Compare Infomaniak kMail and Mailo on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Outlook.com
Switzerland· Email Services
Needs review
Shortlist when you need Swiss-hosted professional email with custom domains, IMAP/CalDAV, suite bundling (kSuite), and operator-owned DCs. Skip when zero-access client-side E2EE or full self-host is mandatory—consider Proton Mail (E2EE) or a self-hosted stack instead.
France· Email Services
Needs review
Shortlist Mailo when you want French-entity freemium webmail with classic IMAP/EAS clients, integrated calendar/cloud, supervised Mailo Junior for kids, or Pro custom domains for SMEs—without US Big Tech accounts. Skip when you need default zero-knowledge E2EE, open-source/self-host, or a full Workspace-class suite; consider Tuta, Proton Mail, or Infomaniak kMail instead.
Highlighted rows differ between the two products.
| Feature | Infomaniak kMail | Mailo |
|---|---|---|
| Country of origin | Switzerland | France |
| Category | Email Services | Email Services |
| Open source | Yes | No |
| Self-hosted | No | No |
| Headquarters | Switzerland | France |
| Legal entity | Infomaniak Network SA (Rue Eugène Marziano 25, 1227 Les Acacias, Geneva; CH-660.0.059.996-1; IDE CHE-103.167.648) | MAILO SAS (capital €75,000; RCS Créteil 851585547; VAT FR44851585547) |
| Governing law | Not listed | French law (terms of use) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Medium |
| Hosting / residency | Primary mail hosting on Infomaniak-operated Swiss data centres (Geneva/Zurich region; Swiss Hosting label claimed); dual-DC backups in Switzerland. Confidentiality policy names payment partners (e.g. PayPal, Checkout) and other ancillary third parties for account/billing/measurement—not AWS/GCP/Azure as primary mail hosts in public materials. | Vendor states user personal data and content are stored/processed on servers in France; specialised French host centre (who-we-are); website hosted by Ecritel, Arradon, France. Named third parties: Verifone/Paybox (payment email), PayPal option, Gandi/Netim (domains), Sirdata + ad agencies (free-tier ads), optional Rainbow video and OnlyOffice. Full mail DC/backup subprocessor list not published. |
| Summary | Swiss-hosted professional email, contacts and calendars from Infomaniak Network SA—custom domains, open protocols, optional encryption, part of kSuite. | French freemium webmail and Mail&Cloud suite (MAILO SAS): email, calendar, cloud disk, Mailo Junior for children, and Pro custom domains—hosted in France, proprietary SaaS. |
| Tags |
| At a glance | Infomaniak kMail | Mailo |
|---|---|---|
| HQ | Geneva, Switzerland (Les Acacias) | Not listed |
| Legal entity | Infomaniak Network SA | Not listed |
| Hosting | Own Swiss data centres; dual-site mailbox backups | Not listed |
| Open source | Mobile clients GPL-3.0; backend SaaS | No (proprietary MailObject®) |
| Self-host | No (hosted only) | No |
| Commercial model | Free my kSuite tier; paid kSuite / Mail Service seats | Not listed |
| HQ / entity | Not listed | MAILO SAS, France (RCS Créteil 851585547) |
| Hosting (claimed) | Not listed | Servers in France; website host Ecritel (FR) |
| Model | Not listed | Freemium SaaS (Free / Premium / Pro / Junior / Edu) |
| Encryption default | Not listed | TLS + optional server-side PGP (not ZK E2EE) |
| Key capabilities | Infomaniak kMail | Mailo |
|---|---|---|
| Swiss-hosted mail | Yes | Not listed |
| Custom domains | Yes | Not listed |
| IMAP / CalDAV | Yes | Not listed |
| OSS mobile clients | Yes | Not listed |
| ISO 27001 (claimed) | Yes | Not listed |
| Optional send encryption | Yes | Not listed |
| France-hosted (claimed) | Not listed | Yes |
| Freemium webmail | Not listed | Yes |
| Mailo Junior | Not listed | Yes |
| IMAP / ActiveSync | Not listed | Yes |
| Pro custom domains | Not listed | Yes |
| Optional PGP (server-side) | Not listed | Yes |
Custom-domain mail with IMAP, CalDAV and CardDAV
Host name@your-domain addresses with standard IMAP/SMTP plus CalDAV/CardDAV so Thunderbird, Apple Mail, Outlook and other clients stay usable. Paid kSuite/Mail Service tiers add multi-mailbox management, aliases/categories, signatures and team admin; free my kSuite is limited to one address without aliases.
One-click send-time encryption (OpenPGP / ECC / AES)
Optional encryption at send uses OpenPGP, ECC and AES-256-GCM; Infomaniak-to-Infomaniak is automatic after auth, while external recipients often open a password-protected secure page. Private keys stay on Infomaniak infrastructure—useful for sensitive sends, but not zero-access client-side E2EE with user-held keys.
Open-source Infomaniak Mail mobile clients
Official iOS and Android mail apps are published on GitHub under GPL-3.0 for local inspection and contribution. The hosted mail backend remains Infomaniak SaaS only—there is no supported self-hosted server stack for kMail.
Swiss dual-DC backups, SPF/DKIM/DMARC and antivirus
Mailboxes are backed up across Swiss data centres with vendor-stated restore windows around 30 days; anti-spam/antivirus plus domain authentication (SPF, DKIM, DMARC) are standard. Availability claims (e.g. high uptime for essential services) should be checked against the current SLA for your plan.
Sovereign AI assist (Euria) inside the mailbox
In-product AI can help draft, correct, translate and process mail context; Infomaniak states messages sent to its AI are processed in Switzerland and not stored for other purposes. Treat AI features as operator-side processing of content you choose to submit—not as end-to-end private AI.
French-hosted webmail with IMAP, EAS, and classic protocols
Webmail plus IMAP4 for clients, Exchange ActiveSync for mobile sync, and POP3 on paid tiers; SMTP relay with account credentials. Vendor states mail and content stay on servers in France. Free tier is ad-supported with lower quotas; Premium unlocks POP3, more aliases, and larger mail/cloud caps. Suits teams that need standard desktop/mobile clients rather than a closed proprietary app only.
Mailo Junior supervised email for children
Child accounts (about ages 6–14) only exchange mail with contacts a parent or teacher validates. Age-adapted mini/junior UIs, no ads on Junior, optional promotion to a standard account while keeping the address. Separate Junior mobile apps. Unique fit for families and schools versus generic consumer mail.
Calendar, virtual disk, and open sync protocols
Shared calendars and tasks, address book, photo albums, and a virtual disk for files with WebDAV/FTP access. CalDAV and CardDAV for external clients. Premium+ can unlock OnlyOffice in-browser editing. Better as an all-in-one Mail&Cloud for SMEs/families than bare IMAP-only privacy mail.
Mailo Pro spaces: custom domains and mutualised storage
Pro Start/5/Modulo style plans share mail+cloud quota across accounts, support custom domains (register, transfer, or declare external), distribution lists, mailbox sharing, resource calendars, and manager tooling. Priority Pro hotline with documented acknowledgement and restoration targets for Pro subscriptions. Aimed at TPE/PME, associations, and municipalities—not a full Google Workspace clone.
Optional server-side PGP and account security controls
Built-in PGP/MIME encrypt and sign in the webmail as a trusted third party (keys managed on Mailo for multi-device convenience). Two-factor authentication, application passwords, connection history, and guardianship-style access options. Not zero-knowledge E2EE by default—use external client crypto if the provider must never hold keys.
| Assurance & compliance | Infomaniak kMail | Mailo |
|---|---|---|
| Independent security / no-logs audit | Not found Bug bounty and ISO ISMS claimed; no public independent no-logs audit of mailbox content found. Encryption is optional and keys remain with Infomaniak. | Not found Charter claims no commercial reading of messages; automated AV/spam scanning on servers. No public third-party audit PDF found. |
| ISO 27001 | Vendor claimed Vendor publishes ISO 27001:2022 certificate (certified since 2018 per certifications page); downloadable PDF and SoA references. | Not found No ISO 27001 claim found on legal/security/primary pages researched. |
| SOC 2 / SOC 3 | Not found Not listed among published certifications (ISO 27001/9001/14001/50001, B Corp, Swiss labels). | Not found No SOC 2/3 report referenced on public product pages. |
| GDPR / EU data protection | Vendor claimed Swiss entity; GDPR and Swiss FADP commitments on legal pages; DPO listed; Swiss hosting of service data claimed. | Vendor claimed French controller; privacy rules cite GDPR and French correspondence secrecy; DPO at dpo@mailo.com; France storage claim. |
| US CLOUD Act exposure (indicative) | Partial Swiss Infomaniak Network SA, no known US parent, own Swiss DCs for mail—not a claimed clean bill. Account payments via partners such as PayPal/Checkout (US-group) per confidentiality policy. Indicative only; not legal advice. | Partial EU entity / no known US parent / France-claimed mail hosting, but Verifone and PayPal (US-group) on payment path; full infra subprocessors unpublished. Assessment only—not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Downloadable DPA linked from trust centre (Data_Processing_Agreement (DPA).pdf). | Not found Privacy rules and terms cover processing; no standalone public B2B DPA download found—request via DPO or Pro channel. |
| EU AI Act | Not applicable Euria AI assist exists inside mail; product is primarily email/hosting, not an AI-system vendor offering. | Not applicable Traditional email/cloud suite; not marketed as an AI system product. |
| Considerations & known limitations | Infomaniak kMail | Mailo |
|---|---|---|
| Encryption is not zero-access by default | Medium Optional send encryption keeps private keys on Infomaniak infrastructure. Operators with warrant or insider access to the platform may still access unencrypted stored mail. Practical impact: do not treat kMail as a zero-knowledge vault for all messages. | Not listed |
| SaaS-only mail backend | Low No official self-host for the mail service; exit means IMAP export/migration. OSS clients do not equal portable server stack. | Not listed |
| Free tier residency and feature caps | Low my kSuite requires OECD residency and phone verification; no aliases, limited storage, enforced free signature. Unsuitable as free global professional mail. | Not listed |
| Limited public mail-path subprocessor table | Low Hosting is own Swiss DCs per vendor docs; confidentiality policy lists payment and marketing-class third parties. Procurement should request a current subprocessor list for mailbox content paths. | Not listed |
| No HDS health-hosting cert | Medium Vendor FAQ states French HDS certification is not planned—material for French health-sector workloads. | Not listed |
| PGP is server-side trusted third party | Not listed | Medium Webmail PGP holds keys on Mailo for multi-device use. Provider-access risk differs from zero-knowledge E2EE defaults at Tuta/Proton. Use external crypto if that is a hard requirement. |
| Incomplete public subprocessor inventory | Not listed | Medium Privacy rules name payments, domains, and free-tier ads, but not a full list of mail storage, backup, or anti-spam infrastructure vendors. Request annex for B2B risk review. |
| US-group payment processors | Not listed | Low Checkout shares email with Verifone/Paybox; PayPal is also offered. Limited to billing path per privacy rules, but relevant to CLOUD Act diligence. |
| Free tier third-party advertising | Not listed | Low Mailo Free shows ad banners via agencies under IAB TCF consent (Sirdata CMP). Premium removes ads. Ad cookies stated as not tied to Mailo profile. |
| No public ISO/SOC or independent security audit | Not listed | Medium Security posture relies on first-party statements and internal measures. Procurement teams may need questionnaires or NDA evidence. |
| Free accounts deleted after inactivity | Not listed | Low Mailo Free unused for 365 days can be deleted with content loss. Premium/Pro have different retention rules—plan backups and renewals. |
When: You need zero-access end-to-end encryption as the default mail model
Consider: Proton Mail
Different trust model: client-side E2EE vs Infomaniak operator-held keys for optional encryption
When: You want European hosted mail with a different encryption or non-profit posture
Consider: Mailfence or Posteo
Compare encryption UX, storage model, and commercial terms on each vendor site
When: You need full control of the MTA and storage stack
Consider: Self-hosted mail (e.g. mailcow/Stalwart) or a host that publishes server software
Infomaniak mobile apps are OSS; the hosted service is not self-hostable
When: You need zero-knowledge / default E2EE webmail
Consider: Tuta or Proton Mail
Mailo PGP is optional and server-side trusted third party
When: You want German privacy mail with different encryption/product posture
Consider: Posteo or mailbox.org
Compare protocols, storage bundles, and business features side by side
When: You need Swiss multi-product cloud with mail plus broader suite
Consider: Infomaniak kMail
Different country stack and product breadth
When: You need US Big Tech ecosystem integration at any cost
Consider: Gmail or Microsoft 365 / Outlook.com
Trade EU entity and France residency claims for ecosystem depth