Compare Infomaniak kMail and Migadu on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Zoho Mail
Switzerland· Email Services
Needs review
Shortlist when you need Swiss-hosted professional email with custom domains, IMAP/CalDAV, suite bundling (kSuite), and operator-owned DCs. Skip when zero-access client-side E2EE or full self-host is mandatory—consider Proton Mail (E2EE) or a self-hosted stack instead.
Switzerland· Email Services
Needs review
Shortlist Migadu when you need Swiss-operated, standards IMAP/SMTP hosting with unlimited addresses across many domains under flat account quotas—especially agencies and multi-domain SMEs. Skip when you need provider E2EE defaults, contractual SLA on the default offer, mailbox 2FA, or bulk/transactional sending; consider Proton Mail/Tuta for E2EE, or mailbox.org/Mailfence/Posteo/Runbox for other European professional-mail tradeoffs.
Highlighted rows differ between the two products.
| Feature | Infomaniak kMail | Migadu |
|---|---|---|
| Country of origin | Switzerland | Switzerland |
| Category | Email Services | Email Services |
| Open source | Yes | No |
| Self-hosted | No | No |
| Headquarters | Switzerland | Switzerland |
| Legal entity | Infomaniak Network SA (Rue Eugène Marziano 25, 1227 Les Acacias, Geneva; CH-660.0.059.996-1; IDE CHE-103.167.648) | Migadu-Mail GmbH |
| Governing law | Not listed | Canton of Appenzell Ausserrhoden, Swiss Confederation (terms) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Medium |
| Hosting / residency | Primary mail hosting on Infomaniak-operated Swiss data centres (Geneva/Zurich region; Swiss Hosting label claimed); dual-DC backups in Switzerland. Confidentiality policy names payment partners (e.g. PayPal, Checkout) and other ancillary third parties for account/billing/measurement—not AWS/GCP/Azure as primary mail hosts in public materials. | Mail servers stated in France (EU). Payment subprocessors Stripe and PayPal (US) for billing data. Full mail infrastructure/backup subprocessor list not published by name on primary pages. |
| Summary | Swiss-hosted professional email, contacts and calendars from Infomaniak Network SA—custom domains, open protocols, optional encryption, part of kSuite. | Swiss-operated, standards-based email hosting for custom domains: unlimited addresses and multi-domain accounts priced by usage quotas, not per mailbox. |
| Tags |
| At a glance | Infomaniak kMail | Migadu |
|---|---|---|
| HQ | Geneva, Switzerland (Les Acacias) | Not listed |
| Legal entity | Infomaniak Network SA | Not listed |
| Hosting | Own Swiss data centres; dual-site mailbox backups | Not listed |
| Open source | Mobile clients GPL-3.0; backend SaaS | Not listed |
| Self-host | No (hosted only) | No |
| Commercial model | Free my kSuite tier; paid kSuite / Mail Service seats | Flat per-account plans by daily message quotas + soft storage |
| HQ / entity | Not listed | Migadu-Mail GmbH, Switzerland |
| Founded | Not listed | 2014 (vendor About) |
| Mail hosting | Not listed | Data centers in France (vendor Pro/Cons) |
| Open source product? | Not listed | No — built on open-source stack; service is proprietary SaaS |
| Ownership | Not listed | Bootstrapped; no outside capital (vendor claim) |
| Key capabilities | Infomaniak kMail | Migadu |
|---|---|---|
| Swiss-hosted mail | Yes | Not listed |
| Custom domains | Yes | Not listed |
| IMAP / CalDAV | Yes | Not listed |
| OSS mobile clients | Yes | Not listed |
| ISO 27001 (claimed) | Yes | Not listed |
| Optional send encryption | Yes | Not listed |
| Swiss operator | Not listed | Yes |
| Usage-priced multi-domain | Not listed | Yes |
| SMTP/IMAP/POP3 | Not listed | Yes |
| Mail hosted in France | Not listed | Yes |
| Multi-admin + API | Not listed | Yes |
| No ads / no tracking | Not listed | Yes |
Custom-domain mail with IMAP, CalDAV and CardDAV
Host name@your-domain addresses with standard IMAP/SMTP plus CalDAV/CardDAV so Thunderbird, Apple Mail, Outlook and other clients stay usable. Paid kSuite/Mail Service tiers add multi-mailbox management, aliases/categories, signatures and team admin; free my kSuite is limited to one address without aliases.
One-click send-time encryption (OpenPGP / ECC / AES)
Optional encryption at send uses OpenPGP, ECC and AES-256-GCM; Infomaniak-to-Infomaniak is automatic after auth, while external recipients often open a password-protected secure page. Private keys stay on Infomaniak infrastructure—useful for sensitive sends, but not zero-access client-side E2EE with user-held keys.
Open-source Infomaniak Mail mobile clients
Official iOS and Android mail apps are published on GitHub under GPL-3.0 for local inspection and contribution. The hosted mail backend remains Infomaniak SaaS only—there is no supported self-hosted server stack for kMail.
Swiss dual-DC backups, SPF/DKIM/DMARC and antivirus
Mailboxes are backed up across Swiss data centres with vendor-stated restore windows around 30 days; anti-spam/antivirus plus domain authentication (SPF, DKIM, DMARC) are standard. Availability claims (e.g. high uptime for essential services) should be checked against the current SLA for your plan.
Sovereign AI assist (Euria) inside the mailbox
In-product AI can help draft, correct, translate and process mail context; Infomaniak states messages sent to its AI are processed in Switzerland and not stored for other purposes. Treat AI features as operator-side processing of content you choose to submit—not as end-to-end private AI.
Usage-metered accounts with unlimited addresses
Plans are flat per Migadu account. Within daily in/out quotas and soft storage guidance, create large numbers of mailboxes and host many domains without per-address fees—useful for agencies and multi-project teams. Soft storage does not hard-bounce mail; sustained over-quota use can force upgrades or limits.
Standards SMTP, IMAP4, POP3, and webmail
No proprietary client protocol. Connect Thunderbird, Apple Mail, Outlook, mutt, and others over TLS (typical endpoints imap.migadu.com:993, smtp.migadu.com:465, pop.migadu.com:995). ManageSieve filtering, aliases, pattern rewrites, identities, footers, auto-responders, and optional catch-alls cover classic postmaster needs. Data remains portable via standard protocols.
Multi-domain admin, multi-admin, and beta API
Agencies can hold many client domains under one roof, open multiple administrators (domain-scoped on higher plans), set per-domain/mailbox limits, and monitor traffic. A REST API (documented as early beta) manages domains, mailboxes, identities, forwardings, aliases, and rewrites for automation. Domain deletion stays UI-only as a safety measure.
DNS helpers and postmaster-style support
Optional built-in DNS ships mail records preconfigured; Migadu also offers DNS setup help at no extra fee and publishes diagnostics/activation flows. Support is ticket-based from people who operate the mail stack—not outsourced chat—with plan-dependent urgency outside office hours.
No ads, no product analytics cookies
Vendor policy states no advertising, no tracking of mailbox content for ads, and no website analytics cookies beyond session needs. Processing is framed for service delivery, abuse prevention, and legal obligations. Payment data still goes to Stripe and PayPal under separate processor terms.
| Assurance & compliance | Infomaniak kMail | Migadu |
|---|---|---|
| Independent security / no-logs audit | Not found Bug bounty and ISO ISMS claimed; no public independent no-logs audit of mailbox content found. Encryption is optional and keys remain with Infomaniak. | Not found Vendor claims no ad scanning/sharing of mail content; no public third-party audit PDF located. |
| ISO 27001 | Vendor claimed Vendor publishes ISO 27001:2022 certificate (certified since 2018 per certifications page); downloadable PDF and SoA references. | Not found Data centers described as internationally certified; no Migadu-organization ISO 27001 certificate found on primary pages. |
| SOC 2 / SOC 3 | Not found Not listed among published certifications (ISO 27001/9001/14001/50001, B Corp, Swiss labels). | Not found |
| GDPR / EU data protection | Vendor claimed Swiss entity; GDPR and Swiss FADP commitments on legal pages; DPO listed; Swiss hosting of service data claimed. | Vendor claimed Privacy policy asserts GDPR and Swiss DPA compliance; mail hosted in France per vendor. |
| US CLOUD Act exposure (indicative) | Partial Swiss Infomaniak Network SA, no known US parent, own Swiss DCs for mail—not a claimed clean bill. Account payments via partners such as PayPal/Checkout (US-group) per confidentiality policy. Indicative only; not legal advice. | Partial Swiss entity, no known US parent, mail in France; Stripe and PayPal process payments with US transfers. Infrastructure subprocessors not fully named. EuropeanStack assessment—not a vendor certification. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Downloadable DPA linked from trust centre (Data_Processing_Agreement (DPA).pdf). | Vendor claimed Privacy page states it serves as privacy policy and DPA; confirm suitability with counsel. |
| EU AI Act | Not applicable Euria AI assist exists inside mail; product is primarily email/hosting, not an AI-system vendor offering. | Not applicable Email hosting product; not an AI system offering. |
| Considerations & known limitations | Infomaniak kMail | Migadu |
|---|---|---|
| Encryption is not zero-access by default | Medium Optional send encryption keeps private keys on Infomaniak infrastructure. Operators with warrant or insider access to the platform may still access unencrypted stored mail. Practical impact: do not treat kMail as a zero-knowledge vault for all messages. | Not listed |
| SaaS-only mail backend | Low No official self-host for the mail service; exit means IMAP export/migration. OSS clients do not equal portable server stack. | Not listed |
| Free tier residency and feature caps | Low my kSuite requires OECD residency and phone verification; no aliases, limited storage, enforced free signature. Unsuitable as free global professional mail. | Not listed |
| Limited public mail-path subprocessor table | Low Hosting is own Swiss DCs per vendor docs; confidentiality policy lists payment and marketing-class third parties. Procurement should request a current subprocessor list for mailbox content paths. | Not listed |
| No HDS health-hosting cert | Medium Vendor FAQ states French HDS certification is not planned—material for French health-sector workloads. | Not listed |
| US payment subprocessors (Stripe, PayPal) | Not listed | Medium Billing-related personal data can transfer to US processors under Migadu’s privacy policy. Mail content path is France/EU per vendor, but payment data is a separate CLOUD Act / transfer surface. |
| Incomplete public infrastructure subprocessor list | Not listed | Medium Primary pages name France hosting and certified DCs without a full vendor inventory for compute, storage, and backups. Procurement should request the current list and regions in writing. |
| No E2EE product default; no classic mailbox 2FA | Not listed | Medium Standards mail with TLS; vendor recommends user-side OpenPGP for strong content secrecy. IMAP 2FA is not offered; app-specific-style identities are not second-factor MFA. |
| Daily quotas and human-mail policy | Not listed | Medium Account-wide daily in/out caps and anti-bulk rules make Migadu unsuitable as a transactional/marketing ESP. Over-limit mail can be deferred or rejected after tolerance. |
| No default SLA on standard plans | Not listed | Low Vendor states standard offers lack SLAs; email is treated as asynchronous and occasionally disrupted. Enterprise SLA only via separate commercial discussion. |
| No public independent security audit | Not listed | Medium Privacy and no-ad-scanning claims are first-party. No independent audit report found for no-logs or security controls. |
When: You need zero-access end-to-end encryption as the default mail model
Consider: Proton Mail
Different trust model: client-side E2EE vs Infomaniak operator-held keys for optional encryption
When: You want European hosted mail with a different encryption or non-profit posture
Consider: Mailfence or Posteo
Compare encryption UX, storage model, and commercial terms on each vendor site
When: You need full control of the MTA and storage stack
Consider: Self-hosted mail (e.g. mailcow/Stalwart) or a host that publishes server software
Infomaniak mobile apps are OSS; the hosted service is not self-hostable
When: You need provider-managed end-to-end encryption as the default product promise
Consider: Proton Mail or Tuta
Migadu is standards hosting with TLS; content secrecy against the operator is not the design center.
When: You want another European professional host with a different admin/encryption/residency package
Consider: mailbox.org, Mailfence, Posteo, or Runbox
Compare DPA detail, audit packaging, and whether multi-domain usage pricing still wins for your address sprawl.
When: You need full workspace suite (docs, meet, identity) rather than email hosting alone
Consider: Google Workspace, Microsoft 365, or Infomaniak-style European suites
Migadu deliberately stays postmaster-focused.
When: You need bulk or high-rate application email
Consider: A dedicated ESP (not Migadu); Amazon SES is the common Big Tech baseline—pair with EU ESPs if residency matters
Migadu rate-limits and bans intentional bulk use.