Mailo vs Runbox

Compare Mailo and Runbox on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Outlook.com

Mailo

France· Email Services

Needs review

Shortlist Mailo when you want French-entity freemium webmail with classic IMAP/EAS clients, integrated calendar/cloud, supervised Mailo Junior for kids, or Pro custom domains for SMEs—without US Big Tech accounts. Skip when you need default zero-knowledge E2EE, open-source/self-host, or a full Workspace-class suite; consider Tuta, Proton Mail, or Infomaniak kMail instead.

France-hosted (claimed)Freemium webmailMailo JuniorIMAP / ActiveSyncPro custom domainsOptional PGP (server-side)

View listing Visit Website

Runbox

Norway· Email Services

Needs review

Shortlist Runbox when you need Norwegian/EEA-hosted IMAP email with custom domains, ad-free subscription economics, and standard clients. Skip when you require default zero-access E2EE—consider Proton Mail or Tuta instead—or when you need a full Microsoft 365-style suite.

Norwegian email hostingIMAP / POP / SMTPCustom domains100% renewable (claimed)Runbox 7 open sourceOptional PGP / S/MIME

View listing Visit Website

Highlighted rows differ between the two products.

Mailo vs Runbox: Snapshot
Feature	Mailo	Runbox
Country of origin	France	Norway
Category	Email Services	Email Services
Open source	No	Yes
Self-hosted	No	No
Headquarters	France	Norway
Legal entity	MAILO SAS (capital €75,000; RCS Créteil 851585547; VAT FR44851585547)	Runbox Solutions AS
Governing law	French law (terms of use)	Norwegian law; Personal Data Act implementing GDPR (EEA)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Vendor states user personal data and content are stored/processed on servers in France; specialised French host centre (who-we-are); website hosted by Ecritel, Arradon, France. Named third parties: Verifone/Paybox (payment email), PayPal option, Gandi/Netim (domains), Sirdata + ad agencies (free-tier ads), optional Rainbow video and OnlyOffice. Full mail DC/backup subprocessor list not published.	Core email and account content: servers in Oslo (StackInfra) under Norwegian jurisdiction; systems management Copyleft Solutions AS (Norway). Optional third parties per privacy policy: Stripe, PayPal, Coinbase (US payments); Enom (US domains); Gandi (FR); Domeneshop (NO); JaguarPC (US default web hosting, Norway option); NodePing (US, status page). No known US parent.
Summary	French freemium webmail and Mail&Cloud suite (MAILO SAS): email, calendar, cloud disk, Mailo Junior for children, and Pro custom domains—hosted in France, proprietary SaaS.	Norwegian subscription email hosting from Runbox Solutions AS: Oslo-hosted IMAP mailboxes, custom domains, CalDAV/CardDAV, and optional PGP. Ad-free; not default zero-access.
Tags	privacy freemium saas family french webmail productivity	privacy email-hosting gdpr norway renewable-energy open-source-webmail

At a glance: Mailo vs Runbox
At a glance	Mailo	Runbox
HQ / entity	MAILO SAS, France (RCS Créteil 851585547)	Not listed
Hosting (claimed)	Servers in France; website host Ecritel (FR)	Not listed
Model	Freemium SaaS (Free / Premium / Pro / Junior / Edu)	Not listed
Open source	No (proprietary MailObject®)	Partial (Runbox 7 web app); not self-hosted
Self-host	No	Not listed
Encryption default	TLS + optional server-side PGP (not ZK E2EE)	Not listed
HQ	Not listed	Oslo, Norway
Legal entity	Not listed	Runbox Solutions AS (orgnr 996877027)
Founded	Not listed	Service since 2000; current AS form 2011
Hosting	Not listed	Email: StackInfra Oslo; optional web hosting may default US
Commercial model	Not listed	Paid subscription + trial (no permanent free tier)

Key capabilities: Mailo vs Runbox
Key capabilities	Mailo	Runbox
France-hosted (claimed)	Yes	Not listed
Freemium webmail	Yes	Not listed
Mailo Junior	Yes	Not listed
IMAP / ActiveSync	Yes	Not listed
Pro custom domains	Yes	Not listed
Optional PGP (server-side)	Yes	Yes
Norwegian email hosting	Not listed	Yes
IMAP / POP / SMTP	Not listed	Yes
Custom domains	Not listed	Yes
100% renewable (claimed)	Not listed	Yes
Runbox 7 open source	Not listed	Yes

Mailo

French-hosted webmail with IMAP, EAS, and classic protocols
Webmail plus IMAP4 for clients, Exchange ActiveSync for mobile sync, and POP3 on paid tiers; SMTP relay with account credentials. Vendor states mail and content stay on servers in France. Free tier is ad-supported with lower quotas; Premium unlocks POP3, more aliases, and larger mail/cloud caps. Suits teams that need standard desktop/mobile clients rather than a closed proprietary app only.
Mailo Junior supervised email for children
Child accounts (about ages 6–14) only exchange mail with contacts a parent or teacher validates. Age-adapted mini/junior UIs, no ads on Junior, optional promotion to a standard account while keeping the address. Separate Junior mobile apps. Unique fit for families and schools versus generic consumer mail.
Calendar, virtual disk, and open sync protocols
Shared calendars and tasks, address book, photo albums, and a virtual disk for files with WebDAV/FTP access. CalDAV and CardDAV for external clients. Premium+ can unlock OnlyOffice in-browser editing. Better as an all-in-one Mail&Cloud for SMEs/families than bare IMAP-only privacy mail.
Mailo Pro spaces: custom domains and mutualised storage
Pro Start/5/Modulo style plans share mail+cloud quota across accounts, support custom domains (register, transfer, or declare external), distribution lists, mailbox sharing, resource calendars, and manager tooling. Priority Pro hotline with documented acknowledgement and restoration targets for Pro subscriptions. Aimed at TPE/PME, associations, and municipalities—not a full Google Workspace clone.
Optional server-side PGP and account security controls
Built-in PGP/MIME encrypt and sign in the webmail as a trusted third party (keys managed on Mailo for multi-device convenience). Two-factor authentication, application passwords, connection history, and guardianship-style access options. Not zero-knowledge E2EE by default—use external client crypto if the provider must never hold keys.

Runbox

Norwegian-hosted IMAP email with full-disk encryption
Mailboxes live on servers Runbox places in a StackInfra facility in Oslo under Norwegian jurisdiction, with full-disk encryption at rest and TLS (including PFS) in transit. Access via IMAP, POP, SMTP, or Runbox 7 webmail suits teams that need standard clients rather than a proprietary-only app.
Custom domains, aliases, and multi-account admin
Host mail on your own domain, manage sub-accounts from a main account, and use many aliases on Runbox domains plus unlimited aliases on customer domains. Plus-addressing and filters help separate identities without running separate mailboxes.
CalDAV/CardDAV plus optional PGP or S/MIME
Integrated calendar and contacts sync over CalDAV and CardDAV with common desktop and mobile apps. End-to-end confidentiality is user-controlled via PGP or S/MIME—not zero-access by default—so operators can still index mail for search and scan for malware.
Ad-free, subscription-funded privacy model
Runbox states it does not show ads, does not use third-party trackers such as Google Analytics, and only scans messages for spam/virus protection—not advertising. Revenue is subscription-based with a public trial period, aligning incentives away from data-mining free mail.
Runbox 7 open-source webmail on hydropowered infra
The Runbox 7 web client is published on GitHub for inspection; the hosted server stack remains largely proprietary. Email infrastructure is advertised as 100% certified renewable electricity in Norway, with additional company offset claims—useful for sustainability procurement checklists.

Assurance & compliance: Mailo vs Runbox
Assurance & compliance	Mailo	Runbox
Independent security / no-logs audit	Not found Charter claims no commercial reading of messages; automated AV/spam scanning on servers. No public third-party audit PDF found.	Not found Vendor claims minimal logging and short retention windows; no public independent audit report found
ISO 27001	Not found No ISO 27001 claim found on legal/security/primary pages researched.	Not found No Runbox ISO 27001 certificate found on primary pages (power supplier ISO 14001 is environmental, not info-sec)
SOC 2 / SOC 3	Not found No SOC 2/3 report referenced on public product pages.	Not found No public SOC 2/3 report located
GDPR / EU data protection	Vendor claimed French controller; privacy rules cite GDPR and French correspondence secrecy; DPO at dpo@mailo.com; France storage claim.	Vendor claimed Norwegian entity; Personal Data Act implements GDPR; appointed DPO; privacy policy documents rights and retention
US CLOUD Act exposure (indicative)	Partial EU entity / no known US parent / France-claimed mail hosting, but Verifone and PayPal (US-group) on payment path; full infra subprocessors unpublished. Assessment only—not legal advice.	Partial No known US parent; core email in Norway. Medium/partial because privacy policy lists US third parties (Stripe, PayPal, Coinbase, Enom, JaguarPC web hosting default, NodePing). Not legal advice.
Data processing agreement (B2B)	Not found Privacy rules and terms cover processing; no standalone public B2B DPA download found—request via DPO or Pro channel.	Not found Processor DPA with Copyleft is mentioned; no public customer-facing B2B DPA template found—ask sales/support
EU AI Act	Not applicable Traditional email/cloud suite; not marketed as an AI system product.	Not applicable Email hosting product; vendor states no intrusive AI for ad profiling

Considerations & known limitations: Mailo vs Runbox
Considerations & known limitations	Mailo	Runbox
PGP is server-side trusted third party	Medium Webmail PGP holds keys on Mailo for multi-device use. Provider-access risk differs from zero-knowledge E2EE defaults at Tuta/Proton. Use external crypto if that is a hard requirement.	Not listed
Incomplete public subprocessor inventory	Medium Privacy rules name payments, domains, and free-tier ads, but not a full list of mail storage, backup, or anti-spam infrastructure vendors. Request annex for B2B risk review.	Not listed
US-group payment processors	Low Checkout shares email with Verifone/Paybox; PayPal is also offered. Limited to billing path per privacy rules, but relevant to CLOUD Act diligence.	Not listed
Free tier third-party advertising	Low Mailo Free shows ad banners via agencies under IAB TCF consent (Sirdata CMP). Premium removes ads. Ad cookies stated as not tied to Mailo profile.	Not listed
No public ISO/SOC or independent security audit	Medium Security posture relies on first-party statements and internal measures. Procurement teams may need questionnaires or NDA evidence.	Medium Assurance relies on vendor policy, Norwegian law, and facility claims. Regulated buyers may need NDA evidence or on-site questionnaire.
Free accounts deleted after inactivity	Low Mailo Free unused for 365 days can be deleted with content loss. Premium/Pro have different retention rules—plan backups and renewals.	Not listed
Not default zero-access encryption	Not listed	Medium Unlike Proton/Tuta, Runbox can access stored mail for spam/virus scanning, indexing, and lawful process. Use PGP/S/MIME when E2EE is required.
US vendors on optional product paths	Not listed	Medium Payments (Stripe/PayPal/Coinbase), domain registrar Enom, and default JaguarPC web hosting introduce US processors. Keep web hosting in Norway and minimize US payment data if policy requires.
Partial open source only	Not listed	Low Runbox 7 webmail is open source; mail backend is proprietary SaaS—no self-host path.
Post-closure and backup retention	Not listed	Low Privacy policy defines multi-month content retention and backup windows after closure (and longer account-info retention for bookkeeping). Request immediate deletion if policy requires faster wipe.

Fit

Mailo

Best fit when

EU individuals and families wanting French-hosted mail with calendar and cloud disk in one account
Parents/schools needing supervised child email (Mailo Junior) with contact allow-lists
French SMEs, associations, and municipalities needing custom domains and mutualised Pro storage
Teams that depend on IMAP, EAS, CalDAV, CardDAV, or WebDAV rather than a locked-in app
Buyers who accept freemium ads on free tier or low-cost Premium rather than pure prepaid anonymity mail

Poor fit when

Orgs that require default end-to-end encryption with zero-access provider architecture
Buyers that need open-source server code or official self-hosting
Enterprises needing SOC 2 / ISO 27001 evidence already published on a trust centre
Heavy Google Workspace / Microsoft 365 collaboration suites (docs/drive ecosystem depth)

Consider instead when

When: You need zero-knowledge / default E2EE webmail
Consider: Tuta or Proton Mail
Mailo PGP is optional and server-side trusted third party
When: You want German privacy mail with different encryption/product posture
Consider: Posteo or mailbox.org
Compare protocols, storage bundles, and business features side by side
When: You need Swiss multi-product cloud with mail plus broader suite
Consider: Infomaniak kMail
Different country stack and product breadth
When: You need US Big Tech ecosystem integration at any cost
Consider: Gmail or Microsoft 365 / Outlook.com
Trade EU entity and France residency claims for ecosystem depth

Runbox

Best fit when

Teams that want Oslo-hosted mailboxes under Runbox Solutions AS and Norwegian law, with full IMAP client freedom
Organizations needing custom domains, multi-account admin, and generous alias patterns without self-hosting an MTA
Buyers who prioritize subscription-funded, ad-free email over free ad-supported Gmail/Outlook tiers
Procurement that values renewable-energy data-center claims and Ethical Consumer Best Buy style ESG signals
Users comfortable managing optional PGP/S/MIME when message-level E2EE is needed for specific threads

Poor fit when

Requirements for default zero-access encryption where the provider cannot read mailbox content (prefer Proton Mail or Tuta)
Need for a fully self-hosted or fully open-source mail server stack
Heavy dependence on Microsoft 365 collaboration (Teams, SharePoint, advanced Exchange) rather than plain email hosting
Mandatory public ISO 27001 or SOC 2 evidence before shortlist—none found on public Runbox pages in this research pass
Optional product paths (default US web hosting via JaguarPC) when a strict no-US-vendor rule covers every SKU

Consider instead when

When: You need default end-to-end / zero-access encryption for all messages
Consider: Proton Mail or Tuta
Runbox uses optional PGP/S/MIME; operator can access stored mail for filtering and lawful process
When: You want a German privacy-oriented host with similar sustainability positioning
Consider: Posteo
Compare jurisdiction (DE vs NO), domain limits, and feature depth
When: You need Belgian email with integrated collaboration extras
Consider: Mailfence
Different encryption defaults and product scope
When: You need global free-tier convenience and suite lock-in
Consider: Gmail or Outlook.com / Microsoft 365
Accept US jurisdiction and ad/suite economics tradeoffs

Open questions for due diligence

Mailo

Will Mailo sign a GDPR Article 28 DPA with a full subprocessor and transfer annex for Pro customers?
What is the named primary data-centre operator and backup/DR location beyond the France and Ecritel website-host statements?
Is there an independent penetration test, ISO 27001 roadmap, or customer-available security whitepaper?
Where is Rainbow (video) and OnlyOffice data processed relative to the France mail claim?
Current UGAP / public procurement listing status for French public buyers?

Runbox

Will Runbox sign a customer-facing B2B DPA listing all subprocessors for your tenant configuration?
Can optional web hosting and domain registration be restricted to EEA-only providers for your account?
Is any independent penetration test or SOC/ISO report available under NDA?
What is the current employee ownership share and any non-EU shareholding since the 2018 figure on the About page?
Confirm backup geography (privacy policy: secure servers separate from main system—are they also Norway-only?)