mailbox (formerly mailbox.org) vs Mailo

Compare mailbox (formerly mailbox.org) and Mailo on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Microsoft 365

mailbox (formerly mailbox.org)

Germany· Office Productivity Suite

Needs review

Shortlist mailbox when you need a German-operated email-plus-collaboration suite (Mail, Drive, Office, Meet, Admin/API) on dual Berlin sites with published BSI C5 Type 1 and ISO 27001 claims. Skip when you require free forever mail or default zero-knowledge for all messages—consider Proton Mail or Tuta instead.

German-operatedBerlin dual-site hostingPGP + S/MIMEBSI C5 Type 1 (claimed)ISO 27001 (claimed)Mail + Drive + Meet + Office

View listing Visit Website

Mailo

France· Email Services

Needs review

Shortlist Mailo when you want French-entity freemium webmail with classic IMAP/EAS clients, integrated calendar/cloud, supervised Mailo Junior for kids, or Pro custom domains for SMEs—without US Big Tech accounts. Skip when you need default zero-knowledge E2EE, open-source/self-host, or a full Workspace-class suite; consider Tuta, Proton Mail, or Infomaniak kMail instead.

France-hosted (claimed)Freemium webmailMailo JuniorIMAP / ActiveSyncPro custom domainsOptional PGP (server-side)

View listing Visit Website

Highlighted rows differ between the two products.

mailbox (formerly mailbox.org) vs Mailo: Snapshot
Feature	mailbox (formerly mailbox.org)	Mailo
Country of origin	Germany	France
Category	Office Productivity Suite	Email Services
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	France
Legal entity	Heinlein Hosting GmbH (Berlin; CEO Peer Heinlein)	MAILO SAS (capital €75,000; RCS Créteil 851585547; VAT FR44851585547)
Governing law	Not listed	French law (terms of use)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
Hosting / residency	Core mailbox, Drive, and Meet on Heinlein-operated servers in German data centres in Berlin (two independent locations). Website analytics: self-hosted Matomo. Marketing site may embed Vimeo/YouTube. No public AWS/GCP/Azure product hosting region found for customer mail data.	Vendor states user personal data and content are stored/processed on servers in France; specialised French host centre (who-we-are); website hosted by Ecritel, Arradon, France. Named third parties: Verifone/Paybox (payment email), PayPal option, Gandi/Netim (domains), Sirdata + ad agencies (free-tier ads), optional Rainbow video and OnlyOffice. Full mail DC/backup subprocessor list not published.
Summary	German paid digital workplace from Heinlein Hosting GmbH: secure email with PGP/S/MIME, Drive, browser Office, Meet, and business Admin on dual Berlin data centres.	French freemium webmail and Mail&Cloud suite (MAILO SAS): email, calendar, cloud disk, Mailo Junior for children, and Pro custom domains—hosted in France, proprietary SaaS.
Tags	productivity privacy email gdpr german-hosting bsi-c5 iso-27001 collaboration	productivity privacy freemium saas family french webmail

At a glance: mailbox (formerly mailbox.org) vs Mailo
At a glance	mailbox (formerly mailbox.org)	Mailo
HQ	Berlin, Germany	Not listed
Legal entity	Heinlein Hosting GmbH	Not listed
Hosting	Own servers, dual independent Berlin sites	Not listed
Model	Paid subscription SaaS; trial available; no permanent free tier	Freemium SaaS (Free / Premium / Pro / Junior / Edu)
Self-host	No (managed SaaS)	No
Open standards	IMAP/SMTP, CalDAV/CardDAV, WebDAV, PGP, S/MIME	Not listed
HQ / entity	Not listed	MAILO SAS, France (RCS Créteil 851585547)
Hosting (claimed)	Not listed	Servers in France; website host Ecritel (FR)
Open source	Not listed	No (proprietary MailObject®)
Encryption default	Not listed	TLS + optional server-side PGP (not ZK E2EE)

Key capabilities: mailbox (formerly mailbox.org) vs Mailo
Key capabilities	mailbox (formerly mailbox.org)	Mailo
German-operated	Yes	Not listed
Berlin dual-site hosting	Yes	Not listed
PGP + S/MIME	Yes	Not listed
BSI C5 Type 1 (claimed)	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
Mail + Drive + Meet + Office	Yes	Not listed
France-hosted (claimed)	Not listed	Yes
Freemium webmail	Not listed	Yes
Mailo Junior	Not listed	Yes
IMAP / ActiveSync	Not listed	Yes
Pro custom domains	Not listed	Yes
Optional PGP (server-side)	Not listed	Yes

mailbox (formerly mailbox.org)

PGP Guard, S/MIME, and hardened mail transport
Webmail Guard for PGP without extra software (or Mailvelope with local keys), S/MIME for sign/encrypt, 2FA and app passwords, multi-stage spam/virus rejection, plus public transport controls (DNSSEC, DANE, MTA-STS, DMARC/DKIM/SPF, TLS checker, @secure.mailbox.org aliases). Benefits security-minded teams that still need interoperable IMAP/SMTP; content is not zero-knowledge by default unless you encrypt.
Drive on dual independent Berlin sites
Cloud files on the provider's own German infrastructure with two independent Berlin locations, WebDAV, mobile apps, guest share links, expandable quota, and optional client-side OpenPGP encryption of stored files. Fits teams replacing consumer cloud drives while keeping residency claims concrete; confirm plan quotas on the official site.
Browser Office with CalDAV and CardDAV
Edit common office formats in the browser, share calendars and contacts via open CalDAV/CardDAV standards, plus tasks, notes, polls, and TLS-secured XMPP chat. Aimed at SMEs and schools that want collaboration without a full Microsoft desktop stack; advanced Excel macros and deep Office add-ins are not the target.
Meet video hosted in German data centres
Browser-based conferencing integrated with calendar and mail: link invites for external guests, breakout rooms, screen share, chat, surveys, and moderator controls. Privacy documentation references the OpenTalk stack; sessions run through mailbox's German data centres. Evaluate E2EE defaults and recording policies against your meeting compliance needs.
Business Admin console and automation API
Central management of domains, mailboxes, quotas, spam/virus settings, IP allowlists, and backups, with an HTTP API for larger orgs and resellers (api.mailbox.org). Supports onboarding help and partner-assisted migration. Better for multi-seat German operations than pure consumer inboxes; not a full IdP replacement without SSO design work.

Mailo

French-hosted webmail with IMAP, EAS, and classic protocols
Webmail plus IMAP4 for clients, Exchange ActiveSync for mobile sync, and POP3 on paid tiers; SMTP relay with account credentials. Vendor states mail and content stay on servers in France. Free tier is ad-supported with lower quotas; Premium unlocks POP3, more aliases, and larger mail/cloud caps. Suits teams that need standard desktop/mobile clients rather than a closed proprietary app only.
Mailo Junior supervised email for children
Child accounts (about ages 6–14) only exchange mail with contacts a parent or teacher validates. Age-adapted mini/junior UIs, no ads on Junior, optional promotion to a standard account while keeping the address. Separate Junior mobile apps. Unique fit for families and schools versus generic consumer mail.
Calendar, virtual disk, and open sync protocols
Shared calendars and tasks, address book, photo albums, and a virtual disk for files with WebDAV/FTP access. CalDAV and CardDAV for external clients. Premium+ can unlock OnlyOffice in-browser editing. Better as an all-in-one Mail&Cloud for SMEs/families than bare IMAP-only privacy mail.
Mailo Pro spaces: custom domains and mutualised storage
Pro Start/5/Modulo style plans share mail+cloud quota across accounts, support custom domains (register, transfer, or declare external), distribution lists, mailbox sharing, resource calendars, and manager tooling. Priority Pro hotline with documented acknowledgement and restoration targets for Pro subscriptions. Aimed at TPE/PME, associations, and municipalities—not a full Google Workspace clone.
Optional server-side PGP and account security controls
Built-in PGP/MIME encrypt and sign in the webmail as a trusted third party (keys managed on Mailo for multi-device convenience). Two-factor authentication, application passwords, connection history, and guardianship-style access options. Not zero-knowledge E2EE by default—use external client crypto if the provider must never hold keys.

Assurance & compliance: mailbox (formerly mailbox.org) vs Mailo
Assurance & compliance	mailbox (formerly mailbox.org)	Mailo
Independent security / no-logs audit	Not found No public independent no-logs audit PDF found; operational transparency reports and BSI/ISO artefacts instead	Not found Charter claims no commercial reading of messages; automated AV/spam scanning on servers. No public third-party audit PDF found.
ISO 27001	Vendor claimed Vendor states ISO/IEC 27001:2022 on certified-quality and press pages; request current certificate in diligence	Not found No ISO 27001 claim found on legal/security/primary pages researched.
SOC 2 / SOC 3	Not found No SOC 2/3 claim found on primary security/cert pages	Not found No SOC 2/3 report referenced on public product pages.
BSI C5	Vendor claimed Vendor press (7 Jan 2026): BSI C5 Type 1 attestation for mailbox; confirm type, scope, and period	Not listed
GDPR / EU data protection	Vendor claimed German controller Heinlein Hosting GmbH; DE hosting; detailed privacy notice; DPO privacy@mailbox.org	Vendor claimed French controller; privacy rules cite GDPR and French correspondence secrecy; DPO at dpo@mailo.com; France storage claim.
US CLOUD Act exposure (indicative)	Partial EU/German entity, no known US parent, self-operated Berlin hosting for core data—no AWS/GCP/Azure product region found. Residual: marketing embeds (Vimeo/YouTube) and possible external payment services. Indicative assessment only, not legal advice.	Partial EU entity / no known US parent / France-claimed mail hosting, but Verifone and PayPal (US-group) on payment path; full infra subprocessors unpublished. Assessment only—not legal advice.
Data processing agreement (B2B)	Vendor claimed Business knowledge base: customers can conclude a DPA online; historic AVV portal for business accounts	Not found Privacy rules and terms cover processing; no standalone public B2B DPA download found—request via DPO or Pro channel.
EU AI Act	Not applicable Email/collaboration suite, not an AI product core	Not applicable Traditional email/cloud suite; not marketed as an AI system product.

Considerations & known limitations: mailbox (formerly mailbox.org) vs Mailo
Considerations & known limitations	mailbox (formerly mailbox.org)	Mailo
Mail is not zero-knowledge by default	Medium Without PGP/S/MIME, stored message content remains operator-accessible under legal process. Practical impact: train users or mandate Guard/S/MIME for confidential traffic.	Not listed
C5 Type 1 is point-in-time	Low Type 1 attestations describe design/implementation at a point in time. Re-check type (1 vs 2), scope, and renewal dates for public-sector RFPs.	Not listed
Payment and edge processors need confirmation	Low Core hosting is self-operated DE, but privacy text references external payment services; marketing embeds US video hosts. Ask for the current processor list with the DPA.	Not listed
Not a full Microsoft 365 ecosystem substitute	Medium Browser Office and Meet cover common collaboration; deep desktop macros, Graph automations, and third-party M365 marketplaces will not map 1:1.	Not listed
No customer self-host option	Low Organisations that must operate mail on their own iron need another stack; mailbox is multi-tenant SaaS.	Not listed
PGP is server-side trusted third party	Not listed	Medium Webmail PGP holds keys on Mailo for multi-device use. Provider-access risk differs from zero-knowledge E2EE defaults at Tuta/Proton. Use external crypto if that is a hard requirement.
Incomplete public subprocessor inventory	Not listed	Medium Privacy rules name payments, domains, and free-tier ads, but not a full list of mail storage, backup, or anti-spam infrastructure vendors. Request annex for B2B risk review.
US-group payment processors	Not listed	Low Checkout shares email with Verifone/Paybox; PayPal is also offered. Limited to billing path per privacy rules, but relevant to CLOUD Act diligence.
Free tier third-party advertising	Not listed	Low Mailo Free shows ad banners via agencies under IAB TCF consent (Sirdata CMP). Premium removes ads. Ad cookies stated as not tied to Mailo profile.
No public ISO/SOC or independent security audit	Not listed	Medium Security posture relies on first-party statements and internal measures. Procurement teams may need questionnaires or NDA evidence.
Free accounts deleted after inactivity	Not listed	Low Mailo Free unused for 365 days can be deleted with content loss. Premium/Pro have different retention rules—plan backups and renewals.

Fit

mailbox (formerly mailbox.org)

Best fit when

German or EU orgs replacing Gmail/Microsoft 365 for mail and light collaboration under German law
Teams that need IMAP/SMTP plus CalDAV/CardDAV and optional custom domains
Buyers that will use PGP Guard or S/MIME deliberately for sensitive mail
SMEs and schools wanting Drive, browser Office, and Meet without a US hyperscaler
Organisations that need multi-seat Admin, DPA, and an automation API

Poor fit when

Users who need a permanent free tier
Buyers requiring default zero-knowledge mail for every user without crypto setup
Teams that must self-host the full stack on their own infrastructure
Enterprises whose workflows depend on deep Microsoft Graph or Google Workspace add-ons

Consider instead when

When: You need default end-to-end encrypted mail as the primary product
Consider: Proton Mail or Tuta
Stronger E2EE-first posture; lighter full workplace suite than mailbox
When: You want minimal German privacy email without Drive/Office/Meet
Consider: Posteo
Leaner mailbox; fewer collaboration modules
When: You need full desktop Office parity and global SaaS integrations
Consider: Microsoft 365 (incumbent) with separate residency controls
Different risk and ecosystem tradeoff—not an EU peer

Mailo

Best fit when

EU individuals and families wanting French-hosted mail with calendar and cloud disk in one account
Parents/schools needing supervised child email (Mailo Junior) with contact allow-lists
French SMEs, associations, and municipalities needing custom domains and mutualised Pro storage
Teams that depend on IMAP, EAS, CalDAV, CardDAV, or WebDAV rather than a locked-in app
Buyers who accept freemium ads on free tier or low-cost Premium rather than pure prepaid anonymity mail

Poor fit when

Orgs that require default end-to-end encryption with zero-access provider architecture
Buyers that need open-source server code or official self-hosting
Enterprises needing SOC 2 / ISO 27001 evidence already published on a trust centre
Heavy Google Workspace / Microsoft 365 collaboration suites (docs/drive ecosystem depth)

Consider instead when

When: You need zero-knowledge / default E2EE webmail
Consider: Tuta or Proton Mail
Mailo PGP is optional and server-side trusted third party
When: You want German privacy mail with different encryption/product posture
Consider: Posteo or mailbox.org
Compare protocols, storage bundles, and business features side by side
When: You need Swiss multi-product cloud with mail plus broader suite
Consider: Infomaniak kMail
Different country stack and product breadth
When: You need US Big Tech ecosystem integration at any cost
Consider: Gmail or Microsoft 365 / Outlook.com
Trade EU entity and France residency claims for ecosystem depth

Open questions for due diligence

mailbox (formerly mailbox.org)

What is the exact current BSI C5 scope, type, and validity period on the attestation document?
Which payment processors and any other subprocessors appear in the live AVV annex?
What is the default Meet encryption mode (TLS-only vs optional E2EE) for your plan, and is recording available?
Which SSO/IdP integrations are supported for your business tier beyond generic SSO mentions?

Mailo

Will Mailo sign a GDPR Article 28 DPA with a full subprocessor and transfer annex for Pro customers?
What is the named primary data-centre operator and backup/DR location beyond the France and Ecritel website-host statements?
Is there an independent penetration test, ISO 27001 roadmap, or customer-available security whitepaper?
Where is Rainbow (video) and OnlyOffice data processed relative to the France mail claim?
Current UGAP / public procurement listing status for French public buyers?