Migadu vs Soverin

Compare Migadu and Soverin on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Microsoft 365

Migadu

Switzerland· Email Services

Needs review

Shortlist Migadu when you need Swiss-operated, standards IMAP/SMTP hosting with unlimited addresses across many domains under flat account quotas—especially agencies and multi-domain SMEs. Skip when you need provider E2EE defaults, contractual SLA on the default offer, mailbox 2FA, or bulk/transactional sending; consider Proton Mail/Tuta for E2EE, or mailbox.org/Mailfence/Posteo/Runbox for other European professional-mail tradeoffs.

Swiss operatorUsage-priced multi-domainSMTP/IMAP/POP3Mail hosted in FranceMulti-admin + APINo ads / no tracking

View listing Visit Website

Soverin

Netherlands· Email Services

Needs review

Shortlist Soverin when you want Dutch-operated, paid IMAP email with custom domains, unlimited aliases, and strong mail-auth standards without Google/Microsoft ads. Skip when you need zero-knowledge E2EE—consider Proton Mail or Tuta instead—or a full productivity suite (mailbox.org / Microsoft 365).

NL / EU operatedCustom domainsIMAP / CalDAVNo ads / no trackingISO 27001 (claimed)DANE / DNSSEC

View listing Visit Website

Highlighted rows differ between the two products.

Migadu vs Soverin: Snapshot
Feature	Migadu	Soverin
Country of origin	Switzerland	Netherlands
Category	Email Services	Email Services
Open source	No	No
Self-hosted	No	No
Headquarters	Switzerland	Netherlands
Legal entity	Migadu-Mail GmbH	Soverin B.V. (Amsterdam); owned by The Sharing Group / TSG Online (Dutch) as of September 2025 acquisition announcement
Governing law	Canton of Appenzell Ausserrhoden, Swiss Confederation (terms)	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Mail servers stated in France (EU). Payment subprocessors Stripe and PayPal (US) for billing data. Full mail infrastructure/backup subprocessor list not published by name on primary pages.	Vendor: EU-only processing; data in NL; self-operated Dutch DCs, no hyperscaler. TechRadar: 3 NL DCs. Core mail hosts on Soverin B.V. AS211993. External first-line support partner under DPA/NDA (country unpublished). HIBP k-anon password checks; Let’s Encrypt; domain DNSSEC partner. No AWS/GCP/Azure as primary mailbox hosts in public materials.
Summary	Swiss-operated, standards-based email hosting for custom domains: unlimited addresses and multi-domain accounts priced by usage quotas, not per mailbox.	Dutch privacy-first email hosting: custom domains, open IMAP/SMTP/CalDAV, 25 GB mailboxes, no ads or content scanning, servers operated in the Netherlands.
Tags	privacy saas api email-hosting standards-based multi-domain	privacy saas email gdpr netherlands custom-domain imap

At a glance: Migadu vs Soverin
At a glance	Migadu	Soverin
HQ / entity	Migadu-Mail GmbH, Switzerland	Not listed
Founded	2014 (vendor About)	Not listed
Mail hosting	Data centers in France (vendor Pro/Cons)	Not listed
Commercial model	Flat per-account plans by daily message quotas + soft storage	Annual prepaid; 30-day mailbox money-back; no free tier
Open source product?	No — built on open-source stack; service is proprietary SaaS	Not listed
Self-host	No	Not listed
Ownership	Bootstrapped; no outside capital (vendor claim)	Not listed
HQ	Not listed	Amsterdam, Netherlands (Soverin B.V.)
Group	Not listed	The Sharing Group / TSG Online (acq. Sep 2025)
Hosting	Not listed	Dutch data centres; vendor claims self-operated, no hyperscaler
Protocols	Not listed	IMAP, SMTP, CalDAV, CardDAV
Storage	Not listed	25 GB per mailbox (vendor-stated)
Self-host / OSS	Not listed	No / No

Key capabilities: Migadu vs Soverin
Key capabilities	Migadu	Soverin
Swiss operator	Yes	Not listed
Usage-priced multi-domain	Yes	Not listed
SMTP/IMAP/POP3	Yes	Not listed
Mail hosted in France	Yes	Not listed
Multi-admin + API	Yes	Not listed
No ads / no tracking	Yes	Yes
NL / EU operated	Not listed	Yes
Custom domains	Not listed	Yes
IMAP / CalDAV	Not listed	Yes
ISO 27001 (claimed)	Not listed	Yes
DANE / DNSSEC	Not listed	Yes

Migadu

Usage-metered accounts with unlimited addresses
Plans are flat per Migadu account. Within daily in/out quotas and soft storage guidance, create large numbers of mailboxes and host many domains without per-address fees—useful for agencies and multi-project teams. Soft storage does not hard-bounce mail; sustained over-quota use can force upgrades or limits.
Standards SMTP, IMAP4, POP3, and webmail
No proprietary client protocol. Connect Thunderbird, Apple Mail, Outlook, mutt, and others over TLS (typical endpoints imap.migadu.com:993, smtp.migadu.com:465, pop.migadu.com:995). ManageSieve filtering, aliases, pattern rewrites, identities, footers, auto-responders, and optional catch-alls cover classic postmaster needs. Data remains portable via standard protocols.
Multi-domain admin, multi-admin, and beta API
Agencies can hold many client domains under one roof, open multiple administrators (domain-scoped on higher plans), set per-domain/mailbox limits, and monitor traffic. A REST API (documented as early beta) manages domains, mailboxes, identities, forwardings, aliases, and rewrites for automation. Domain deletion stays UI-only as a safety measure.
DNS helpers and postmaster-style support
Optional built-in DNS ships mail records preconfigured; Migadu also offers DNS setup help at no extra fee and publishes diagnostics/activation flows. Support is ticket-based from people who operate the mail stack—not outsourced chat—with plan-dependent urgency outside office hours.
No ads, no product analytics cookies
Vendor policy states no advertising, no tracking of mailbox content for ads, and no website analytics cookies beyond session needs. Processing is framed for service delivery, abuse prevention, and legal obligations. Payment data still goes to Stripe and PayPal under separate processor terms.

Soverin

Custom domains with unlimited aliases
Host mail on your own domain (bring existing or register through Soverin). Unlimited aliases—plus-addressing or domain names—deliver into one mailbox, plus optional random @sinenomine.email private aliases that hide the real address. Suits freelancers and SMEs who need brandable addresses without per-alias fees.
Open IMAP/SMTP plus CalDAV/CardDAV
Use any standards-based client or device for mail, calendar, and contacts—no proprietary app required. Dashboard import helps migrate from other providers. Ideal when IT wants Thunderbird, Apple Mail, or Outlook without locking into a closed webmail ecosystem; not a zero-knowledge E2EE product by default.
Mail-path security: DANE, DKIM, DMARC, IP stripping
Outbound and inbound paths use TLS; Soverin publishes and honours DANE/TLSA, signs with DKIM, publishes SPF/DMARC, enables DNSSEC on managed domains, and strips personal IP addresses from outbound headers. 2FA is available and can be admin-mandated. Buyers still need their own OpenPGP setup for end-to-end content secrecy with external parties.
25 GB mailboxes with per-user encrypted backups
Each mailbox includes a stated 25 GB quota covering mail, calendar, and contacts. Nightly backups use individually generated keys; Soverin states that emptying trash permanently deletes data and that leaving the service removes backups when the key is destroyed. Extra mailboxes can share storage for small teams.
Multi-mailbox and channel-friendly business use
Purchase and assign additional mailboxes on a domain, with admin tooling for teams. Soverin markets to hosters, ISPs, MSPs, and independent professionals for multi-mailbox and white-label scenarios—useful when you want Dutch-operated email without building your own mail stack.

Assurance & compliance: Migadu vs Soverin
Assurance & compliance	Migadu	Soverin
Independent security / no-logs audit	Not found Vendor claims no ad scanning/sharing of mail content; no public third-party audit PDF located.	Not found No public third-party no-logs or full security audit PDF located; privacy claims are first-party.
ISO 27001	Not found Data centers described as internationally certified; no Migadu-organization ISO 27001 certificate found on primary pages.	Vendor claimed Vendor states independently audited ISO 27001; certificates available on request via support@soverin.net. Not re-verified against a public registry entry in this pass.
SOC 2 / SOC 3	Not found	Not found No SOC 2/3 claim found on primary pages reviewed.
GDPR / EU data protection	Vendor claimed Privacy policy asserts GDPR and Swiss DPA compliance; mail hosted in France per vendor.	Vendor claimed NL entity; AVG-framed privacy statement; EU-only processing claimed; GDPR Proof messaging on recognitions page.
US CLOUD Act exposure (indicative)	Partial Swiss entity, no known US parent, mail in France; Stripe and PayPal process payments with US transfers. Infrastructure subprocessors not fully named. EuropeanStack assessment—not a vendor certification. Not legal advice.	Partial EuropeanStack assessment: low exposure path—Dutch Soverin B.V., Dutch The Sharing Group owner, claimed self-operated NL hosting without public AWS/GCP/Azure mailbox hosts. Partial because residual subprocessors (support partner jurisdiction, domain partners, HIBP hash checks) need buyer confirmation. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Privacy page states it serves as privacy policy and DPA; confirm suitability with counsel.	Vendor claimed Privacy statement states it qualifies as an Article 28 AVG processing agreement; other DPAs expressly rejected. Confirm signed annex for enterprise use.
EU AI Act	Not applicable Email hosting product; not an AI system offering.	Not applicable Email hosting product; vendor emphasises no AI scanning/mining of mailbox content for ads.
ISO 9001 / ISO 14001	Not listed	Vendor claimed Vendor-claimed quality and environmental certifications; certificates on request.
NIS2 readiness	Not listed	Vendor claimed Vendor markets NIS2 Ready; buyer press also asserts NIS2 compliance—confirm evidence package.
NEN 7510 (healthcare NL)	Not listed	Partial Vendor states NEN 7510 certification is in progress, not completed.

Considerations & known limitations: Migadu vs Soverin
Considerations & known limitations	Migadu	Soverin
US payment subprocessors (Stripe, PayPal)	Medium Billing-related personal data can transfer to US processors under Migadu’s privacy policy. Mail content path is France/EU per vendor, but payment data is a separate CLOUD Act / transfer surface.	Not listed
Incomplete public infrastructure subprocessor list	Medium Primary pages name France hosting and certified DCs without a full vendor inventory for compute, storage, and backups. Procurement should request the current list and regions in writing.	Not listed
No E2EE product default; no classic mailbox 2FA	Medium Standards mail with TLS; vendor recommends user-side OpenPGP for strong content secrecy. IMAP 2FA is not offered; app-specific-style identities are not second-factor MFA.	Not listed
Daily quotas and human-mail policy	Medium Account-wide daily in/out caps and anti-bulk rules make Migadu unsuitable as a transactional/marketing ESP. Over-limit mail can be deferred or rejected after tolerance.	Not listed
No default SLA on standard plans	Low Vendor states standard offers lack SLAs; email is treated as asynchronous and occasionally disrupted. Enterprise SLA only via separate commercial discussion.	Not listed
No public independent security audit	Medium Privacy and no-ad-scanning claims are first-party. No independent audit report found for no-logs or security controls.	Not listed
Not zero-knowledge E2EE by default	Not listed	Medium Unlike Proton/Tuta, Soverin is a classic IMAP host. Provider infrastructure can process content for delivery and spam filtering. Practical impact: unsuitable as a drop-in for policies that require provider-blind encryption without extra client crypto.
Unnamed external support partner	Not listed	Medium Privacy statement discloses a first-line support partner with limited account data under DPA/NDA, but does not publish the partner name or country. Practical impact: add an open diligence item for any regulated workload.
ISO certificates not self-serve public	Not listed	Low ISO 27001/9001/14001 are claimed with certificates via support rather than a public PDF registry link found in research. Practical impact: procurement should request current attestations before treating certs as verified.
2025 group acquisition	Not listed	Low The Sharing Group acquisition may change subprocessors, tooling, or brand packaging over time even if continuity is promised. Practical impact: re-check DPA and hosting annex annually.
Email-centric support	Not listed	Low Public materials emphasise human Dutch-team email support; TechRadar notes no live chat or phone. Practical impact: large orgs needing 24/7 phone SLAs may find coverage thin.

Fit

Migadu

Best fit when

Agencies and freelancers hosting many client domains under one account with multi-admin or API provisioning
Organizations that want custom-domain mail with standard clients and portable IMAP—not a proprietary suite lock-in
Teams tired of per-seat pricing for large address spaces with modest real traffic
Buyers who value a small bootstrapped Swiss operator that publishes blunt product limits
Setups that need aliases, rewrites, identities, SIEVE, and postmaster-style controls more than collab apps

Poor fit when

Primary need is end-to-end encrypted mail by default (Proton Mail, Tuta, or user-side OpenPGP workflows)
High-volume transactional, marketing, or bulk outbound mail
Requirement for default contractual SLA, phone support, or multi-language admin UI
Mandatory mailbox 2FA on every IMAP login
Want a free long-term plan or Migadu-branded @provider addresses without owning a domain

Consider instead when

When: You need provider-managed end-to-end encryption as the default product promise
Consider: Proton Mail or Tuta
Migadu is standards hosting with TLS; content secrecy against the operator is not the design center.
When: You want another European professional host with a different admin/encryption/residency package
Consider: mailbox.org, Mailfence, Posteo, or Runbox
Compare DPA detail, audit packaging, and whether multi-domain usage pricing still wins for your address sprawl.
When: You need full workspace suite (docs, meet, identity) rather than email hosting alone
Consider: Google Workspace, Microsoft 365, or Infomaniak-style European suites
Migadu deliberately stays postmaster-focused.
When: You need bulk or high-rate application email
Consider: A dedicated ESP (not Migadu); Amazon SES is the common Big Tech baseline—pair with EU ESPs if residency matters
Migadu rate-limits and bans intentional bulk use.

Soverin

Best fit when

Individuals and freelancers who want a paid European mailbox on their own domain with any standard mail client
SMEs needing several mailboxes, aliases, and CalDAV/CardDAV without adopting Google Workspace or Microsoft 365
Teams prioritising Dutch jurisdiction and claimed no-hyperscaler hosting over zero-knowledge E2EE
Hosters/ISPs/MSPs evaluating white-label or multi-mailbox Dutch email
Buyers who value DANE, DKIM/DMARC, DNSSEC, and IP-header stripping on an open-standards stack

Poor fit when

Organisations that require default zero-access / E2EE mail against the provider (use Proton Mail or Tuta)
Users seeking a free tier, anonymous cash-only signup, or purely self-hosted open-source mail servers
Enterprises needing SSO, eDiscovery archives, phone support SLAs, or a full office suite in one vendor
Workloads that depend on US-region mailbox hosting or hyperscale global PoPs

Consider instead when

When: You need zero-knowledge E2EE and a privacy-first mobile/web ecosystem
Consider: Proton Mail or Tuta
Trade open IMAP convenience for stronger default content secrecy vs the provider.
When: You want German-hosted paid mail with broader office-style add-ons
Consider: mailbox.org or Posteo
Compare storage, admin features, and payment anonymity (Posteo) against Soverin’s domain/alias model.
When: You need Google- or Microsoft-class collaboration and global free consumer mail
Consider: Gmail or Microsoft 365 / Outlook.com
Different risk and advertising model; not EU-sovereignty substitutes.

Open questions for due diligence

Migadu

What are the current named mail hosting, backup, and ancillary subprocessors and their countries?
Can Migadu provide ISO/SOC evidence for the organization or only DC-level certifications?
Is an independent security or penetration-test summary available under NDA?
Does the privacy-page DPA meet your controller’s mandatory clauses without a separate signed agreement?
What encryption-at-rest and key-management practices apply today versus the older public pro/con narrative?

Soverin

What is the legal name and country of the first-line support partner, and is a current subprocessor list available under NDA?
Can Soverin provide the latest ISO 27001/9001/14001 certificates and scope statements without delay?
After The Sharing Group acquisition, are any new group companies (e.g. Mijndomein, Greenhost, Leafcloud tooling) in the mailbox data path?
Is NEN 7510 certification complete for healthcare use cases, or still in progress?
Which domain registrar(s) handle customer DNSSEC, and where are registry data stored?