mailbox (formerly mailbox.org) vs Unomed Flows

Compare mailbox (formerly mailbox.org) and Unomed Flows on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Microsoft 365

mailbox (formerly mailbox.org)

Germany· Office Productivity Suite

Needs review

Shortlist mailbox when you need a German-operated email-plus-collaboration suite (Mail, Drive, Office, Meet, Admin/API) on dual Berlin sites with published BSI C5 Type 1 and ISO 27001 claims. Skip when you require free forever mail or default zero-knowledge for all messages—consider Proton Mail or Tuta instead.

German-operatedBerlin dual-site hostingPGP + S/MIMEBSI C5 Type 1 (claimed)ISO 27001 (claimed)Mail + Drive + Meet + Office

View listing Visit Website

Unomed Flows

Switzerland· Office Productivity Suite

Needs review

Shortlist for Swiss practices wanting AI-prepared referrals, filing, ICD-10-GM suggestions and dictation drafts inside an existing browser-based PIS with mandatory human approval. Skip if you need a full PIS replacement, no US-group cloud processors, or public ISO/SOC evidence before pilot. Consider LiteScribe or HappyScribe when the only gap is transcription rather than multi-step practice administration.

Swiss-operatedHuman approval gateExisting PIS overlaySwiss hosting (claimed)No patient-data training (claimed)

View listing Visit Website

Highlighted rows differ between the two products.

mailbox (formerly mailbox.org) vs Unomed Flows: Snapshot
Feature	mailbox (formerly mailbox.org)	Unomed Flows
Country of origin	Germany	Switzerland
Category	Office Productivity Suite	Office Productivity Suite
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	Switzerland
Legal entity	Heinlein Hosting GmbH (Berlin; CEO Peer Heinlein)	Unomed AG, Tramstrasse 9, 8050 Zurich, Switzerland (CHE-374.858.885)
Governing law	Not listed	Swiss law / Swiss FADP (DSG) framing on privacy pages; German legal texts stated as binding
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
EU-hosted status	Not listed	Partial
Hosting / residency	Core mailbox, Drive, and Meet on Heinlein-operated servers in German data centres in Berlin (two independent locations). Website analytics: self-hosted Matomo. Marketing site may embed Vimeo/YouTube. No public AWS/GCP/Azure product hosting region found for customer mail data.	Vendor claims Swiss data-centre hosting and a locally operated LLM in Switzerland. Privacy lists CH for hosting/DB, file storage, email and SMS; Ireland for identity/liveness; Denmark for speech. Observed api.unomed.ch CSP references AWS S3 eu-central-2 and AWS Rekognition/Cognito eu-west-1. Firebase Cloud Messaging for push; Cloudflare/Google Analytics on the website. Full named processor list on request.
Summary	German paid digital workplace from Heinlein Hosting GmbH: secure email with PGP/S/MIME, Drive, browser Office, Meet, and business Admin on dual Berlin data centres.	Swiss AI workflow automation that prepares referrals, filing, coding and report drafts inside existing browser-based medical practice software for human approval.
Tags	email productivity privacy gdpr german-hosting bsi-c5 iso-27001 collaboration	workflow-automation ai healthcare medical-practices switzerland swiss-fadp practice-software

At a glance: mailbox (formerly mailbox.org) vs Unomed Flows
At a glance	mailbox (formerly mailbox.org)	Unomed Flows
HQ	Berlin, Germany	Zurich, Switzerland
Legal entity	Heinlein Hosting GmbH	Unomed AG (CHE-374.858.885)
Hosting	Own servers, dual independent Berlin sites	Not listed
Model	Paid subscription SaaS; trial available; no permanent free tier	Not listed
Self-host	No (managed SaaS)	Not listed
Open standards	IMAP/SMTP, CalDAV/CardDAV, WebDAV, PGP, S/MIME	Not listed
Product focus	Not listed	AI admin workflows inside existing practice software
Commercial model	Not listed	Per finished workflow run; free first-run trial path; monthly cancel
Open source	Not listed	No
Self-hosted	Not listed	Not offered as standard (Enterprise mentions own deployment; details not public)

Key capabilities: mailbox (formerly mailbox.org) vs Unomed Flows
Key capabilities	mailbox (formerly mailbox.org)	Unomed Flows
German-operated	Yes	Yes
Berlin dual-site hosting	Yes	Not listed
PGP + S/MIME	Yes	Not listed
BSI C5 Type 1 (claimed)	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
Mail + Drive + Meet + Office	Yes	Not listed
Human approval gate	Not listed	Yes
Existing PIS overlay	Not listed	Yes
Swiss hosting (claimed)	Not listed	Yes
No patient-data training (claimed)	Not listed	Yes

mailbox (formerly mailbox.org)

PGP Guard, S/MIME, and hardened mail transport
Webmail Guard for PGP without extra software (or Mailvelope with local keys), S/MIME for sign/encrypt, 2FA and app passwords, multi-stage spam/virus rejection, plus public transport controls (DNSSEC, DANE, MTA-STS, DMARC/DKIM/SPF, TLS checker, @secure.mailbox.org aliases). Benefits security-minded teams that still need interoperable IMAP/SMTP; content is not zero-knowledge by default unless you encrypt.
Drive on dual independent Berlin sites
Cloud files on the provider's own German infrastructure with two independent Berlin locations, WebDAV, mobile apps, guest share links, expandable quota, and optional client-side OpenPGP encryption of stored files. Fits teams replacing consumer cloud drives while keeping residency claims concrete; confirm plan quotas on the official site.
Browser Office with CalDAV and CardDAV
Edit common office formats in the browser, share calendars and contacts via open CalDAV/CardDAV standards, plus tasks, notes, polls, and TLS-secured XMPP chat. Aimed at SMEs and schools that want collaboration without a full Microsoft desktop stack; advanced Excel macros and deep Office add-ins are not the target.
Meet video hosted in German data centres
Browser-based conferencing integrated with calendar and mail: link invites for external guests, breakout rooms, screen share, chat, surveys, and moderator controls. Privacy documentation references the OpenTalk stack; sessions run through mailbox's German data centres. Evaluate E2EE defaults and recording policies against your meeting compliance needs.
Business Admin console and automation API
Central management of domains, mailboxes, quotas, spam/virus settings, IP allowlists, and backups, with an HTTP API for larger orgs and resellers (api.mailbox.org). Supports onboarding help and partner-assisted migration. Better for multi-seat German operations than pure consumer inboxes; not a full IdP replacement without SSO design work.

Unomed Flows

Trigger-and-step workflows with mandatory approval
Practices assemble workflows from listed triggers (referral arrived, dictation finished, lab result, refill request, insurer question, and more) and preparation steps (extract, match patient, suggest codes, draft report, file, encrypt-send). The vendor states the last step is always human review and approval before results are used.
Referral intake without retyping
Ready-made template path: when a referral PDF arrives, Flows reads patient and referrer fields, prepares patient creation in the practice system, and prepares a receipt confirmation. Staff confirm the match before anything is written. Aimed at Swiss referral volume rather than generic OCR demos.
ICD-10-GM code suggestions from documentation
After a consultation is documented, Flows can suggest matching ICD-10-GM codes and only enters them once approved. Coding responsibility stays with the professional; the product prepares candidates inside the practice process.
Runs inside existing browser-based PIS UIs
Unomed claims to work on the visible interface of the practice software (like an assistant), without database access or replacing the system. Public list covers 16-plus systems with official partnerships named for Swiss-MR, Axenita, inSuite, Nereida, ePaad and roaadent among others. Desktop-only stacks need a custom discussion.
Dictation and findings preparation
Workflows can turn finished dictations into structured report drafts (including referrer-short versions) and prepare findings for naming and filing into the proposed record. Unclear patient matches are meant to be resolved before filing, not auto-committed.

Assurance & compliance: mailbox (formerly mailbox.org) vs Unomed Flows
Assurance & compliance	mailbox (formerly mailbox.org)	Unomed Flows
Independent security / no-logs audit	Not found No public independent no-logs audit PDF found; operational transparency reports and BSI/ISO artefacts instead	Not found No public independent audit PDF or no-logs audit page found on unomed.ch.
ISO 27001	Vendor claimed Vendor states ISO/IEC 27001:2022 on certified-quality and press pages; request current certificate in diligence	Not found No ISO 27001 certificate claim located on product, security or trust pages.
SOC 2 / SOC 3	Not found No SOC 2/3 claim found on primary security/cert pages	Not found No SOC 2/3 report claim found.
BSI C5	Vendor claimed Vendor press (7 Jan 2026): BSI C5 Type 1 attestation for mailbox; confirm type, scope, and period	Not listed
GDPR / EU data protection	Vendor claimed German controller Heinlein Hosting GmbH; DE hosting; detailed privacy notice; DPO privacy@mailbox.org	Vendor claimed Swiss FADP (DSG) and GDPR both referenced in the privacy policy; Unomed AG is Swiss controller/processor depending on context. Confirm DPA for B2B healthcare use.
US CLOUD Act exposure (indicative)	Partial EU/German entity, no known US parent, self-operated Berlin hosting for core data—no AWS/GCP/Azure product region found. Residual: marketing embeds (Vimeo/YouTube) and possible external payment services. Indicative assessment only, not legal advice.	Partial Swiss entity / no known US parent, but US-group subprocessors appear: AWS (S3 eu-central-2, Rekognition/Cognito eu-west-1 per CSP), Firebase Cloud Messaging, Cloudflare and possibly Google Analytics on the marketing site. Indicative exposure medium. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Business knowledge base: customers can conclude a DPA online; historic AVV portal for business accounts	Vendor claimed Privacy policy §9 states processing on behalf of healthcare providers under contractual arrangements (data processing agreement). Request the current DPA and named subprocessor schedule.
EU AI Act	Not applicable Email/collaboration suite, not an AI product core	Unknown Product is AI-centric for administrative preparation with human approval. No public EU AI Act classification or conformity statement found.

Considerations & known limitations: mailbox (formerly mailbox.org) vs Unomed Flows
Considerations & known limitations	mailbox (formerly mailbox.org)	Unomed Flows
Mail is not zero-knowledge by default	Medium Without PGP/S/MIME, stored message content remains operator-accessible under legal process. Practical impact: train users or mandate Guard/S/MIME for confidential traffic.	Not listed
C5 Type 1 is point-in-time	Low Type 1 attestations describe design/implementation at a point in time. Re-check type (1 vs 2), scope, and renewal dates for public-sector RFPs.	Not listed
Payment and edge processors need confirmation	Low Core hosting is self-operated DE, but privacy text references external payment services; marketing embeds US video hosts. Ask for the current processor list with the DPA.	Not listed
Not a full Microsoft 365 ecosystem substitute	Medium Browser Office and Meet cover common collaboration; deep desktop macros, Graph automations, and third-party M365 marketplaces will not map 1:1.	Not listed
No customer self-host option	Low Organisations that must operate mail on their own iron need another stack; mailbox is multi-tenant SaaS.	Not listed
US-group cloud services on the data path	Not listed	Medium Despite Swiss hosting claims, observed and disclosed paths include AWS services and Firebase push. Sovereignty-sensitive buyers should obtain the named processor list and assess CLOUD Act / transfer risk with counsel.
No public independent security audit	Not listed	Medium No ISO 27001, SOC 2 or independent audit artefacts were found on the public site. Healthcare procurement may need questionnaires, penetration-test summaries or on-request reports before production use.
AI preparation errors in clinical administration	Not listed	Medium Vendor openly states suggestions can be wrong. Residual risk remains if practices over-trust auto-prepared codes, patient matches or report drafts; approval UX and training matter.
PIS coverage and desktop limits	Not listed	Low Supported browser-based systems are listed, but missing PIS brands and non-browser desktop software may block adoption until Unomed confirms feasibility.

Fit

mailbox (formerly mailbox.org)

Best fit when

German or EU orgs replacing Gmail/Microsoft 365 for mail and light collaboration under German law
Teams that need IMAP/SMTP plus CalDAV/CardDAV and optional custom domains
Buyers that will use PGP Guard or S/MIME deliberately for sensitive mail
SMEs and schools wanting Drive, browser Office, and Meet without a US hyperscaler
Organisations that need multi-seat Admin, DPA, and an automation API

Poor fit when

Users who need a permanent free tier
Buyers requiring default zero-knowledge mail for every user without crypto setup
Teams that must self-host the full stack on their own infrastructure
Enterprises whose workflows depend on deep Microsoft Graph or Google Workspace add-ons

Consider instead when

When: You need default end-to-end encrypted mail as the primary product
Consider: Proton Mail or Tuta
Stronger E2EE-first posture; lighter full workplace suite than mailbox
When: You want minimal German privacy email without Drive/Office/Meet
Consider: Posteo
Leaner mailbox; fewer collaboration modules
When: You need full desktop Office parity and global SaaS integrations
Consider: Microsoft 365 (incumbent) with separate residency controls
Different risk and ecosystem tradeoff—not an EU peer

Unomed Flows

Best fit when

Swiss medical practices on supported browser-based PIS wanting less retyping of referrals and findings
Teams that require a visible approve step before AI-prepared data enters the record
Clinics standardising ICD-10-GM suggestion and dictation-to-report drafting inside current software
Buyers prioritising Swiss legal entity and Swiss-claimed workflow hosting over US productivity suites

Poor fit when

Organisations replacing the practice information system itself rather than automating adjacent admin steps
Desktop-only PIS environments with no browser UI unless Unomed confirms a custom connection
Procurement that forbids US-parent cloud subprocessors (AWS/Firebase/Cloudflare paths observed or disclosed)
Buyers needing published ISO 27001/SOC 2 reports or a fully public named subprocessor register on day one

Consider instead when

When: You only need dictation or meeting transcription, not multi-step referral and filing workflows
Consider: LiteScribe or HappyScribe
Those catalog peers focus on transcription/notes rather than Swiss PIS overlay automation.
When: You need general-purpose cross-app automation across Office/Google stacks outside Swiss healthcare templates
Consider: Microsoft 365 or Google Workspace automation
Broader ecosystems, different jurisdiction and healthcare workflow depth.

Open questions for due diligence

mailbox (formerly mailbox.org)

What is the exact current BSI C5 scope, type, and validity period on the attestation document?
Which payment processors and any other subprocessors appear in the live AVV annex?
What is the default Meet encryption mode (TLS-only vs optional E2EE) for your plan, and is recording available?
Which SSO/IdP integrations are supported for your business tier beyond generic SSO mentions?

Unomed Flows

Will Unomed provide the current named subprocessor list (legal entities) and sign a DPA covering Flows workflows before go-live?
Which exact Swiss datacentre operator hosts primary databases, and is any AWS account/region used for primary patient workflow storage versus only identity or object storage?
Are ISO 27001, SOC 2, or health-sector assessments available under NDA?
What does Enterprise 'own deployment' include (VPC, on-prem components, customer-managed keys)?
How is EU AI Act applicability assessed for administrative AI with mandatory human approval in Swiss practices serving cross-border patients?