Mailfence vs Soverin

Compare Mailfence and Soverin on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Microsoft 365, Outlook.com

Mailfence

Belgium· Email Services

Needs review

Shortlist Mailfence when you want Belgian-operated webmail with interoperable OpenPGP, digital signatures, and a light calendar/documents suite—plus optional business private-label or on-prem license. Skip when you need automatic closed E2EE without key management (consider Tuta), a large Swiss privacy ecosystem (Proton Mail), or a minimalist German mailbox (Posteo / mailbox.org).

EU-operated (Belgium)OpenPGP E2EEDigital signaturesMail + calendar + docsCustom domains (paid)B2B DPA available

View listing Visit Website

Soverin

Netherlands· Email Services

Needs review

Shortlist Soverin when you want Dutch-operated, paid IMAP email with custom domains, unlimited aliases, and strong mail-auth standards without Google/Microsoft ads. Skip when you need zero-knowledge E2EE—consider Proton Mail or Tuta instead—or a full productivity suite (mailbox.org / Microsoft 365).

NL / EU operatedCustom domainsIMAP / CalDAVNo ads / no trackingISO 27001 (claimed)DANE / DNSSEC

View listing Visit Website

Highlighted rows differ between the two products.

Mailfence vs Soverin: Snapshot
Feature	Mailfence	Soverin
Country of origin	Belgium	Netherlands
Category	Email Services	Email Services
Open source	No	No
Self-hosted	No	No
Headquarters	Belgium	Netherlands
Legal entity	ContactOffice Group sa, Avenue Franklin Roosevelt 47b, B-1050 Brussels (BE 0466.241.584)	Soverin B.V. (Amsterdam); owned by The Sharing Group / TSG Online (Dutch) as of September 2025 acquisition announcement
Governing law	Belgian law; Brussels courts (Terms of Use)	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Low
Hosting / residency	Primary production servers described as located in Belgium under Mailfence operational control (no intermediary managing servers per security page). No public AWS/GCP/Azure subprocessor list found. Backups stored in locations separate from offices/main DC (providers not named). Payment-card processing path not fully published.	Vendor: EU-only processing; data in NL; self-operated Dutch DCs, no hyperscaler. TechRadar: 3 NL DCs. Core mail hosts on Soverin B.V. AS211993. External first-line support partner under DPA/NDA (country unpublished). HIBP k-anon password checks; Let’s Encrypt; domain DNSSEC partner. No AWS/GCP/Azure as primary mailbox hosts in public materials.
Summary	Belgian secure email suite with browser-side OpenPGP encryption, digital signatures, calendar, documents, and optional custom domains under ContactOffice Group SA.	Dutch privacy-first email hosting: custom domains, open IMAP/SMTP/CalDAV, 25 GB mailboxes, no ads or content scanning, servers operated in the Netherlands.
Tags	privacy gdpr saas encrypted-email openpgp productivity belgium	privacy gdpr saas email netherlands custom-domain imap

At a glance: Mailfence vs Soverin
At a glance	Mailfence	Soverin
HQ / entity	Brussels — ContactOffice Group sa (BE 0466.241.584)	Not listed
Product launch	Mailfence brand ~2013; ContactOffice lineage since 1999	Not listed
Crypto	OpenPGP E2EE + digital signatures; optional password-encrypted messages	Not listed
Hosting	Vendor-operated servers in Belgium (per security page)	Dutch data centres; vendor claims self-operated, no hyperscaler
Open source	No (front-end OSS planned; not current)	Not listed
Self-host	SaaS default; Business license for large on-prem deployments	Not listed
Commercial model	Free tier + prepaid paid plans; Business packaging (see vendor site)	Annual prepaid; 30-day mailbox money-back; no free tier
Independent audit	No public audit PDF found	Not listed
HQ	Not listed	Amsterdam, Netherlands (Soverin B.V.)
Group	Not listed	The Sharing Group / TSG Online (acq. Sep 2025)
Protocols	Not listed	IMAP, SMTP, CalDAV, CardDAV
Storage	Not listed	25 GB per mailbox (vendor-stated)
Self-host / OSS	Not listed	No / No

Key capabilities: Mailfence vs Soverin
Key capabilities	Mailfence	Soverin
EU-operated (Belgium)	Yes	Yes
OpenPGP E2EE	Yes	Not listed
Digital signatures	Yes	Not listed
Mail + calendar + docs	Yes	Not listed
Custom domains (paid)	Yes	Not listed
B2B DPA available	Yes	Not listed
Custom domains	Not listed	Yes
IMAP / CalDAV	Not listed	Yes
No ads / no tracking	Not listed	Yes
ISO 27001 (claimed)	Not listed	Yes
DANE / DNSSEC	Not listed	Yes

Mailfence

Browser-side OpenPGP end-to-end encryption
Encrypt outbound mail in the browser with the OpenPGP standard so intermediaries—including Mailfence when messages are properly E2EE—cannot read ciphertext. Fully interoperable with other OpenPGP tools (e.g. Thunderbird/GnuPG). Optional password-encrypted messages cover recipients who do not use PGP. Unencrypted mail still sits on servers in the normal webmail model.
Digital signatures and multi-key OpenPGP keystore
Sign messages for authenticity and integrity, and manage keys in-product: generate, import, export, publish, and hold multiple key pairs without browser plug-ins. Default generated keys are 4096-bit per the threat-model page. Passphrase protection of private keys limits crypto operations if only the account password is compromised.
Mail, calendar, documents, and groups in one account
Beyond inbox: shareable calendars, online document storage/editing, and contact groups for collaboration without bolting on a separate US suite. Storage and alias limits scale by plan; free accounts remain suitable only for light personal use.
Custom domains, aliases, and mail protocols on paid tiers
Higher plans add custom domains with SPF/DKIM/DMARC-oriented setup, larger alias counts, and classic client access (POP, IMAP, SMTP) plus ActiveSync where listed. Entry-level free accounts focus on web/PWA/apps rather than full protocol parity—verify the live plan matrix before procurement.
Business admin: API, SSO, private label, optional on-prem license
Mailfence for Business offers control-panel and XML-RPC API user provisioning, SSO and directory hooks (LDAP/AD/CAS), branding, and Belgian cloud hosting with SLA language—or a license to run on customer Linux servers for large deployments. Fit for orgs that need Belgian hosting with admin automation, not a consumer-only mailbox.

Soverin

Custom domains with unlimited aliases
Host mail on your own domain (bring existing or register through Soverin). Unlimited aliases—plus-addressing or domain names—deliver into one mailbox, plus optional random @sinenomine.email private aliases that hide the real address. Suits freelancers and SMEs who need brandable addresses without per-alias fees.
Open IMAP/SMTP plus CalDAV/CardDAV
Use any standards-based client or device for mail, calendar, and contacts—no proprietary app required. Dashboard import helps migrate from other providers. Ideal when IT wants Thunderbird, Apple Mail, or Outlook without locking into a closed webmail ecosystem; not a zero-knowledge E2EE product by default.
Mail-path security: DANE, DKIM, DMARC, IP stripping
Outbound and inbound paths use TLS; Soverin publishes and honours DANE/TLSA, signs with DKIM, publishes SPF/DMARC, enables DNSSEC on managed domains, and strips personal IP addresses from outbound headers. 2FA is available and can be admin-mandated. Buyers still need their own OpenPGP setup for end-to-end content secrecy with external parties.
25 GB mailboxes with per-user encrypted backups
Each mailbox includes a stated 25 GB quota covering mail, calendar, and contacts. Nightly backups use individually generated keys; Soverin states that emptying trash permanently deletes data and that leaving the service removes backups when the key is destroyed. Extra mailboxes can share storage for small teams.
Multi-mailbox and channel-friendly business use
Purchase and assign additional mailboxes on a domain, with admin tooling for teams. Soverin markets to hosters, ISPs, MSPs, and independent professionals for multi-mailbox and white-label scenarios—useful when you want Dutch-operated email without building your own mail stack.

Assurance & compliance: Mailfence vs Soverin
Assurance & compliance	Mailfence	Soverin
Independent security / no-logs audit	Not found No public third-party audit PDF found. Vendor mentions security specialists, bug bounty activity, and inspection openness—not a substitute for a published audit. Privacy policy documents operational metadata collection (not zero-logs).	Not found No public third-party no-logs or full security audit PDF located; privacy claims are first-party.
ISO 27001	Not found No Mailfence ISO 27001 certificate claim found on primary security/GDPR/company pages.	Vendor claimed Vendor states independently audited ISO 27001; certificates available on request via support@soverin.net. Not re-verified against a public registry entry in this pass.
SOC 2 / SOC 3	Not found	Not found No SOC 2/3 claim found on primary pages reviewed.
GDPR / EU data protection	Vendor claimed Belgian controller/processor materials; dedicated GDPR page and technical/organisational measures overview. Confirm roles in your DPA.	Vendor claimed NL entity; AVG-framed privacy statement; EU-only processing claimed; GDPR Proof messaging on recognitions page.
US CLOUD Act exposure (indicative)	Partial EU entity (ContactOffice Group sa), no known US parent; servers claimed self-operated in Belgium without named US hyperscaler hosts. No formal public subprocessor inventory; payment processors not named. Assessment residual: partial transparency on data path. Not legal advice.	Partial EuropeanStack assessment: low exposure path—Dutch Soverin B.V., Dutch The Sharing Group owner, claimed self-operated NL hosting without public AWS/GCP/Azure mailbox hosts. Partial because residual subprocessors (support partner jurisdiction, domain partners, HIBP hash checks) need buyer confirmation. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Downloadable DPA linked from the GDPR page for organisational customers.	Vendor claimed Privacy statement states it qualifies as an Article 28 AVG processing agreement; other DPAs expressly rejected. Confirm signed annex for enterprise use.
EU AI Act	Not applicable Email/collaboration suite; not an AI system under typical procurement framing.	Not applicable Email hosting product; vendor emphasises no AI scanning/mining of mailbox content for ads.
ISO 9001 / ISO 14001	Not listed	Vendor claimed Vendor-claimed quality and environmental certifications; certificates on request.
NIS2 readiness	Not listed	Vendor claimed Vendor markets NIS2 Ready; buyer press also asserts NIS2 compliance—confirm evidence package.
NEN 7510 (healthcare NL)	Not listed	Partial Vendor states NEN 7510 certification is in progress, not completed.

Considerations & known limitations: Mailfence vs Soverin
Considerations & known limitations	Mailfence	Soverin
No public independent security audit	Medium If vendor risk requires a published audit letter, ISO 27001, or SOC 2, treat Mailfence as incomplete until evidence is obtained offline or under NDA.	Not listed
Closed-source SaaS	Medium Cannot independently review server code or default-self-host like some FOSS mail stacks. Business on-prem license is a commercial path, not community self-host docs.	Not listed
E2EE is opt-in OpenPGP, not automatic	Medium Clear-text messages are operator-readable at rest. Users must encrypt/sign deliberately; training and policy matter for regulated content.	Not listed
Operational metadata retention	Low Privacy policy lists IP, message-IDs, addresses, subjects, and related fields for operations, abuse control, and legal process—not a zero-logs design.	Not listed
Limited public subprocessor inventory	Low Strong first-party claims of internal hosting, but no AWS-style public subprocessor table; confirm payment and support tooling in procurement.	Not listed
US CLOUD Act (indicative)	Low No known US parent; Belgian self-operated hosting narrative. Residual unknown payment/SaaS paths. Not a legal safe harbour guarantee.	Not listed
Not zero-knowledge E2EE by default	Not listed	Medium Unlike Proton/Tuta, Soverin is a classic IMAP host. Provider infrastructure can process content for delivery and spam filtering. Practical impact: unsuitable as a drop-in for policies that require provider-blind encryption without extra client crypto.
Unnamed external support partner	Not listed	Medium Privacy statement discloses a first-line support partner with limited account data under DPA/NDA, but does not publish the partner name or country. Practical impact: add an open diligence item for any regulated workload.
ISO certificates not self-serve public	Not listed	Low ISO 27001/9001/14001 are claimed with certificates via support rather than a public PDF registry link found in research. Practical impact: procurement should request current attestations before treating certs as verified.
2025 group acquisition	Not listed	Low The Sharing Group acquisition may change subprocessors, tooling, or brand packaging over time even if continuity is promised. Practical impact: re-check DPA and hosting annex annually.
Email-centric support	Not listed	Low Public materials emphasise human Dutch-team email support; TechRadar notes no live chat or phone. Practical impact: large orgs needing 24/7 phone SLAs may find coverage thin.

Fit

Mailfence

Best fit when

You need OpenPGP interoperability and digital signatures from a European webmail, not only proprietary E2EE
Belgian legal entity and self-described self-operated Belgian hosting are procurement requirements
Teams want mail plus calendar/documents/groups without moving to Microsoft 365 or Google Workspace
You need custom domains, aliases, and classic clients (IMAP/POP/ActiveSync) on paid tiers
Business buyers evaluating private-label, API provisioning, SSO/directory integration, or large-scale on-prem license

Poor fit when

Security policy requires a published independent security audit, ISO 27001, or SOC 2 from the email vendor
You want fully open-source server/client stacks you can fork and self-host as default
Every message must be automatically E2EE with no OpenPGP key UX (Tuta-style)
You need Microsoft-class DLP, eDiscovery, compliance archives, and deep SaaS integrations
Zero-logs marketing is a hard requirement (Mailfence documents operational metadata collection)

Consider instead when

When: You want automatic encryption for all messages with minimal key management
Consider: Tuta
Different crypto model; less OpenPGP interop emphasis than Mailfence.
When: You want a larger Swiss privacy suite brand and ecosystem apps
Consider: Proton Mail
Trade Belgian ContactOffice ownership and PGP-centric UX for Proton’s broader product family.
When: You want a lean German ad-free mailbox without suite features
Consider: Posteo or mailbox.org
Simpler mailbox posture; different admin/domain/crypto tradeoffs.
When: You need full Google/Microsoft productivity and compliance tooling
Consider: Microsoft 365 or Google Workspace (accept US-cloud risk) or EU office suites if residency is the driver
Mailfence is not a drop-in M365 replacement.

Soverin

Best fit when

Individuals and freelancers who want a paid European mailbox on their own domain with any standard mail client
SMEs needing several mailboxes, aliases, and CalDAV/CardDAV without adopting Google Workspace or Microsoft 365
Teams prioritising Dutch jurisdiction and claimed no-hyperscaler hosting over zero-knowledge E2EE
Hosters/ISPs/MSPs evaluating white-label or multi-mailbox Dutch email
Buyers who value DANE, DKIM/DMARC, DNSSEC, and IP-header stripping on an open-standards stack

Poor fit when

Organisations that require default zero-access / E2EE mail against the provider (use Proton Mail or Tuta)
Users seeking a free tier, anonymous cash-only signup, or purely self-hosted open-source mail servers
Enterprises needing SSO, eDiscovery archives, phone support SLAs, or a full office suite in one vendor
Workloads that depend on US-region mailbox hosting or hyperscale global PoPs

Consider instead when

When: You need zero-knowledge E2EE and a privacy-first mobile/web ecosystem
Consider: Proton Mail or Tuta
Trade open IMAP convenience for stronger default content secrecy vs the provider.
When: You want German-hosted paid mail with broader office-style add-ons
Consider: mailbox.org or Posteo
Compare storage, admin features, and payment anonymity (Posteo) against Soverin’s domain/alias model.
When: You need Google- or Microsoft-class collaboration and global free consumer mail
Consider: Gmail or Microsoft 365 / Outlook.com
Different risk and advertising model; not EU-sovereignty substitutes.

Open questions for due diligence

Mailfence

Will Mailfence provide a current written subprocessor list (including payment processors and any backup locations) for a company account?
Is any independent security assessment available under NDA for regulated buyers?
For Business on-prem license: exact minimum scale, support model, update cadence, and cryptographic feature parity vs SaaS?
Which plan tiers currently include IMAP/POP/ActiveSync and custom-domain limits for our user count?
How are disaster-recovery backup sites jurisdictions documented in the signed DPA annex?

Soverin

What is the legal name and country of the first-line support partner, and is a current subprocessor list available under NDA?
Can Soverin provide the latest ISO 27001/9001/14001 certificates and scope statements without delay?
After The Sharing Group acquisition, are any new group companies (e.g. Mijndomein, Greenhost, Leafcloud tooling) in the mailbox data path?
Is NEN 7510 certification complete for healthcare use cases, or still in progress?
Which domain registrar(s) handle customer DNSSEC, and where are registry data stored?