mailbox (formerly mailbox.org) vs reeqee

Compare mailbox (formerly mailbox.org) and reeqee on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Microsoft 365

mailbox (formerly mailbox.org)

Germany· Office Productivity Suite

Needs review

Shortlist mailbox when you need a German-operated email-plus-collaboration suite (Mail, Drive, Office, Meet, Admin/API) on dual Berlin sites with published BSI C5 Type 1 and ISO 27001 claims. Skip when you require free forever mail or default zero-knowledge for all messages—consider Proton Mail or Tuta instead.

German-operatedBerlin dual-site hostingPGP + S/MIMEBSI C5 Type 1 (claimed)ISO 27001 (claimed)Mail + Drive + Meet + Office

View listing Visit Website

reeqee

Germany· Office Productivity Suite

Needs review

Shortlist reeqee when a DACH team needs German natural-language queries on CSV/XLSX with local row processing and an EU LLM that only receives schema. Skip when you need a full spreadsheet suite, server-side warehouse analytics, independent security audits, or consumer licensing. Consider Microsoft 365 Excel or Google Workspace for authoring, and LibreOffice or Nextcloud for European office/file workflows that are not text-to-SQL.

EU-operatedBrowser-local SQLGerman NLP queriesSchema-only AI pathB2B DACH focus

View listing Visit Website

Highlighted rows differ between the two products.

mailbox (formerly mailbox.org) vs reeqee: Snapshot
Feature	mailbox (formerly mailbox.org)	reeqee
Country of origin	Germany	Germany
Category	Office Productivity Suite	Office Productivity Suite
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	Germany
Legal entity	Heinlein Hosting GmbH (Berlin; CEO Peer Heinlein)	Christian Lesemann (sole trader), Torstraße 208, 10115 Berlin
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Low
EU-hosted status	Not listed	EU hosted
Hosting / residency	Core mailbox, Drive, and Meet on Heinlein-operated servers in German data centres in Berlin (two independent locations). Website analytics: self-hosted Matomo. Marketing site may embed Vimeo/YouTube. No public AWS/GCP/Azure product hosting region found for customer mail data.	Web app hosted on Hetzner Online GmbH in Germany (vendor privacy policy; public A record in Hetzner AS24940, Nuremberg). Text-to-SQL LLM: Mistral AI SAS in France (schema and questions only per vendor). Payments: Mollie B.V., Netherlands. Analytics: self-hosted Umami on Hetzner. Site CSP also allows cdn.jsdelivr.net for client assets (likely DuckDB-WASM). No US parent found. Backup/DR providers not published.
Summary	German paid digital workplace from Heinlein Hosting GmbH: secure email with PGP/S/MIME, Drive, browser Office, Meet, and business Admin on dual Berlin data centres.	Browser-native German text-to-SQL for CSV and Excel: ask in plain language, run DuckDB-WASM locally, send only schema and the question to Mistral in the EU.
Tags	privacy gdpr email productivity german-hosting bsi-c5 iso-27001 collaboration	privacy gdpr text-to-sql csv excel duckdb dsgvo dach mistral hetzner browser

At a glance: mailbox (formerly mailbox.org) vs reeqee
At a glance	mailbox (formerly mailbox.org)	reeqee
HQ	Berlin, Germany	Berlin, Germany
Legal entity	Heinlein Hosting GmbH	Christian Lesemann (sole trader)
Hosting	Own servers, dual independent Berlin sites	Not listed
Model	Paid subscription SaaS; trial available; no permanent free tier	Not listed
Self-host	No (managed SaaS)	No
Open standards	IMAP/SMTP, CalDAV/CardDAV, WebDAV, PGP, S/MIME	Not listed
Product type	Not listed	Browser SaaS text-to-SQL for CSV/XLSX
AI provider	Not listed	Mistral AI SAS (France), schema + question only (vendor claim)
Commercial model	Not listed	Trial then annual prepaid B2B plans via Mollie
Open source	Not listed	No

Key capabilities: mailbox (formerly mailbox.org) vs reeqee
Key capabilities	mailbox (formerly mailbox.org)	reeqee
German-operated	Yes	Yes
Berlin dual-site hosting	Yes	Not listed
PGP + S/MIME	Yes	Not listed
BSI C5 Type 1 (claimed)	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
Mail + Drive + Meet + Office	Yes	Not listed
Browser-local SQL	Not listed	Yes
German NLP queries	Not listed	Yes
Schema-only AI path	Not listed	Yes
B2B DACH focus	Not listed	Yes

mailbox (formerly mailbox.org)

PGP Guard, S/MIME, and hardened mail transport
Webmail Guard for PGP without extra software (or Mailvelope with local keys), S/MIME for sign/encrypt, 2FA and app passwords, multi-stage spam/virus rejection, plus public transport controls (DNSSEC, DANE, MTA-STS, DMARC/DKIM/SPF, TLS checker, @secure.mailbox.org aliases). Benefits security-minded teams that still need interoperable IMAP/SMTP; content is not zero-knowledge by default unless you encrypt.
Drive on dual independent Berlin sites
Cloud files on the provider's own German infrastructure with two independent Berlin locations, WebDAV, mobile apps, guest share links, expandable quota, and optional client-side OpenPGP encryption of stored files. Fits teams replacing consumer cloud drives while keeping residency claims concrete; confirm plan quotas on the official site.
Browser Office with CalDAV and CardDAV
Edit common office formats in the browser, share calendars and contacts via open CalDAV/CardDAV standards, plus tasks, notes, polls, and TLS-secured XMPP chat. Aimed at SMEs and schools that want collaboration without a full Microsoft desktop stack; advanced Excel macros and deep Office add-ins are not the target.
Meet video hosted in German data centres
Browser-based conferencing integrated with calendar and mail: link invites for external guests, breakout rooms, screen share, chat, surveys, and moderator controls. Privacy documentation references the OpenTalk stack; sessions run through mailbox's German data centres. Evaluate E2EE defaults and recording policies against your meeting compliance needs.
Business Admin console and automation API
Central management of domains, mailboxes, quotas, spam/virus settings, IP allowlists, and backups, with an HTTP API for larger orgs and resellers (api.mailbox.org). Supports onboarding help and partner-assisted migration. Better for multi-seat German operations than pure consumer inboxes; not a full IdP replacement without SSO design work.

reeqee

German text-to-SQL on CSV and XLSX
Users upload CSV or Excel, ask in everyday German, and receive a generated SQL query plus a result table. Aimed at accountants and SME staff who will not write SQL or complex formulas.
Local DuckDB-WASM execution
Row data is processed in the browser with DuckDB-WASM according to the vendor. Analysis does not require uploading table contents to reeqee servers, which helps with sensitive DATEV or bank exports.
Schema-only Mistral EU calls
The privacy policy states that only the question and column names go to Mistral AI SAS in France for SQL generation and suggested questions. Cell values are excluded from that path.
Multi-file join and export
Paid workflows include linking multiple files or sheets with column matching, then exporting results as Excel or CSV. Plan limits differ between single-file and multi-file tiers.
Offline-style CSV/Excel converter
A separate converter turns files between XLSX, XLS, ODS, and CSV variants entirely in the browser without calling the AI, useful for UTF-8 and delimiter fixes.

Assurance & compliance: mailbox (formerly mailbox.org) vs reeqee
Assurance & compliance	mailbox (formerly mailbox.org)	reeqee
Independent security / no-logs audit	Not found No public independent no-logs audit PDF found; operational transparency reports and BSI/ISO artefacts instead	Not found Vendor claims local processing and limited AI payloads; no public third-party audit PDF found.
ISO 27001	Vendor claimed Vendor states ISO/IEC 27001:2022 on certified-quality and press pages; request current certificate in diligence	Not found
SOC 2 / SOC 3	Not found No SOC 2/3 claim found on primary security/cert pages	Not found
BSI C5	Vendor claimed Vendor press (7 Jan 2026): BSI C5 Type 1 attestation for mailbox; confirm type, scope, and period	Not listed
GDPR / EU data protection	Vendor claimed German controller Heinlein Hosting GmbH; DE hosting; detailed privacy notice; DPO privacy@mailbox.org	Vendor claimed German sole trader controller; detailed DE privacy policy; Hetzner and Mistral named as processors with Art. 28 language.
US CLOUD Act exposure (indicative)	Partial EU/German entity, no known US parent, self-operated Berlin hosting for core data—no AWS/GCP/Azure product region found. Residual: marketing embeds (Vimeo/YouTube) and possible external payment services. Indicative assessment only, not legal advice.	Partial EU sole trader, no known US parent, published processors are EU (Hetzner, Mistral, Mollie). Residual risk from possible US-operated client CDN (jsdelivr in CSP) and unpublished backup/DR. Indicative only, not legal advice.
Data processing agreement (B2B)	Vendor claimed Business knowledge base: customers can conclude a DPA online; historic AVV portal for business accounts	Vendor claimed AGB §10 state parties conclude an Art. 28 DPA when the provider processes personal data on the customer's behalf. Confirm execution in procurement.
EU AI Act	Not applicable Email/collaboration suite, not an AI product core	Not found Product is AI-assisted (Mistral text-to-SQL). No public AI Act classification or conformity statement found on the site.

Considerations & known limitations: mailbox (formerly mailbox.org) vs reeqee
Considerations & known limitations	mailbox (formerly mailbox.org)	reeqee
Mail is not zero-knowledge by default	Medium Without PGP/S/MIME, stored message content remains operator-accessible under legal process. Practical impact: train users or mandate Guard/S/MIME for confidential traffic.	Not listed
C5 Type 1 is point-in-time	Low Type 1 attestations describe design/implementation at a point in time. Re-check type (1 vs 2), scope, and renewal dates for public-sector RFPs.	Not listed
Payment and edge processors need confirmation	Low Core hosting is self-operated DE, but privacy text references external payment services; marketing embeds US video hosts. Ask for the current processor list with the DPA.	Not listed
Not a full Microsoft 365 ecosystem substitute	Medium Browser Office and Meet cover common collaboration; deep desktop macros, Graph automations, and third-party M365 marketplaces will not map 1:1.	Not listed
No customer self-host option	Low Organisations that must operate mail on their own iron need another stack; mailbox is multi-tenant SaaS.	Not listed
AI SQL can be wrong	Not listed	High AGB disclaim correctness of generated SQL and results. Customers must validate before tax, accounting, or business decisions. Practical impact: treat outputs as assistive, keep human review of the shown SQL.
Questions and SQL are logged	Not listed	Medium Privacy policy stores question text, generated SQL, success flag, and timestamp. Even if row data stays local, question text may itself be sensitive. Object via hello@reeqee.de per the policy.
No public independent audit	Not listed	Medium Local-processing and schema-only AI claims are first-party. No ISO 27001, SOC 2, or public security audit was found. High-assurance buyers will need contractual evidence and technical due diligence.
Sole-trader operator scale	Not listed	Medium Legal entity is a Berlin sole trader, not a GmbH with published certs or status page. Fine for many SME tools; weaker for enterprises that need vendor risk tiers, SLA percentages, or succession guarantees.
Renewal wording inconsistency	Not listed	Low Pricing page text and AGB renewal clauses have differed on automatic extension. Confirm the signed terms before budgeting renewals.

Fit

mailbox (formerly mailbox.org)

Best fit when

German or EU orgs replacing Gmail/Microsoft 365 for mail and light collaboration under German law
Teams that need IMAP/SMTP plus CalDAV/CardDAV and optional custom domains
Buyers that will use PGP Guard or S/MIME deliberately for sensitive mail
SMEs and schools wanting Drive, browser Office, and Meet without a US hyperscaler
Organisations that need multi-seat Admin, DPA, and an automation API

Poor fit when

Users who need a permanent free tier
Buyers requiring default zero-knowledge mail for every user without crypto setup
Teams that must self-host the full stack on their own infrastructure
Enterprises whose workflows depend on deep Microsoft Graph or Google Workspace add-ons

Consider instead when

When: You need default end-to-end encrypted mail as the primary product
Consider: Proton Mail or Tuta
Stronger E2EE-first posture; lighter full workplace suite than mailbox
When: You want minimal German privacy email without Drive/Office/Meet
Consider: Posteo
Leaner mailbox; fewer collaboration modules
When: You need full desktop Office parity and global SaaS integrations
Consider: Microsoft 365 (incumbent) with separate residency controls
Different risk and ecosystem tradeoff—not an EU peer

reeqee

Best fit when

German-speaking accounting, tax, controlling, or SME operators querying CSV/XLSX exports without SQL skills
Teams that want row data to stay in the browser and only send schema plus questions to an EU LLM
Buyers who need a narrow analysis tool beside Excel/DATEV exports rather than a full office suite
Organisations that prefer German-law B2B contracting with Berlin-based sole-trader operation and Hetzner DE hosting

Poor fit when

Teams that need collaborative spreadsheet authoring, macros, or a full Microsoft 365 / Google Workspace replacement
Workloads that require server-side data warehouses, scheduled pipelines, or multi-tenant governed datasets
Buyers that require ISO 27001, SOC 2, or an independent no-logs/security audit before shortlisting
Consumer or personal use cases (AGB limit the offer to entrepreneurs and public-law entities)

Consider instead when

When: You need a full European spreadsheet client for creating and editing workbooks offline
Consider: LibreOffice
LibreOffice is an office suite, not a text-to-SQL assistant.
When: You need EU file sync, sharing, and office collaboration rather than ad hoc CSV questioning
Consider: Nextcloud
Complementary stack: store in Nextcloud, analyse exports in reeqee if the AI path fits.
When: Analysts already live in Excel/Sheets and only need formulas, Power Query, or pivot tables
Consider: Microsoft 365 Excel or Google Workspace Sheets
Stay in the incumbent suite if natural-language German querying is not the bottleneck.

Open questions for due diligence

mailbox (formerly mailbox.org)

What is the exact current BSI C5 scope, type, and validity period on the attestation document?
Which payment processors and any other subprocessors appear in the live AVV annex?
What is the default Meet encryption mode (TLS-only vs optional E2EE) for your plan, and is recording available?
Which SSO/IdP integrations are supported for your business tier beyond generic SSO mentions?

reeqee

Will the vendor sign a customer DPA and provide a complete subprocessor list including backup/DR?
Is there an independent review of the browser build proving row data never leaves the client?
Which exact Mistral model/endpoint is used, and how are prompt logs retained on Mistral's side?
Which renewal and cancellation terms govern paid plans when pricing page and AGB wording diverge?
Are there documented row/size limits for DuckDB-WASM on typical office laptops?