mailbox (formerly mailbox.org) vs OrdoGrid

Compare mailbox (formerly mailbox.org) and OrdoGrid on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Microsoft 365

mailbox (formerly mailbox.org)

Germany· Office Productivity Suite

Needs review

Shortlist mailbox when you need a German-operated email-plus-collaboration suite (Mail, Drive, Office, Meet, Admin/API) on dual Berlin sites with published BSI C5 Type 1 and ISO 27001 claims. Skip when you require free forever mail or default zero-knowledge for all messages—consider Proton Mail or Tuta instead.

German-operatedBerlin dual-site hostingPGP + S/MIMEBSI C5 Type 1 (claimed)ISO 27001 (claimed)Mail + Drive + Meet + Office

View listing Visit Website

OrdoGrid

Belgium· Office Productivity Suite

Needs review

Shortlist OrdoGrid when you need Belgian Peppol send/receive plus quotes and customers in one browser product, especially if unlimited Peppol inbox on a free tier matters. Skip when you need a full accounting ledger, multi-country e-invoicing regimes, self-hosting, or a direct contract with a Peppol access-point operator. Consider DELKARO HANDWERK for German craft workflows or a dedicated Peppol access-point vendor when network control is the purchase filter.

EU-operatedPeppol e-invoicingFree Peppol receive tierPublic API (Business)EN / FR / NL / DE

View listing Visit Website

Highlighted rows differ between the two products.

mailbox (formerly mailbox.org) vs OrdoGrid: Snapshot
Feature	mailbox (formerly mailbox.org)	OrdoGrid
Country of origin	Germany	Belgium
Category	Office Productivity Suite	Office Productivity Suite
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	Belgium
Legal entity	Heinlein Hosting GmbH (Berlin; CEO Peer Heinlein)	OrdoGrid (Belgian contracting entity per Terms; formal company form and BCE number not published on site)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
EU-hosted status	Not listed	Partial
Hosting / residency	Core mailbox, Drive, and Meet on Heinlein-operated servers in German data centres in Berlin (two independent locations). Website analytics: self-hosted Matomo. Marketing site may embed Vimeo/YouTube. No public AWS/GCP/Azure product hosting region found for customer mail data.	Vendor claims EU hosting. Core app/marketing DNS resolved to Hetzner (DE) in Helsinki, FI. Privacy lists Google, Microsoft, Stripe, SendGrid (US) and OpenAI (US) as processors.
Summary	German paid digital workplace from Heinlein Hosting GmbH: secure email with PGP/S/MIME, Drive, browser Office, Meet, and business Admin on dual Berlin data centres.	Belgian browser SaaS for Peppol e-invoicing, quotes, customers and optional project/time workflows for freelancers and small businesses.
Tags	email productivity privacy gdpr german-hosting bsi-c5 iso-27001 collaboration	invoicing peppol accounting belgium e-invoicing quotes saas

At a glance: mailbox (formerly mailbox.org) vs OrdoGrid
At a glance	mailbox (formerly mailbox.org)	OrdoGrid
HQ	Berlin, Germany	Not listed
Legal entity	Heinlein Hosting GmbH	Not listed
Hosting	Own servers, dual independent Berlin sites	Not listed
Model	Paid subscription SaaS; trial available; no permanent free tier	Not listed
Self-host	No (managed SaaS)	Not listed
Open standards	IMAP/SMTP, CalDAV/CardDAV, WebDAV, PGP, S/MIME	Not listed
HQ / governing law	Not listed	Belgium (Terms: Belgian law, Brussels courts)
Legal entity (public)	Not listed	OrdoGrid (trade name; BCE number not published on site)
Deployment	Not listed	Cloud SaaS (browser); not self-hosted
Peppol	Not listed	Send/receive via certified access point (vendor claim)
Commercial model	Not listed	Free forever tier + monthly paid plans (14-day paid trials)
Languages	Not listed	English, French, Dutch, German

Key capabilities: mailbox (formerly mailbox.org) vs OrdoGrid
Key capabilities	mailbox (formerly mailbox.org)	OrdoGrid
German-operated	Yes	Yes
Berlin dual-site hosting	Yes	Not listed
PGP + S/MIME	Yes	Not listed
BSI C5 Type 1 (claimed)	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
Mail + Drive + Meet + Office	Yes	Not listed
Peppol e-invoicing	Not listed	Yes
Free Peppol receive tier	Not listed	Yes
Public API (Business)	Not listed	Yes
EN / FR / NL / DE	Not listed	Yes

mailbox (formerly mailbox.org)

PGP Guard, S/MIME, and hardened mail transport
Webmail Guard for PGP without extra software (or Mailvelope with local keys), S/MIME for sign/encrypt, 2FA and app passwords, multi-stage spam/virus rejection, plus public transport controls (DNSSEC, DANE, MTA-STS, DMARC/DKIM/SPF, TLS checker, @secure.mailbox.org aliases). Benefits security-minded teams that still need interoperable IMAP/SMTP; content is not zero-knowledge by default unless you encrypt.
Drive on dual independent Berlin sites
Cloud files on the provider's own German infrastructure with two independent Berlin locations, WebDAV, mobile apps, guest share links, expandable quota, and optional client-side OpenPGP encryption of stored files. Fits teams replacing consumer cloud drives while keeping residency claims concrete; confirm plan quotas on the official site.
Browser Office with CalDAV and CardDAV
Edit common office formats in the browser, share calendars and contacts via open CalDAV/CardDAV standards, plus tasks, notes, polls, and TLS-secured XMPP chat. Aimed at SMEs and schools that want collaboration without a full Microsoft desktop stack; advanced Excel macros and deep Office add-ins are not the target.
Meet video hosted in German data centres
Browser-based conferencing integrated with calendar and mail: link invites for external guests, breakout rooms, screen share, chat, surveys, and moderator controls. Privacy documentation references the OpenTalk stack; sessions run through mailbox's German data centres. Evaluate E2EE defaults and recording policies against your meeting compliance needs.
Business Admin console and automation API
Central management of domains, mailboxes, quotas, spam/virus settings, IP allowlists, and backups, with an HTTP API for larger orgs and resellers (api.mailbox.org). Supports onboarding help and partner-assisted migration. Better for multi-seat German operations than pure consumer inboxes; not a full IdP replacement without SSO design work.

OrdoGrid

Peppol send, receive and delivery statuses
Prepare UBL invoices aligned with EN 16931, send through a certified Peppol access point, receive supplier invoices in an inbox, and track delivery plus IMR-style acceptance, rejection or dispute responses. Free plan: unlimited receiving and one outgoing Peppol invoice per month.
Quote-to-invoice document chain
Create quotes and invoices with automatic numbering and Belgian legal mentions, convert accepted quotes to invoices, look up VAT via CBE and VIES, and export PDFs. Receipts, credit notes and email sending with read receipts are on paid plans per the public pricing page.
Customers, projects, time and payments (paid)
Customer directory sits beside documents. Business features advertised include Kanban boards, tasks, time tracking, calendar sync (Google, Outlook, Apple ICS), Stripe payment links, bank statement import with payment matching, multi-location branding and team roles.
Public API on Business
Company-scoped API keys with documented OpenAPI for invoicing, Peppol and loyalty integrations. Useful when an accountant tool or custom workflow must create or fetch documents without living only in the UI.
Multilingual Belgian SME UI
Product and marketing surfaces are available in English, French, Dutch and German, with knowledge guides aimed at the Belgian 2026 B2B structured invoicing mandate and Peppol registration steps.

Assurance & compliance: mailbox (formerly mailbox.org) vs OrdoGrid
Assurance & compliance	mailbox (formerly mailbox.org)	OrdoGrid
Independent security / no-logs audit	Not found No public independent no-logs audit PDF found; operational transparency reports and BSI/ISO artefacts instead	Not found No public independent audit report found on official site.
ISO 27001	Vendor claimed Vendor states ISO/IEC 27001:2022 on certified-quality and press pages; request current certificate in diligence	Not found No ISO 27001 claim or certificate located on official pages researched.
SOC 2 / SOC 3	Not found No SOC 2/3 claim found on primary security/cert pages	Not found No SOC 2/3 report found on official site.
BSI C5	Vendor claimed Vendor press (7 Jan 2026): BSI C5 Type 1 attestation for mailbox; confirm type, scope, and period	Not listed
GDPR / EU data protection	Vendor claimed German controller Heinlein Hosting GmbH; DE hosting; detailed privacy notice; DPO privacy@mailbox.org	Vendor claimed Privacy policy commits to GDPR and Belgian data protection law; Belgian DPA complaint link published.
US CLOUD Act exposure (indicative)	Partial EU/German entity, no known US parent, self-operated Berlin hosting for core data—no AWS/GCP/Azure product region found. Residual: marketing embeds (Vimeo/YouTube) and possible external payment services. Indicative assessment only, not legal advice.	Partial Belgian contracting entity and Hetzner FI core path, but privacy lists US-group processors (SendGrid, OpenAI, Stripe, Google, Microsoft). Indicative only, not legal advice.
Data processing agreement (B2B)	Vendor claimed Business knowledge base: customers can conclude a DPA online; historic AVV portal for business accounts	Not found No public DPA download found; confirm under contract.
EU AI Act	Not applicable Email/collaboration suite, not an AI product core	Partial Not an AI-first product, but privacy discloses OpenAI processing of PDF invoices for data extraction. Confirm role under AI Act with vendor if relevant.

Considerations & known limitations: mailbox (formerly mailbox.org) vs OrdoGrid
Considerations & known limitations	mailbox (formerly mailbox.org)	OrdoGrid
Mail is not zero-knowledge by default	Medium Without PGP/S/MIME, stored message content remains operator-accessible under legal process. Practical impact: train users or mandate Guard/S/MIME for confidential traffic.	Not listed
C5 Type 1 is point-in-time	Low Type 1 attestations describe design/implementation at a point in time. Re-check type (1 vs 2), scope, and renewal dates for public-sector RFPs.	Not listed
Payment and edge processors need confirmation	Low Core hosting is self-operated DE, but privacy text references external payment services; marketing embeds US video hosts. Ask for the current processor list with the DPA.	Not listed
Not a full Microsoft 365 ecosystem substitute	Medium Browser Office and Meet cover common collaboration; deep desktop macros, Graph automations, and third-party M365 marketplaces will not map 1:1.	Not listed
No customer self-host option	Low Organisations that must operate mail on their own iron need another stack; mailbox is multi-tenant SaaS.	Not listed
No published BCE / legal-form imprint	Not listed	Medium Terms and privacy identify OrdoGrid under Belgian law, and RDAP shows BE registrant country, but the public site does not show an enterprise number or SRL/BV line. Procurement teams may need registry confirmation before contracting.
US SaaS subprocessors on email, AI OCR and payments	Not listed	Medium SendGrid, OpenAI, Stripe and Google appear in the privacy processor table. Orgs with strict no-US-processor policies need a written exception or alternative tooling for those paths.
No public security certification pack	Not listed	Medium ISO 27001, SOC 2 and independent audit artefacts were not found publicly. Security questionnaires will need vendor follow-up.
Peppol via third-party access point	Not listed	Low Network reach depends on the certified access point OrdoGrid uses. Switching access points or troubleshooting delivery may involve that provider as well as OrdoGrid support.
Not a full accounting suite	Not listed	Low Document and Peppol workflows are the centre. Buyers needing statutory ledgers still need an accountant tool or ERP alongside OrdoGrid.

Fit

mailbox (formerly mailbox.org)

Best fit when

German or EU orgs replacing Gmail/Microsoft 365 for mail and light collaboration under German law
Teams that need IMAP/SMTP plus CalDAV/CardDAV and optional custom domains
Buyers that will use PGP Guard or S/MIME deliberately for sensitive mail
SMEs and schools wanting Drive, browser Office, and Meet without a US hyperscaler
Organisations that need multi-seat Admin, DPA, and an automation API

Poor fit when

Users who need a permanent free tier
Buyers requiring default zero-knowledge mail for every user without crypto setup
Teams that must self-host the full stack on their own infrastructure
Enterprises whose workflows depend on deep Microsoft Graph or Google Workspace add-ons

Consider instead when

When: You need default end-to-end encrypted mail as the primary product
Consider: Proton Mail or Tuta
Stronger E2EE-first posture; lighter full workplace suite than mailbox
When: You want minimal German privacy email without Drive/Office/Meet
Consider: Posteo
Leaner mailbox; fewer collaboration modules
When: You need full desktop Office parity and global SaaS integrations
Consider: Microsoft 365 (incumbent) with separate residency controls
Different risk and ecosystem tradeoff—not an EU peer

OrdoGrid

Best fit when

Belgian freelancers and SMEs exchanging Peppol invoices for in-scope domestic B2B work
Teams that want quotes, invoices and customer records in the same browser workspace as Peppol statuses
Buyers who need unlimited Peppol receiving with only occasional outgoing send on a free plan
Organisations that may later add projects, time tracking, bank import, Stripe links or API access on paid plans
Users who need the product UI in English, French, Dutch or German

Poor fit when

Companies that must contract a Peppol certified access point operator directly rather than via a SaaS intermediary
Teams needing full statutory bookkeeping, multi-entity consolidation or non-Belgian e-invoicing regimes as the core product
Buyers requiring published ISO 27001/SOC 2 or an on-site DPA download before first contact
Organisations that refuse US-group subprocessors for email, payments, analytics or AI document extraction
Self-host or open-source mandate environments

Consider instead when

When: You need German craft-business job, quote and invoice workflows with a field app rather than Belgian Peppol
Consider: DELKARO HANDWERK
Different country focus and no Peppol-first positioning in the catalog entry.
When: You want a French-hosted general office suite (files, email, docs) without Peppol invoicing
Consider: ArkiaSuite
Office productivity peer, not an e-invoicing network product.
When: You need a broad productivity suite already used company-wide and will bolt Peppol on elsewhere
Consider: Microsoft 365 or a dedicated Peppol access-point provider
Suite covers docs/email; Peppol still needs a network path.

Open questions for due diligence

mailbox (formerly mailbox.org)

What is the exact current BSI C5 scope, type, and validity period on the attestation document?
Which payment processors and any other subprocessors appear in the live AVV annex?
What is the default Meet encryption mode (TLS-only vs optional E2EE) for your plan, and is recording available?
Which SSO/IdP integrations are supported for your business tier beyond generic SSO mentions?

OrdoGrid

What is the registered Belgian legal name and BCE/KBO enterprise number for the contracting entity?
Which Peppol certified access point provider is used, and can that chain be named in the DPA?
Will OrdoGrid sign a B2B DPA and provide a current subprocessor list under contract?
Is OpenAI processing of invoice PDFs optional, and can it be disabled for a tenant?
Are backups and database storage also on Hetzner EU regions, or on another cloud?