mailbox (formerly mailbox.org) vs RAIDBOXES Emails

Compare mailbox (formerly mailbox.org) and RAIDBOXES Emails on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Microsoft 365

mailbox (formerly mailbox.org)

Germany· Office Productivity Suite

Needs review

Shortlist mailbox when you need a German-operated email-plus-collaboration suite (Mail, Drive, Office, Meet, Admin/API) on dual Berlin sites with published BSI C5 Type 1 and ISO 27001 claims. Skip when you require free forever mail or default zero-knowledge for all messages—consider Proton Mail or Tuta instead.

German-operatedBerlin dual-site hostingPGP + S/MIMEBSI C5 Type 1 (claimed)ISO 27001 (claimed)Mail + Drive + Meet + Office

View listing Visit Website

RAIDBOXES Emails

Germany· Email Services

Needs review

Shortlist when you already (or will) host the domain and WordPress stack at RAIDBOXES and need practical multi-mailbox domain email under a German operator with an online DPA. Skip when you need multi-domain density, default E2EE, or email fully independent of a hoster—consider Migadu, Tuta, Posteo, or mailbox.org instead.

German operatorIMAP / SMTPMail Hosting 2.0Online DPAWordPress-adjacentOptional PGP

View listing Visit Website

Highlighted rows differ between the two products.

mailbox (formerly mailbox.org) vs RAIDBOXES Emails: Snapshot
Feature	mailbox (formerly mailbox.org)	RAIDBOXES Emails
Country of origin	Germany	Germany
Category	Office Productivity Suite	Email Services
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	Germany
Legal entity	Heinlein Hosting GmbH (Berlin; CEO Peer Heinlein)	Raidboxes GmbH, Hafenstraße 32, 48153 Münster (Amtsgericht Münster HRB 16184)
Governing law	Not listed	German law (company domicile Münster)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
Hosting / residency	Core mailbox, Drive, and Meet on Heinlein-operated servers in German data centres in Berlin (two independent locations). Website analytics: self-hosted Matomo. Marketing site may embed Vimeo/YouTube. No public AWS/GCP/Azure product hosting region found for customer mail data.	Email: vendor claims exclusive German data centres and first-party Mail Hosting 2.0 infrastructure (IMAP/SMTP on securemail.pro hostnames); privacy policy still names Heinlein Hosting/mailbox.org under paid email boxes (possible legacy lag). Platform/website: AWS EMEA SARL and DigitalOcean listed for web hosting of the online offer; US-group SaaS includes Intercom, Calendly, Chargebee, Sentry, Google analytics/ads, Mailgun, and others for support, billing, and marketing.
Summary	German paid digital workplace from Heinlein Hosting GmbH: secure email with PGP/S/MIME, Drive, browser Office, Meet, and business Admin on dual Berlin data centres.	German domain email hosting from Raidboxes GmbH (Münster): Mail Hosting 2.0 with IMAP/SMTP, multi-mailbox plans, optional PGP, and dashboard fit for WordPress agencies—domain must be hosted at RAIDBOXES.
Tags	privacy gdpr email productivity german-hosting bsi-c5 iso-27001 collaboration	privacy gdpr email-hosting wordpress germany business-email imap

At a glance: mailbox (formerly mailbox.org) vs RAIDBOXES Emails
At a glance	mailbox (formerly mailbox.org)	RAIDBOXES Emails
HQ	Berlin, Germany	Münster, Germany
Legal entity	Heinlein Hosting GmbH	Raidboxes GmbH (HRB 16184)
Hosting	Own servers, dual independent Berlin sites	Not listed
Model	Paid subscription SaaS; trial available; no permanent free tier	Not listed
Self-host	No (managed SaaS)	Not listed
Open standards	IMAP/SMTP, CalDAV/CardDAV, WebDAV, PGP, S/MIME	Not listed
Group	Not listed	team.blue (Belgium) since 2022
Product	Not listed	Mail Hosting 2.0 domain email
Access	Not listed	IMAP / SMTP + webmail
Domain constraint	Not listed	Domain hosted at RAIDBOXES for new mailboxes
Open source	Not listed	No
Self-hosted	Not listed	No

Key capabilities: mailbox (formerly mailbox.org) vs RAIDBOXES Emails
Key capabilities	mailbox (formerly mailbox.org)	RAIDBOXES Emails
German-operated	Yes	Not listed
Berlin dual-site hosting	Yes	Not listed
PGP + S/MIME	Yes	Not listed
BSI C5 Type 1 (claimed)	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
Mail + Drive + Meet + Office	Yes	Not listed
German operator	Not listed	Yes
IMAP / SMTP	Not listed	Yes
Mail Hosting 2.0	Not listed	Yes
Online DPA	Not listed	Yes
WordPress-adjacent	Not listed	Yes
Optional PGP	Not listed	Yes

mailbox (formerly mailbox.org)

PGP Guard, S/MIME, and hardened mail transport
Webmail Guard for PGP without extra software (or Mailvelope with local keys), S/MIME for sign/encrypt, 2FA and app passwords, multi-stage spam/virus rejection, plus public transport controls (DNSSEC, DANE, MTA-STS, DMARC/DKIM/SPF, TLS checker, @secure.mailbox.org aliases). Benefits security-minded teams that still need interoperable IMAP/SMTP; content is not zero-knowledge by default unless you encrypt.
Drive on dual independent Berlin sites
Cloud files on the provider's own German infrastructure with two independent Berlin locations, WebDAV, mobile apps, guest share links, expandable quota, and optional client-side OpenPGP encryption of stored files. Fits teams replacing consumer cloud drives while keeping residency claims concrete; confirm plan quotas on the official site.
Browser Office with CalDAV and CardDAV
Edit common office formats in the browser, share calendars and contacts via open CalDAV/CardDAV standards, plus tasks, notes, polls, and TLS-secured XMPP chat. Aimed at SMEs and schools that want collaboration without a full Microsoft desktop stack; advanced Excel macros and deep Office add-ins are not the target.
Meet video hosted in German data centres
Browser-based conferencing integrated with calendar and mail: link invites for external guests, breakout rooms, screen share, chat, surveys, and moderator controls. Privacy documentation references the OpenTalk stack; sessions run through mailbox's German data centres. Evaluate E2EE defaults and recording policies against your meeting compliance needs.
Business Admin console and automation API
Central management of domains, mailboxes, quotas, spam/virus settings, IP allowlists, and backups, with an HTTP API for larger orgs and resellers (api.mailbox.org). Supports onboarding help and partner-assisted migration. Better for multi-seat German operations than pure consumer inboxes; not a full IdP replacement without SSO design work.

RAIDBOXES Emails

Mail Hosting 2.0 on RAIDBOXES infrastructure
IMAP/SMTP mailboxes on dedicated hostnames (mail-rb.securemail.pro / smtp-rb.securemail.pro) after the move off the prior mailbox.org cooperation. Vendor claims German data-centre locations and triple-redundant mail servers. Best for teams that want domain mail under the same German WordPress host rather than a separate privacy-mail brand.
Multi-mailbox plans with aliases, forwards, and catch-all
Tiered plans allocate a fixed number of mailboxes and a shared storage pool, plus per-mailbox alias and forwarding quotas, autoresponders, and catch-all (requires a dedicated catch-all mailbox). One connected domain per plan—confirm multi-domain needs before shortlisting.
Spam/virus filters, TLS, optional PGP, ad-free inboxes
All plans include spam and virus filtering, SSL/TLS for transfer, a blacklist checker, webmail, and ad-free inboxes. PGP is optional rather than default end-to-end encryption for every message—teams that need mandatory E2EE workflows should evaluate Tuta or a full mailbox.org stack instead.
Dashboard-adjacent domain and WordPress ops
Mailboxes are ordered from the RAIDBOXES dashboard and are intended to sit next to WordPress hosting and domain management. New RAIDBOXES mailboxes require the domain to be hosted with RAIDBOXES; legacy mailbox.org-linked domains follow a separate migration path documented in the help centre.
Online B2B DPA and German operator
Raidboxes GmbH (Münster) offers an online data processing agreement (AV contract) with technical-organisational measures. Useful for agencies that already sign a DPA for WordPress hosting and want the same counterparty for domain email—still review TOMs and subprocessor scope for mailbox vs platform tooling.

Assurance & compliance: mailbox (formerly mailbox.org) vs RAIDBOXES Emails
Assurance & compliance	mailbox (formerly mailbox.org)	RAIDBOXES Emails
Independent security / no-logs audit	Not found No public independent no-logs audit PDF found; operational transparency reports and BSI/ISO artefacts instead	Not found No public third-party security or no-logs audit report found for RAIDBOXES Emails on primary pages.
ISO 27001	Vendor claimed Vendor states ISO/IEC 27001:2022 on certified-quality and press pages; request current certificate in diligence	Not found No company-wide ISO 27001 certificate for Raidboxes GmbH found on product/security pages; AWS region ISO mentions are not RAIDBOXES certs.
SOC 2 / SOC 3	Not found No SOC 2/3 claim found on primary security/cert pages	Not found No public SOC 2/3 report located for RAIDBOXES Emails.
BSI C5	Vendor claimed Vendor press (7 Jan 2026): BSI C5 Type 1 attestation for mailbox; confirm type, scope, and period	Not listed
GDPR / EU data protection	Vendor claimed German controller Heinlein Hosting GmbH; DE hosting; detailed privacy notice; DPO privacy@mailbox.org	Vendor claimed German controller (Raidboxes GmbH); product claims DE server locations and GDPR-aligned deletion; online DPA available. Confirm active mail stack vs privacy-policy mailbox.org listing.
US CLOUD Act exposure (indicative)	Partial EU/German entity, no known US parent, self-operated Berlin hosting for core data—no AWS/GCP/Azure product region found. Residual: marketing embeds (Vimeo/YouTube) and possible external payment services. Indicative assessment only, not legal advice.	Partial EU/German entity, no known US parent (team.blue BE group). Medium residual exposure via US-group platform subprocessors (AWS/DigitalOcean for online offer hosting; Intercom, Chargebee, Google tooling, Mailgun, etc.). Mail content path claimed DE-only. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Business knowledge base: customers can conclude a DPA online; historic AVV portal for business accounts	Vendor claimed Online AV/DPA flow at raidboxes.io/en/dpa/ and DocuSign TOM path documented in help centre.
EU AI Act	Not applicable Email/collaboration suite, not an AI product core	Not applicable Domain email hosting product, not an AI system offering.
B Corp certification	Not listed	Vendor claimed Raidboxes GmbH listed as Certified B Corporation on B Lab directory; impact certification, not an information-security audit.

Considerations & known limitations: mailbox (formerly mailbox.org) vs RAIDBOXES Emails
Considerations & known limitations	mailbox (formerly mailbox.org)	RAIDBOXES Emails
Mail is not zero-knowledge by default	Medium Without PGP/S/MIME, stored message content remains operator-accessible under legal process. Practical impact: train users or mandate Guard/S/MIME for confidential traffic.	Not listed
C5 Type 1 is point-in-time	Low Type 1 attestations describe design/implementation at a point in time. Re-check type (1 vs 2), scope, and renewal dates for public-sector RFPs.	Not listed
Payment and edge processors need confirmation	Low Core hosting is self-operated DE, but privacy text references external payment services; marketing embeds US video hosts. Ask for the current processor list with the DPA.	Not listed
Not a full Microsoft 365 ecosystem substitute	Medium Browser Office and Meet cover common collaboration; deep desktop macros, Graph automations, and third-party M365 marketplaces will not map 1:1.	Not listed
No customer self-host option	Low Organisations that must operate mail on their own iron need another stack; mailbox is multi-tenant SaaS.	Not listed
Domain must be hosted at RAIDBOXES	Not listed	Medium New mailboxes require the domain on RAIDBOXES. That is convenient for WP customers and a lock-in factor if you only wanted independent mail.
One connected domain per plan	Not listed	Medium Multi-domain operators need multiple plans or another provider; not a Migadu-style multi-domain account model.
PGP optional, not default E2EE	Not listed	Medium Threat models that assume provider-side unreadability by default are a better fit for Tuta or similar products.
US-group platform subprocessors	Not listed	Medium Privacy policy discloses AWS EMEA, DigitalOcean, Intercom, Chargebee, Google tools, Mailgun, and others for website/support/billing/marketing—even while email marketing claims German mail servers. Scope diligence to mailbox vs platform data paths.
Privacy policy may lag Mail Hosting 2.0	Not listed	Low §Email box still lists mailbox.org/Heinlein while marketing claims first-party hosting—confirm live stack and subprocessor annex for your contract.
No public ISO/SOC/mail audit	Not listed	Medium B Corp is not a security certification. Enterprise security questionnaires may need NDA materials or alternative providers with published audits.

Fit

mailbox (formerly mailbox.org)

Best fit when

German or EU orgs replacing Gmail/Microsoft 365 for mail and light collaboration under German law
Teams that need IMAP/SMTP plus CalDAV/CardDAV and optional custom domains
Buyers that will use PGP Guard or S/MIME deliberately for sensitive mail
SMEs and schools wanting Drive, browser Office, and Meet without a US hyperscaler
Organisations that need multi-seat Admin, DPA, and an automation API

Poor fit when

Users who need a permanent free tier
Buyers requiring default zero-knowledge mail for every user without crypto setup
Teams that must self-host the full stack on their own infrastructure
Enterprises whose workflows depend on deep Microsoft Graph or Google Workspace add-ons

Consider instead when

When: You need default end-to-end encrypted mail as the primary product
Consider: Proton Mail or Tuta
Stronger E2EE-first posture; lighter full workplace suite than mailbox
When: You want minimal German privacy email without Drive/Office/Meet
Consider: Posteo
Leaner mailbox; fewer collaboration modules
When: You need full desktop Office parity and global SaaS integrations
Consider: Microsoft 365 (incumbent) with separate residency controls
Different risk and ecosystem tradeoff—not an EU peer

RAIDBOXES Emails

Best fit when

WordPress agencies and freelancers standardising on RAIDBOXES for sites, domains, and mail admin
SMEs wanting professional multi-mailbox domain email with standard IMAP clients—not a full Google/Microsoft suite
Teams that need catch-all, aliases, forwards, autoresponders, and ad-free inboxes on one domain
Buyers who require a German legal counterparty and an online B2B DPA for processor agreements
Operators migrating off legacy mailbox.org-linked RAIDBOXES mail toward first-party Mail Hosting 2.0

Poor fit when

Multi-domain mail estates that need many domains under one contract (one connected domain per plan)
Policies requiring default end-to-end encryption for all mail (PGP is optional only)
Buyers who refuse any coupling between mailbox service and domain/WordPress hosting
Teams seeking a full office suite (Drive, collaborative docs, built-in video) rather than domain mail
Procurement that demands public ISO 27001/SOC 2 or independent no-logs audit reports for the mail product

Consider instead when

When: You need multi-domain, usage-based professional mail without WordPress host lock-in
Consider: Migadu
Swiss-operated, standards-based hosting priced by quotas rather than per-domain WordPress adjacency
When: You need default E2EE and a privacy-first client model
Consider: Tuta
Different threat model; less IMAP flexibility than RAIDBOXES
When: You want privacy-oriented German personal/business mail without hosting coupling
Consider: Posteo or mailbox (formerly mailbox.org)
mailbox is also the former RAIDBOXES mail partner and a deeper digital-workplace option
When: You need Google/Microsoft suite collaboration, not just domain mailboxes
Consider: Google Workspace or Microsoft 365
US Big Tech residency and CLOUD Act profile differ sharply—use only if suite features dominate

Open questions for due diligence

mailbox (formerly mailbox.org)

What is the exact current BSI C5 scope, type, and validity period on the attestation document?
Which payment processors and any other subprocessors appear in the live AVV annex?
What is the default Meet encryption mode (TLS-only vs optional E2EE) for your plan, and is recording available?
Which SSO/IdP integrations are supported for your business tier beyond generic SSO mentions?

RAIDBOXES Emails

For a new Mail Hosting 2.0 mailbox, is mailbox.org/Heinlein still a subprocessor for mailbox content, or only a legacy path?
Which German data-centre operators and exact regions host mail storage and backups (primary + DR)?
Does the standard DPA/TOM annex explicitly cover email hosting subprocessors separately from WordPress hosting?
What are published RPO/RTO and restore procedures for mailbox backups?
Are there any upcoming multi-domain plan options or reseller mail SKUs?