Compare Infomaniak kMail and Runbox on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Outlook.com
Switzerland· Email Services
Needs review
Shortlist when you need Swiss-hosted professional email with custom domains, IMAP/CalDAV, suite bundling (kSuite), and operator-owned DCs. Skip when zero-access client-side E2EE or full self-host is mandatory—consider Proton Mail (E2EE) or a self-hosted stack instead.
Norway· Email Services
Needs review
Shortlist Runbox when you need Norwegian/EEA-hosted IMAP email with custom domains, ad-free subscription economics, and standard clients. Skip when you require default zero-access E2EE—consider Proton Mail or Tuta instead—or when you need a full Microsoft 365-style suite.
Highlighted rows differ between the two products.
| Feature | Infomaniak kMail | Runbox |
|---|---|---|
| Country of origin | Switzerland | Norway |
| Category | Email Services | Email Services |
| Open source | Yes | Yes |
| Self-hosted | No | No |
| Headquarters | Switzerland | Norway |
| Legal entity | Infomaniak Network SA (Rue Eugène Marziano 25, 1227 Les Acacias, Geneva; CH-660.0.059.996-1; IDE CHE-103.167.648) | Runbox Solutions AS |
| Governing law | Not listed | Norwegian law; Personal Data Act implementing GDPR (EEA) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Medium |
| Hosting / residency | Primary mail hosting on Infomaniak-operated Swiss data centres (Geneva/Zurich region; Swiss Hosting label claimed); dual-DC backups in Switzerland. Confidentiality policy names payment partners (e.g. PayPal, Checkout) and other ancillary third parties for account/billing/measurement—not AWS/GCP/Azure as primary mail hosts in public materials. | Core email and account content: servers in Oslo (StackInfra) under Norwegian jurisdiction; systems management Copyleft Solutions AS (Norway). Optional third parties per privacy policy: Stripe, PayPal, Coinbase (US payments); Enom (US domains); Gandi (FR); Domeneshop (NO); JaguarPC (US default web hosting, Norway option); NodePing (US, status page). No known US parent. |
| Summary | Swiss-hosted professional email, contacts and calendars from Infomaniak Network SA—custom domains, open protocols, optional encryption, part of kSuite. | Norwegian subscription email hosting from Runbox Solutions AS: Oslo-hosted IMAP mailboxes, custom domains, CalDAV/CardDAV, and optional PGP. Ad-free; not default zero-access. |
| Tags |
| At a glance | Infomaniak kMail | Runbox |
|---|---|---|
| HQ | Geneva, Switzerland (Les Acacias) | Oslo, Norway |
| Legal entity | Infomaniak Network SA | Runbox Solutions AS (orgnr 996877027) |
| Hosting | Own Swiss data centres; dual-site mailbox backups | Email: StackInfra Oslo; optional web hosting may default US |
| Open source | Mobile clients GPL-3.0; backend SaaS | Partial (Runbox 7 web app); not self-hosted |
| Self-host | No (hosted only) | Not listed |
| Commercial model | Free my kSuite tier; paid kSuite / Mail Service seats | Paid subscription + trial (no permanent free tier) |
| Founded | Not listed | Service since 2000; current AS form 2011 |
| Key capabilities | Infomaniak kMail | Runbox |
|---|---|---|
| Swiss-hosted mail | Yes | Not listed |
| Custom domains | Yes | Yes |
| IMAP / CalDAV | Yes | Not listed |
| OSS mobile clients | Yes | Not listed |
| ISO 27001 (claimed) | Yes | Not listed |
| Optional send encryption | Yes | Not listed |
| Norwegian email hosting | Not listed | Yes |
| IMAP / POP / SMTP | Not listed | Yes |
| 100% renewable (claimed) | Not listed | Yes |
| Runbox 7 open source | Not listed | Yes |
| Optional PGP / S/MIME | Not listed | Yes |
Custom-domain mail with IMAP, CalDAV and CardDAV
Host name@your-domain addresses with standard IMAP/SMTP plus CalDAV/CardDAV so Thunderbird, Apple Mail, Outlook and other clients stay usable. Paid kSuite/Mail Service tiers add multi-mailbox management, aliases/categories, signatures and team admin; free my kSuite is limited to one address without aliases.
One-click send-time encryption (OpenPGP / ECC / AES)
Optional encryption at send uses OpenPGP, ECC and AES-256-GCM; Infomaniak-to-Infomaniak is automatic after auth, while external recipients often open a password-protected secure page. Private keys stay on Infomaniak infrastructure—useful for sensitive sends, but not zero-access client-side E2EE with user-held keys.
Open-source Infomaniak Mail mobile clients
Official iOS and Android mail apps are published on GitHub under GPL-3.0 for local inspection and contribution. The hosted mail backend remains Infomaniak SaaS only—there is no supported self-hosted server stack for kMail.
Swiss dual-DC backups, SPF/DKIM/DMARC and antivirus
Mailboxes are backed up across Swiss data centres with vendor-stated restore windows around 30 days; anti-spam/antivirus plus domain authentication (SPF, DKIM, DMARC) are standard. Availability claims (e.g. high uptime for essential services) should be checked against the current SLA for your plan.
Sovereign AI assist (Euria) inside the mailbox
In-product AI can help draft, correct, translate and process mail context; Infomaniak states messages sent to its AI are processed in Switzerland and not stored for other purposes. Treat AI features as operator-side processing of content you choose to submit—not as end-to-end private AI.
Norwegian-hosted IMAP email with full-disk encryption
Mailboxes live on servers Runbox places in a StackInfra facility in Oslo under Norwegian jurisdiction, with full-disk encryption at rest and TLS (including PFS) in transit. Access via IMAP, POP, SMTP, or Runbox 7 webmail suits teams that need standard clients rather than a proprietary-only app.
Custom domains, aliases, and multi-account admin
Host mail on your own domain, manage sub-accounts from a main account, and use many aliases on Runbox domains plus unlimited aliases on customer domains. Plus-addressing and filters help separate identities without running separate mailboxes.
CalDAV/CardDAV plus optional PGP or S/MIME
Integrated calendar and contacts sync over CalDAV and CardDAV with common desktop and mobile apps. End-to-end confidentiality is user-controlled via PGP or S/MIME—not zero-access by default—so operators can still index mail for search and scan for malware.
Ad-free, subscription-funded privacy model
Runbox states it does not show ads, does not use third-party trackers such as Google Analytics, and only scans messages for spam/virus protection—not advertising. Revenue is subscription-based with a public trial period, aligning incentives away from data-mining free mail.
Runbox 7 open-source webmail on hydropowered infra
The Runbox 7 web client is published on GitHub for inspection; the hosted server stack remains largely proprietary. Email infrastructure is advertised as 100% certified renewable electricity in Norway, with additional company offset claims—useful for sustainability procurement checklists.
| Assurance & compliance | Infomaniak kMail | Runbox |
|---|---|---|
| Independent security / no-logs audit | Not found Bug bounty and ISO ISMS claimed; no public independent no-logs audit of mailbox content found. Encryption is optional and keys remain with Infomaniak. | Not found Vendor claims minimal logging and short retention windows; no public independent audit report found |
| ISO 27001 | Vendor claimed Vendor publishes ISO 27001:2022 certificate (certified since 2018 per certifications page); downloadable PDF and SoA references. | Not found No Runbox ISO 27001 certificate found on primary pages (power supplier ISO 14001 is environmental, not info-sec) |
| SOC 2 / SOC 3 | Not found Not listed among published certifications (ISO 27001/9001/14001/50001, B Corp, Swiss labels). | Not found No public SOC 2/3 report located |
| GDPR / EU data protection | Vendor claimed Swiss entity; GDPR and Swiss FADP commitments on legal pages; DPO listed; Swiss hosting of service data claimed. | Vendor claimed Norwegian entity; Personal Data Act implements GDPR; appointed DPO; privacy policy documents rights and retention |
| US CLOUD Act exposure (indicative) | Partial Swiss Infomaniak Network SA, no known US parent, own Swiss DCs for mail—not a claimed clean bill. Account payments via partners such as PayPal/Checkout (US-group) per confidentiality policy. Indicative only; not legal advice. | Partial No known US parent; core email in Norway. Medium/partial because privacy policy lists US third parties (Stripe, PayPal, Coinbase, Enom, JaguarPC web hosting default, NodePing). Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Downloadable DPA linked from trust centre (Data_Processing_Agreement (DPA).pdf). | Not found Processor DPA with Copyleft is mentioned; no public customer-facing B2B DPA template found—ask sales/support |
| EU AI Act | Not applicable Euria AI assist exists inside mail; product is primarily email/hosting, not an AI-system vendor offering. | Not applicable Email hosting product; vendor states no intrusive AI for ad profiling |
| Considerations & known limitations | Infomaniak kMail | Runbox |
|---|---|---|
| Encryption is not zero-access by default | Medium Optional send encryption keeps private keys on Infomaniak infrastructure. Operators with warrant or insider access to the platform may still access unencrypted stored mail. Practical impact: do not treat kMail as a zero-knowledge vault for all messages. | Medium Unlike Proton/Tuta, Runbox can access stored mail for spam/virus scanning, indexing, and lawful process. Use PGP/S/MIME when E2EE is required. |
| SaaS-only mail backend | Low No official self-host for the mail service; exit means IMAP export/migration. OSS clients do not equal portable server stack. | Not listed |
| Free tier residency and feature caps | Low my kSuite requires OECD residency and phone verification; no aliases, limited storage, enforced free signature. Unsuitable as free global professional mail. | Not listed |
| Limited public mail-path subprocessor table | Low Hosting is own Swiss DCs per vendor docs; confidentiality policy lists payment and marketing-class third parties. Procurement should request a current subprocessor list for mailbox content paths. | Not listed |
| No HDS health-hosting cert | Medium Vendor FAQ states French HDS certification is not planned—material for French health-sector workloads. | Not listed |
| US vendors on optional product paths | Not listed | Medium Payments (Stripe/PayPal/Coinbase), domain registrar Enom, and default JaguarPC web hosting introduce US processors. Keep web hosting in Norway and minimize US payment data if policy requires. |
| No public ISO 27001 / SOC 2 / independent audit | Not listed | Medium Assurance relies on vendor policy, Norwegian law, and facility claims. Regulated buyers may need NDA evidence or on-site questionnaire. |
| Partial open source only | Not listed | Low Runbox 7 webmail is open source; mail backend is proprietary SaaS—no self-host path. |
| Post-closure and backup retention | Not listed | Low Privacy policy defines multi-month content retention and backup windows after closure (and longer account-info retention for bookkeeping). Request immediate deletion if policy requires faster wipe. |
When: You need zero-access end-to-end encryption as the default mail model
Consider: Proton Mail
Different trust model: client-side E2EE vs Infomaniak operator-held keys for optional encryption
When: You want European hosted mail with a different encryption or non-profit posture
Consider: Mailfence or Posteo
Compare encryption UX, storage model, and commercial terms on each vendor site
When: You need full control of the MTA and storage stack
Consider: Self-hosted mail (e.g. mailcow/Stalwart) or a host that publishes server software
Infomaniak mobile apps are OSS; the hosted service is not self-hostable
When: You need default end-to-end / zero-access encryption for all messages
Consider: Proton Mail or Tuta
Runbox uses optional PGP/S/MIME; operator can access stored mail for filtering and lawful process
When: You want a German privacy-oriented host with similar sustainability positioning
Consider: Posteo
Compare jurisdiction (DE vs NO), domain limits, and feature depth
When: You need Belgian email with integrated collaboration extras
Consider: Mailfence
Different encryption defaults and product scope
When: You need global free-tier convenience and suite lock-in
Consider: Gmail or Outlook.com / Microsoft 365
Accept US jurisdiction and ad/suite economics tradeoffs