Migadu vs Runbox

Compare Migadu and Runbox on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail

Migadu

Switzerland· Email Services

Needs review

Shortlist Migadu when you need Swiss-operated, standards IMAP/SMTP hosting with unlimited addresses across many domains under flat account quotas—especially agencies and multi-domain SMEs. Skip when you need provider E2EE defaults, contractual SLA on the default offer, mailbox 2FA, or bulk/transactional sending; consider Proton Mail/Tuta for E2EE, or mailbox.org/Mailfence/Posteo/Runbox for other European professional-mail tradeoffs.

Swiss operatorUsage-priced multi-domainSMTP/IMAP/POP3Mail hosted in FranceMulti-admin + APINo ads / no tracking

View listing Visit Website

Runbox

Norway· Email Services

Needs review

Shortlist Runbox when you need Norwegian/EEA-hosted IMAP email with custom domains, ad-free subscription economics, and standard clients. Skip when you require default zero-access E2EE—consider Proton Mail or Tuta instead—or when you need a full Microsoft 365-style suite.

Norwegian email hostingIMAP / POP / SMTPCustom domains100% renewable (claimed)Runbox 7 open sourceOptional PGP / S/MIME

View listing Visit Website

Highlighted rows differ between the two products.

Migadu vs Runbox: Snapshot
Feature	Migadu	Runbox
Country of origin	Switzerland	Norway
Category	Email Services	Email Services
Open source	No	Yes
Self-hosted	No	No
Headquarters	Switzerland	Norway
Legal entity	Migadu-Mail GmbH	Runbox Solutions AS
Governing law	Canton of Appenzell Ausserrhoden, Swiss Confederation (terms)	Norwegian law; Personal Data Act implementing GDPR (EEA)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Mail servers stated in France (EU). Payment subprocessors Stripe and PayPal (US) for billing data. Full mail infrastructure/backup subprocessor list not published by name on primary pages.	Core email and account content: servers in Oslo (StackInfra) under Norwegian jurisdiction; systems management Copyleft Solutions AS (Norway). Optional third parties per privacy policy: Stripe, PayPal, Coinbase (US payments); Enom (US domains); Gandi (FR); Domeneshop (NO); JaguarPC (US default web hosting, Norway option); NodePing (US, status page). No known US parent.
Summary	Swiss-operated, standards-based email hosting for custom domains: unlimited addresses and multi-domain accounts priced by usage quotas, not per mailbox.	Norwegian subscription email hosting from Runbox Solutions AS: Oslo-hosted IMAP mailboxes, custom domains, CalDAV/CardDAV, and optional PGP. Ad-free; not default zero-access.
Tags	privacy email-hosting saas api standards-based multi-domain	privacy email-hosting gdpr norway renewable-energy open-source-webmail

At a glance: Migadu vs Runbox
At a glance	Migadu	Runbox
HQ / entity	Migadu-Mail GmbH, Switzerland	Not listed
Founded	2014 (vendor About)	Service since 2000; current AS form 2011
Mail hosting	Data centers in France (vendor Pro/Cons)	Not listed
Commercial model	Flat per-account plans by daily message quotas + soft storage	Paid subscription + trial (no permanent free tier)
Open source product?	No — built on open-source stack; service is proprietary SaaS	Not listed
Self-host	No	Not listed
Ownership	Bootstrapped; no outside capital (vendor claim)	Not listed
HQ	Not listed	Oslo, Norway
Legal entity	Not listed	Runbox Solutions AS (orgnr 996877027)
Hosting	Not listed	Email: StackInfra Oslo; optional web hosting may default US
Open source	Not listed	Partial (Runbox 7 web app); not self-hosted

Key capabilities: Migadu vs Runbox
Key capabilities	Migadu	Runbox
Swiss operator	Yes	Not listed
Usage-priced multi-domain	Yes	Not listed
SMTP/IMAP/POP3	Yes	Not listed
Mail hosted in France	Yes	Not listed
Multi-admin + API	Yes	Not listed
No ads / no tracking	Yes	Not listed
Norwegian email hosting	Not listed	Yes
IMAP / POP / SMTP	Not listed	Yes
Custom domains	Not listed	Yes
100% renewable (claimed)	Not listed	Yes
Runbox 7 open source	Not listed	Yes
Optional PGP / S/MIME	Not listed	Yes

Migadu

Usage-metered accounts with unlimited addresses
Plans are flat per Migadu account. Within daily in/out quotas and soft storage guidance, create large numbers of mailboxes and host many domains without per-address fees—useful for agencies and multi-project teams. Soft storage does not hard-bounce mail; sustained over-quota use can force upgrades or limits.
Standards SMTP, IMAP4, POP3, and webmail
No proprietary client protocol. Connect Thunderbird, Apple Mail, Outlook, mutt, and others over TLS (typical endpoints imap.migadu.com:993, smtp.migadu.com:465, pop.migadu.com:995). ManageSieve filtering, aliases, pattern rewrites, identities, footers, auto-responders, and optional catch-alls cover classic postmaster needs. Data remains portable via standard protocols.
Multi-domain admin, multi-admin, and beta API
Agencies can hold many client domains under one roof, open multiple administrators (domain-scoped on higher plans), set per-domain/mailbox limits, and monitor traffic. A REST API (documented as early beta) manages domains, mailboxes, identities, forwardings, aliases, and rewrites for automation. Domain deletion stays UI-only as a safety measure.
DNS helpers and postmaster-style support
Optional built-in DNS ships mail records preconfigured; Migadu also offers DNS setup help at no extra fee and publishes diagnostics/activation flows. Support is ticket-based from people who operate the mail stack—not outsourced chat—with plan-dependent urgency outside office hours.
No ads, no product analytics cookies
Vendor policy states no advertising, no tracking of mailbox content for ads, and no website analytics cookies beyond session needs. Processing is framed for service delivery, abuse prevention, and legal obligations. Payment data still goes to Stripe and PayPal under separate processor terms.

Runbox

Norwegian-hosted IMAP email with full-disk encryption
Mailboxes live on servers Runbox places in a StackInfra facility in Oslo under Norwegian jurisdiction, with full-disk encryption at rest and TLS (including PFS) in transit. Access via IMAP, POP, SMTP, or Runbox 7 webmail suits teams that need standard clients rather than a proprietary-only app.
Custom domains, aliases, and multi-account admin
Host mail on your own domain, manage sub-accounts from a main account, and use many aliases on Runbox domains plus unlimited aliases on customer domains. Plus-addressing and filters help separate identities without running separate mailboxes.
CalDAV/CardDAV plus optional PGP or S/MIME
Integrated calendar and contacts sync over CalDAV and CardDAV with common desktop and mobile apps. End-to-end confidentiality is user-controlled via PGP or S/MIME—not zero-access by default—so operators can still index mail for search and scan for malware.
Ad-free, subscription-funded privacy model
Runbox states it does not show ads, does not use third-party trackers such as Google Analytics, and only scans messages for spam/virus protection—not advertising. Revenue is subscription-based with a public trial period, aligning incentives away from data-mining free mail.
Runbox 7 open-source webmail on hydropowered infra
The Runbox 7 web client is published on GitHub for inspection; the hosted server stack remains largely proprietary. Email infrastructure is advertised as 100% certified renewable electricity in Norway, with additional company offset claims—useful for sustainability procurement checklists.

Assurance & compliance: Migadu vs Runbox
Assurance & compliance	Migadu	Runbox
Independent security / no-logs audit	Not found Vendor claims no ad scanning/sharing of mail content; no public third-party audit PDF located.	Not found Vendor claims minimal logging and short retention windows; no public independent audit report found
ISO 27001	Not found Data centers described as internationally certified; no Migadu-organization ISO 27001 certificate found on primary pages.	Not found No Runbox ISO 27001 certificate found on primary pages (power supplier ISO 14001 is environmental, not info-sec)
SOC 2 / SOC 3	Not found	Not found No public SOC 2/3 report located
GDPR / EU data protection	Vendor claimed Privacy policy asserts GDPR and Swiss DPA compliance; mail hosted in France per vendor.	Vendor claimed Norwegian entity; Personal Data Act implements GDPR; appointed DPO; privacy policy documents rights and retention
US CLOUD Act exposure (indicative)	Partial Swiss entity, no known US parent, mail in France; Stripe and PayPal process payments with US transfers. Infrastructure subprocessors not fully named. EuropeanStack assessment—not a vendor certification. Not legal advice.	Partial No known US parent; core email in Norway. Medium/partial because privacy policy lists US third parties (Stripe, PayPal, Coinbase, Enom, JaguarPC web hosting default, NodePing). Not legal advice.
Data processing agreement (B2B)	Vendor claimed Privacy page states it serves as privacy policy and DPA; confirm suitability with counsel.	Not found Processor DPA with Copyleft is mentioned; no public customer-facing B2B DPA template found—ask sales/support
EU AI Act	Not applicable Email hosting product; not an AI system offering.	Not applicable Email hosting product; vendor states no intrusive AI for ad profiling

Considerations & known limitations: Migadu vs Runbox
Considerations & known limitations	Migadu	Runbox
US payment subprocessors (Stripe, PayPal)	Medium Billing-related personal data can transfer to US processors under Migadu’s privacy policy. Mail content path is France/EU per vendor, but payment data is a separate CLOUD Act / transfer surface.	Not listed
Incomplete public infrastructure subprocessor list	Medium Primary pages name France hosting and certified DCs without a full vendor inventory for compute, storage, and backups. Procurement should request the current list and regions in writing.	Not listed
No E2EE product default; no classic mailbox 2FA	Medium Standards mail with TLS; vendor recommends user-side OpenPGP for strong content secrecy. IMAP 2FA is not offered; app-specific-style identities are not second-factor MFA.	Not listed
Daily quotas and human-mail policy	Medium Account-wide daily in/out caps and anti-bulk rules make Migadu unsuitable as a transactional/marketing ESP. Over-limit mail can be deferred or rejected after tolerance.	Not listed
No default SLA on standard plans	Low Vendor states standard offers lack SLAs; email is treated as asynchronous and occasionally disrupted. Enterprise SLA only via separate commercial discussion.	Not listed
No public independent security audit	Medium Privacy and no-ad-scanning claims are first-party. No independent audit report found for no-logs or security controls.	Not listed
Not default zero-access encryption	Not listed	Medium Unlike Proton/Tuta, Runbox can access stored mail for spam/virus scanning, indexing, and lawful process. Use PGP/S/MIME when E2EE is required.
US vendors on optional product paths	Not listed	Medium Payments (Stripe/PayPal/Coinbase), domain registrar Enom, and default JaguarPC web hosting introduce US processors. Keep web hosting in Norway and minimize US payment data if policy requires.
No public ISO 27001 / SOC 2 / independent audit	Not listed	Medium Assurance relies on vendor policy, Norwegian law, and facility claims. Regulated buyers may need NDA evidence or on-site questionnaire.
Partial open source only	Not listed	Low Runbox 7 webmail is open source; mail backend is proprietary SaaS—no self-host path.
Post-closure and backup retention	Not listed	Low Privacy policy defines multi-month content retention and backup windows after closure (and longer account-info retention for bookkeeping). Request immediate deletion if policy requires faster wipe.

Fit

Migadu

Best fit when

Agencies and freelancers hosting many client domains under one account with multi-admin or API provisioning
Organizations that want custom-domain mail with standard clients and portable IMAP—not a proprietary suite lock-in
Teams tired of per-seat pricing for large address spaces with modest real traffic
Buyers who value a small bootstrapped Swiss operator that publishes blunt product limits
Setups that need aliases, rewrites, identities, SIEVE, and postmaster-style controls more than collab apps

Poor fit when

Primary need is end-to-end encrypted mail by default (Proton Mail, Tuta, or user-side OpenPGP workflows)
High-volume transactional, marketing, or bulk outbound mail
Requirement for default contractual SLA, phone support, or multi-language admin UI
Mandatory mailbox 2FA on every IMAP login
Want a free long-term plan or Migadu-branded @provider addresses without owning a domain

Consider instead when

When: You need provider-managed end-to-end encryption as the default product promise
Consider: Proton Mail or Tuta
Migadu is standards hosting with TLS; content secrecy against the operator is not the design center.
When: You want another European professional host with a different admin/encryption/residency package
Consider: mailbox.org, Mailfence, Posteo, or Runbox
Compare DPA detail, audit packaging, and whether multi-domain usage pricing still wins for your address sprawl.
When: You need full workspace suite (docs, meet, identity) rather than email hosting alone
Consider: Google Workspace, Microsoft 365, or Infomaniak-style European suites
Migadu deliberately stays postmaster-focused.
When: You need bulk or high-rate application email
Consider: A dedicated ESP (not Migadu); Amazon SES is the common Big Tech baseline—pair with EU ESPs if residency matters
Migadu rate-limits and bans intentional bulk use.

Runbox

Best fit when

Teams that want Oslo-hosted mailboxes under Runbox Solutions AS and Norwegian law, with full IMAP client freedom
Organizations needing custom domains, multi-account admin, and generous alias patterns without self-hosting an MTA
Buyers who prioritize subscription-funded, ad-free email over free ad-supported Gmail/Outlook tiers
Procurement that values renewable-energy data-center claims and Ethical Consumer Best Buy style ESG signals
Users comfortable managing optional PGP/S/MIME when message-level E2EE is needed for specific threads

Poor fit when

Requirements for default zero-access encryption where the provider cannot read mailbox content (prefer Proton Mail or Tuta)
Need for a fully self-hosted or fully open-source mail server stack
Heavy dependence on Microsoft 365 collaboration (Teams, SharePoint, advanced Exchange) rather than plain email hosting
Mandatory public ISO 27001 or SOC 2 evidence before shortlist—none found on public Runbox pages in this research pass
Optional product paths (default US web hosting via JaguarPC) when a strict no-US-vendor rule covers every SKU

Consider instead when

When: You need default end-to-end / zero-access encryption for all messages
Consider: Proton Mail or Tuta
Runbox uses optional PGP/S/MIME; operator can access stored mail for filtering and lawful process
When: You want a German privacy-oriented host with similar sustainability positioning
Consider: Posteo
Compare jurisdiction (DE vs NO), domain limits, and feature depth
When: You need Belgian email with integrated collaboration extras
Consider: Mailfence
Different encryption defaults and product scope
When: You need global free-tier convenience and suite lock-in
Consider: Gmail or Outlook.com / Microsoft 365
Accept US jurisdiction and ad/suite economics tradeoffs

Open questions for due diligence

Migadu

What are the current named mail hosting, backup, and ancillary subprocessors and their countries?
Can Migadu provide ISO/SOC evidence for the organization or only DC-level certifications?
Is an independent security or penetration-test summary available under NDA?
Does the privacy-page DPA meet your controller’s mandatory clauses without a separate signed agreement?
What encryption-at-rest and key-management practices apply today versus the older public pro/con narrative?

Runbox

Will Runbox sign a customer-facing B2B DPA listing all subprocessors for your tenant configuration?
Can optional web hosting and domain registration be restricted to EEA-only providers for your account?
Is any independent penetration test or SOC/ISO report available under NDA?
What is the current employee ownership share and any non-EU shareholding since the 2018 figure on the About page?
Confirm backup geography (privacy policy: secure servers separate from main system—are they also Norway-only?)