B-1050 Brussels (BE 0466.241.584) |
| Governing law | Not listed | Belgian law; Brussels courts (Terms of Use) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Low |
| Hosting / residency | Primary mail hosting on Infomaniak-operated Swiss data centres (Geneva/Zurich region; Swiss Hosting label claimed); dual-DC backups in Switzerland. Confidentiality policy names payment partners (e.g. PayPal, Checkout) and other ancillary third parties for account/billing/measurement—not AWS/GCP/Azure as primary mail hosts in public materials. | Primary production servers described as located in Belgium under Mailfence operational control (no intermediary managing servers per security page). No public AWS/GCP/Azure subprocessor list found. Backups stored in locations separate from offices/main DC (providers not named). Payment-card processing path not fully published. |
| Summary | Swiss-hosted professional email, contacts and calendars from Infomaniak Network SA—custom domains, open protocols, optional encryption, part of kSuite. | Belgian secure email suite with browser-side OpenPGP encryption, digital signatures, calendar, documents, and optional custom domains under ContactOffice Group SA. |
| Tags |
| At a glance | Infomaniak kMail | Mailfence |
|---|---|---|
| HQ | Geneva, Switzerland (Les Acacias) | Not listed |
| Legal entity | Infomaniak Network SA | Not listed |
| Hosting | Own Swiss data centres; dual-site mailbox backups | Vendor-operated servers in Belgium (per security page) |
| Open source | Mobile clients GPL-3.0; backend SaaS | No (front-end OSS planned; not current) |
| Self-host | No (hosted only) | SaaS default; Business license for large on-prem deployments |
| Commercial model | Free my kSuite tier; paid kSuite / Mail Service seats | Free tier + prepaid paid plans; Business packaging (see vendor site) |
| HQ / entity | Not listed | Brussels — ContactOffice Group sa (BE 0466.241.584) |
| Product launch | Not listed | Mailfence brand ~2013; ContactOffice lineage since 1999 |
| Crypto | Not listed | OpenPGP E2EE + digital signatures; optional password-encrypted messages |
| Independent audit | Not listed | No public audit PDF found |
| Key capabilities | Infomaniak kMail | Mailfence |
|---|---|---|
| Swiss-hosted mail | Yes | Not listed |
| Custom domains | Yes | Not listed |
| IMAP / CalDAV | Yes | Not listed |
| OSS mobile clients | Yes | Not listed |
| ISO 27001 (claimed) | Yes | Not listed |
| Optional send encryption | Yes | Not listed |
| EU-operated (Belgium) | Not listed | Yes |
| OpenPGP E2EE | Not listed | Yes |
| Digital signatures | Not listed | Yes |
| Mail + calendar + docs | Not listed | Yes |
| Custom domains (paid) | Not listed | Yes |
| B2B DPA available | Not listed | Yes |
Custom-domain mail with IMAP, CalDAV and CardDAV
Host name@your-domain addresses with standard IMAP/SMTP plus CalDAV/CardDAV so Thunderbird, Apple Mail, Outlook and other clients stay usable. Paid kSuite/Mail Service tiers add multi-mailbox management, aliases/categories, signatures and team admin; free my kSuite is limited to one address without aliases.
One-click send-time encryption (OpenPGP / ECC / AES)
Optional encryption at send uses OpenPGP, ECC and AES-256-GCM; Infomaniak-to-Infomaniak is automatic after auth, while external recipients often open a password-protected secure page. Private keys stay on Infomaniak infrastructure—useful for sensitive sends, but not zero-access client-side E2EE with user-held keys.
Open-source Infomaniak Mail mobile clients
Official iOS and Android mail apps are published on GitHub under GPL-3.0 for local inspection and contribution. The hosted mail backend remains Infomaniak SaaS only—there is no supported self-hosted server stack for kMail.
Swiss dual-DC backups, SPF/DKIM/DMARC and antivirus
Mailboxes are backed up across Swiss data centres with vendor-stated restore windows around 30 days; anti-spam/antivirus plus domain authentication (SPF, DKIM, DMARC) are standard. Availability claims (e.g. high uptime for essential services) should be checked against the current SLA for your plan.
Sovereign AI assist (Euria) inside the mailbox
In-product AI can help draft, correct, translate and process mail context; Infomaniak states messages sent to its AI are processed in Switzerland and not stored for other purposes. Treat AI features as operator-side processing of content you choose to submit—not as end-to-end private AI.
Browser-side OpenPGP end-to-end encryption
Encrypt outbound mail in the browser with the OpenPGP standard so intermediaries—including Mailfence when messages are properly E2EE—cannot read ciphertext. Fully interoperable with other OpenPGP tools (e.g. Thunderbird/GnuPG). Optional password-encrypted messages cover recipients who do not use PGP. Unencrypted mail still sits on servers in the normal webmail model.
Digital signatures and multi-key OpenPGP keystore
Sign messages for authenticity and integrity, and manage keys in-product: generate, import, export, publish, and hold multiple key pairs without browser plug-ins. Default generated keys are 4096-bit per the threat-model page. Passphrase protection of private keys limits crypto operations if only the account password is compromised.
Mail, calendar, documents, and groups in one account
Beyond inbox: shareable calendars, online document storage/editing, and contact groups for collaboration without bolting on a separate US suite. Storage and alias limits scale by plan; free accounts remain suitable only for light personal use.
Custom domains, aliases, and mail protocols on paid tiers
Higher plans add custom domains with SPF/DKIM/DMARC-oriented setup, larger alias counts, and classic client access (POP, IMAP, SMTP) plus ActiveSync where listed. Entry-level free accounts focus on web/PWA/apps rather than full protocol parity—verify the live plan matrix before procurement.
Business admin: API, SSO, private label, optional on-prem license
Mailfence for Business offers control-panel and XML-RPC API user provisioning, SSO and directory hooks (LDAP/AD/CAS), branding, and Belgian cloud hosting with SLA language—or a license to run on customer Linux servers for large deployments. Fit for orgs that need Belgian hosting with admin automation, not a consumer-only mailbox.
| Assurance & compliance | Infomaniak kMail | Mailfence |
|---|---|---|
| Independent security / no-logs audit | Not found Bug bounty and ISO ISMS claimed; no public independent no-logs audit of mailbox content found. Encryption is optional and keys remain with Infomaniak. | Not found No public third-party audit PDF found. Vendor mentions security specialists, bug bounty activity, and inspection openness—not a substitute for a published audit. Privacy policy documents operational metadata collection (not zero-logs). |
| ISO 27001 | Vendor claimed Vendor publishes ISO 27001:2022 certificate (certified since 2018 per certifications page); downloadable PDF and SoA references. | Not found No Mailfence ISO 27001 certificate claim found on primary security/GDPR/company pages. |
| SOC 2 / SOC 3 | Not found Not listed among published certifications (ISO 27001/9001/14001/50001, B Corp, Swiss labels). | Not found |
| GDPR / EU data protection | Vendor claimed Swiss entity; GDPR and Swiss FADP commitments on legal pages; DPO listed; Swiss hosting of service data claimed. | Vendor claimed Belgian controller/processor materials; dedicated GDPR page and technical/organisational measures overview. Confirm roles in your DPA. |
| US CLOUD Act exposure (indicative) | Partial Swiss Infomaniak Network SA, no known US parent, own Swiss DCs for mail—not a claimed clean bill. Account payments via partners such as PayPal/Checkout (US-group) per confidentiality policy. Indicative only; not legal advice. | Partial EU entity (ContactOffice Group sa), no known US parent; servers claimed self-operated in Belgium without named US hyperscaler hosts. No formal public subprocessor inventory; payment processors not named. Assessment residual: partial transparency on data path. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Downloadable DPA linked from trust centre (Data_Processing_Agreement (DPA).pdf). | Vendor claimed Downloadable DPA linked from the GDPR page for organisational customers. |
| EU AI Act | Not applicable Euria AI assist exists inside mail; product is primarily email/hosting, not an AI-system vendor offering. | Not applicable Email/collaboration suite; not an AI system under typical procurement framing. |
| Considerations & known limitations | Infomaniak kMail | Mailfence |
|---|---|---|
| Encryption is not zero-access by default | Medium Optional send encryption keeps private keys on Infomaniak infrastructure. Operators with warrant or insider access to the platform may still access unencrypted stored mail. Practical impact: do not treat kMail as a zero-knowledge vault for all messages. | Not listed |
| SaaS-only mail backend | Low No official self-host for the mail service; exit means IMAP export/migration. OSS clients do not equal portable server stack. | Not listed |
| Free tier residency and feature caps | Low my kSuite requires OECD residency and phone verification; no aliases, limited storage, enforced free signature. Unsuitable as free global professional mail. | Not listed |
| Limited public mail-path subprocessor table | Low Hosting is own Swiss DCs per vendor docs; confidentiality policy lists payment and marketing-class third parties. Procurement should request a current subprocessor list for mailbox content paths. | Not listed |
| No HDS health-hosting cert | Medium Vendor FAQ states French HDS certification is not planned—material for French health-sector workloads. | Not listed |
| No public independent security audit | Not listed | Medium If vendor risk requires a published audit letter, ISO 27001, or SOC 2, treat Mailfence as incomplete until evidence is obtained offline or under NDA. |
| Closed-source SaaS | Not listed | Medium Cannot independently review server code or default-self-host like some FOSS mail stacks. Business on-prem license is a commercial path, not community self-host docs. |
| E2EE is opt-in OpenPGP, not automatic | Not listed | Medium Clear-text messages are operator-readable at rest. Users must encrypt/sign deliberately; training and policy matter for regulated content. |
| Operational metadata retention | Not listed | Low Privacy policy lists IP, message-IDs, addresses, subjects, and related fields for operations, abuse control, and legal process—not a zero-logs design. |
| Limited public subprocessor inventory | Not listed | Low Strong first-party claims of internal hosting, but no AWS-style public subprocessor table; confirm payment and support tooling in procurement. |
| US CLOUD Act (indicative) | Not listed | Low No known US parent; Belgian self-operated hosting narrative. Residual unknown payment/SaaS paths. Not a legal safe harbour guarantee. |
When: You need zero-access end-to-end encryption as the default mail model
Consider: Proton Mail
Different trust model: client-side E2EE vs Infomaniak operator-held keys for optional encryption
When: You want European hosted mail with a different encryption or non-profit posture
Consider: Mailfence or Posteo
Compare encryption UX, storage model, and commercial terms on each vendor site
When: You need full control of the MTA and storage stack
Consider: Self-hosted mail (e.g. mailcow/Stalwart) or a host that publishes server software
Infomaniak mobile apps are OSS; the hosted service is not self-hostable
When: You want automatic encryption for all messages with minimal key management
Consider: Tuta
Different crypto model; less OpenPGP interop emphasis than Mailfence.
When: You want a larger Swiss privacy suite brand and ecosystem apps
Consider: Proton Mail
Trade Belgian ContactOffice ownership and PGP-centric UX for Proton’s broader product family.
When: You want a lean German ad-free mailbox without suite features
Consider: Posteo or mailbox.org
Simpler mailbox posture; different admin/domain/crypto tradeoffs.
When: You need full Google/Microsoft productivity and compliance tooling
Consider: Microsoft 365 or Google Workspace (accept US-cloud risk) or EU office suites if residency is the driver
Mailfence is not a drop-in M365 replacement.