Migadu vs web.de

Compare Migadu and web.de on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail

Migadu

Switzerland· Email Services

Needs review

Shortlist Migadu when you need Swiss-operated, standards IMAP/SMTP hosting with unlimited addresses across many domains under flat account quotas—especially agencies and multi-domain SMEs. Skip when you need provider E2EE defaults, contractual SLA on the default offer, mailbox 2FA, or bulk/transactional sending; consider Proton Mail/Tuta for E2EE, or mailbox.org/Mailfence/Posteo/Runbox for other European professional-mail tradeoffs.

Swiss operatorUsage-priced multi-domainSMTP/IMAP/POP3Mail hosted in FranceMulti-admin + APINo ads / no tracking

View listing Visit Website

web.de

Germany· Email Services

Needs review

Shortlist web.de when you need mass-market German freemail with DE-sited mail/cloud, E-Mail made in Germany TLS alliance markers, optional PGP/2FA, and a familiar DACH portal. Skip when you need default E2EE, no advertising data path, self-host, or enterprise admin—consider Posteo, mailbox.org, Tuta, or Proton Mail instead.

DE-operated freemailE-Mail made in GermanyGermany data centers (claimed)Optional PGPFreeMail + paid upgradesSaaS only

View listing Visit Website

Highlighted rows differ between the two products.

Migadu vs web.de: Snapshot
Feature	Migadu	web.de
Country of origin	Switzerland	Germany
Category	Email Services	Email Services
Open source	No	No
Self-hosted	No	No
Headquarters	Switzerland	Germany
Legal entity	Migadu-Mail GmbH	1&1 Mail & Media GmbH (United Internet AG group)
Governing law	Canton of Appenzell Ausserrhoden, Swiss Confederation (terms)	Germany / EU GDPR
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Mail servers stated in France (EU). Payment subprocessors Stripe and PayPal (US) for billing data. Full mail infrastructure/backup subprocessor list not published by name on primary pages.	Vendor claims email and Online-Speicher stored exclusively in Germany in company-owned data centers (E-Mail/Cloud made in Germany). FreeMail monetized via advertising and IAB TCF consent partners; privacy notice allows EEA third-country transfers with Chapter V safeguards. Portal/optional features use additional processors (e.g. search partners, embeds, homepage builder DUDA Inc., ID vendors). No exhaustive public mail-stack subprocessor list found.
Summary	Swiss-operated, standards-based email hosting for custom domains: unlimited addresses and multi-domain accounts priced by usage quotas, not per mailbox.	German freemail and portal from United Internet’s 1&1 Mail & Media GmbH: FreeMail with DE-sited mail and cloud, E-Mail made in Germany TLS alliance, optional PGP—consumer SaaS, not default-E2EE privacy mail.
Tags	saas privacy api email-hosting standards-based multi-domain	saas freemail germany email cloud-storage gdpr consumer

At a glance: Migadu vs web.de
At a glance	Migadu	web.de
HQ / entity	Migadu-Mail GmbH, Switzerland	Not listed
Founded	2014 (vendor About)	Not listed
Mail hosting	Data centers in France (vendor Pro/Cons)	Not listed
Commercial model	Flat per-account plans by daily message quotas + soft storage	Ad-supported FreeMail; paid mailbox/cloud upgrades; Consent or Pay
Open source product?	No — built on open-source stack; service is proprietary SaaS	Not listed
Self-host	No	No
Ownership	Bootstrapped; no outside capital (vendor claim)	Not listed
HQ / operator	Not listed	1&1 Mail & Media GmbH, Montabaur/Karlsruhe, Germany
Parent group	Not listed	United Internet AG (Germany)
Product type	Not listed	Consumer freemail + portal + cloud (SaaS)
Hosting (vendor claim)	Not listed	Company-owned data centers in Germany
Open source	Not listed	No

Key capabilities: Migadu vs web.de
Key capabilities	Migadu	web.de
Swiss operator	Yes	Not listed
Usage-priced multi-domain	Yes	Not listed
SMTP/IMAP/POP3	Yes	Not listed
Mail hosted in France	Yes	Not listed
Multi-admin + API	Yes	Not listed
No ads / no tracking	Yes	Not listed
DE-operated freemail	Not listed	Yes
E-Mail made in Germany	Not listed	Yes
Germany data centers (claimed)	Not listed	Yes
Optional PGP	Not listed	Yes
FreeMail + paid upgrades	Not listed	Yes
SaaS only	Not listed	Yes

Migadu

Usage-metered accounts with unlimited addresses
Plans are flat per Migadu account. Within daily in/out quotas and soft storage guidance, create large numbers of mailboxes and host many domains without per-address fees—useful for agencies and multi-project teams. Soft storage does not hard-bounce mail; sustained over-quota use can force upgrades or limits.
Standards SMTP, IMAP4, POP3, and webmail
No proprietary client protocol. Connect Thunderbird, Apple Mail, Outlook, mutt, and others over TLS (typical endpoints imap.migadu.com:993, smtp.migadu.com:465, pop.migadu.com:995). ManageSieve filtering, aliases, pattern rewrites, identities, footers, auto-responders, and optional catch-alls cover classic postmaster needs. Data remains portable via standard protocols.
Multi-domain admin, multi-admin, and beta API
Agencies can hold many client domains under one roof, open multiple administrators (domain-scoped on higher plans), set per-domain/mailbox limits, and monitor traffic. A REST API (documented as early beta) manages domains, mailboxes, identities, forwardings, aliases, and rewrites for automation. Domain deletion stays UI-only as a safety measure.
DNS helpers and postmaster-style support
Optional built-in DNS ships mail records preconfigured; Migadu also offers DNS setup help at no extra fee and publishes diagnostics/activation flows. Support is ticket-based from people who operate the mail stack—not outsourced chat—with plan-dependent urgency outside office hours.
No ads, no product analytics cookies
Vendor policy states no advertising, no tracking of mailbox content for ads, and no website analytics cookies beyond session needs. Processing is framed for service delivery, abuse prevention, and legal obligations. Payment data still goes to Stripe and PayPal under separate processor terms.

web.de

E-Mail made in Germany alliance transport
Founding member of the German provider alliance (WEB.DE, GMX, 1&1, STRATO, T-Online, freenet). TLS on paths inside the alliance, mail stored in Germany, and green checkmarks on alliance addresses in the compose UI. Does not encrypt content to non-alliance or non-PGP recipients end-to-end by default.
FreeMail + paid upgrades with intelligent inbox
Ad-supported FreeMail with integrated calendar, contacts, and Online-Speicher. Intelligent inbox categorizes newsletters, orders, social, and contracts/subscriptions without duplicating messages; optional package tracking via DHL, DPD, and GLS when consented. Paid tiers expand quotas and reduce ad/tracking friction under Consent or Pay.
Optional PGP and free 2FA
Optional PGP end-to-end encryption for sensitive mail (both parties need keys/compatible clients). Optional free two-factor authentication for account login. Baseline mailbox protection relies on account credentials, spam/virus filters, and TLS—not default E2EE for every message.
Cloud made in Germany Online-Speicher
Mailbox-integrated cloud with browser, app, and desktop access; link sharing and Online Office for documents. Vendor claims exclusive German data-center storage and TLS in transit under Cloud made in Germany. Free tier includes a starter cloud quota; larger capacities are paid add-ons. Not a full Google Drive/OneDrive collab suite.
German consumer portal on the same identity
News, services, WEB.Cent cashback, and optional Deutsche Post letter preview sit beside mail. Useful for personal DACH users; increases advertising and partner surface versus a pure mailbox product. Portal embeds and partners are consent-gated where required.

Assurance & compliance: Migadu vs web.de
Assurance & compliance	Migadu	web.de
Independent security / no-logs audit	Not found Vendor claims no ad scanning/sharing of mail content; no public third-party audit PDF located.	Not found No public independent no-logs or full security audit package found for FreeMail; alliance pages claim oversight by data-protection function and independent Prüfstellen at a high level only.
ISO 27001	Not found Data centers described as internationally certified; no Migadu-organization ISO 27001 certificate found on primary pages.	Not found No public ISO 27001 certificate page located for the web.de freemail product during research.
SOC 2 / SOC 3	Not found	Not found No public SOC 2/3 report found for web.de FreeMail.
GDPR / EU data protection	Vendor claimed Privacy policy asserts GDPR and Swiss DPA compliance; mail hosted in France per vendor.	Vendor claimed German controller (1&1 Mail & Media GmbH); detailed GDPR privacy notice; DE storage claims for mail/cloud. Not a legal certification.
US CLOUD Act exposure (indicative)	Partial Swiss entity, no known US parent, mail in France; Stripe and PayPal process payments with US transfers. Infrastructure subprocessors not fully named. EuropeanStack assessment—not a vendor certification. Not legal advice.	Partial EU/German entity and parent; no known US parent; mail/cloud claimed on company-owned DE data centers. Partial because privacy notice allows third-country transfers with safeguards, FreeMail uses ad/TCF partners, and no exhaustive public subprocessor inventory. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Privacy page states it serves as privacy policy and DPA; confirm suitability with counsel.	Not found Consumer freemail focus; no clear self-serve public B2B DPA for FreeMail found. Request under contract if treating as processor for an organization.
EU AI Act	Not applicable Email hosting product; not an AI system offering.	Not applicable Consumer mail/portal with limited in-product assistants; not an AI-centric product for this checklist.

Considerations & known limitations: Migadu vs web.de
Considerations & known limitations	Migadu	web.de
US payment subprocessors (Stripe, PayPal)	Medium Billing-related personal data can transfer to US processors under Migadu’s privacy policy. Mail content path is France/EU per vendor, but payment data is a separate CLOUD Act / transfer surface.	Not listed
Incomplete public infrastructure subprocessor list	Medium Primary pages name France hosting and certified DCs without a full vendor inventory for compute, storage, and backups. Procurement should request the current list and regions in writing.	Not listed
No E2EE product default; no classic mailbox 2FA	Medium Standards mail with TLS; vendor recommends user-side OpenPGP for strong content secrecy. IMAP 2FA is not offered; app-specific-style identities are not second-factor MFA.	Not listed
Daily quotas and human-mail policy	Medium Account-wide daily in/out caps and anti-bulk rules make Migadu unsuitable as a transactional/marketing ESP. Over-limit mail can be deferred or rejected after tolerance.	Not listed
No default SLA on standard plans	Low Vendor states standard offers lack SLAs; email is treated as asynchronous and occasionally disrupted. Enterprise SLA only via separate commercial discussion.	Not listed
No public independent security audit	Medium Privacy and no-ad-scanning claims are first-party. No independent audit report found for no-logs or security controls.	Medium ISO 27001, SOC 2, and independent no-logs audits not found on public product pages. Trust rests on German entity, DE hosting claims, and first-party security copy.
Ad-financed FreeMail and consent surface	Not listed	Medium FreeMail uses advertising and Consent or Pay. With consent, content may feed interest profiles; FreeMail users cannot drop WEB.DE informiert like paid tiers. Unsuitable where ad-tech processors are banned.
No default end-to-end encryption	Not listed	Medium TLS and alliance transport protection are not content E2EE. Optional PGP only covers willing counterparties. Operator can process plaintext for spam, intelligent inbox, and consented ad analysis.
Third-country transfers and portal partners	Not listed	Low Privacy notice contemplates non-EEA recipients under Chapter V safeguards. Portal/search/ID/ad features introduce extra processors beyond the mailbox DC story—review consent layer and purpose before sensitive use.
FreeMail inactivity content deletion	Not listed	Low Privacy notice: FreeMail email content may be deleted after more than 180 days without login. Not a durable archive without activity or export.

Fit

Migadu

Best fit when

Agencies and freelancers hosting many client domains under one account with multi-admin or API provisioning
Organizations that want custom-domain mail with standard clients and portable IMAP—not a proprietary suite lock-in
Teams tired of per-seat pricing for large address spaces with modest real traffic
Buyers who value a small bootstrapped Swiss operator that publishes blunt product limits
Setups that need aliases, rewrites, identities, SIEVE, and postmaster-style controls more than collab apps

Poor fit when

Primary need is end-to-end encrypted mail by default (Proton Mail, Tuta, or user-side OpenPGP workflows)
High-volume transactional, marketing, or bulk outbound mail
Requirement for default contractual SLA, phone support, or multi-language admin UI
Mandatory mailbox 2FA on every IMAP login
Want a free long-term plan or Migadu-branded @provider addresses without owning a domain

Consider instead when

When: You need provider-managed end-to-end encryption as the default product promise
Consider: Proton Mail or Tuta
Migadu is standards hosting with TLS; content secrecy against the operator is not the design center.
When: You want another European professional host with a different admin/encryption/residency package
Consider: mailbox.org, Mailfence, Posteo, or Runbox
Compare DPA detail, audit packaging, and whether multi-domain usage pricing still wins for your address sprawl.
When: You need full workspace suite (docs, meet, identity) rather than email hosting alone
Consider: Google Workspace, Microsoft 365, or Infomaniak-style European suites
Migadu deliberately stays postmaster-focused.
When: You need bulk or high-rate application email
Consider: A dedicated ESP (not Migadu); Amazon SES is the common Big Tech baseline—pair with EU ESPs if residency matters
Migadu rate-limits and bans intentional bulk use.

web.de

Best fit when

German consumers who want a familiar .de freemail address with portal news and everyday cloud storage
Secondary personal or family mail where DE operator and DE storage matter more than default E2EE
Users who value intelligent inbox sorting, package tracking, and mobile/desktop access over privacy-maximalist design
Teams comparing Gmail/Outlook.com alternatives on jurisdiction while accepting consumer freemail trade-offs
Buyers already in the United Internet ecosystem (WEB.DE / GMX) who need a consistent DACH brand

Poor fit when

Organizations needing primary business mail with admin console, SSO, and signed B2B DPA as standard
Hard requirements for default end-to-end encryption or zero advertising/tracking surface
Self-hosted or open-source mail stacks you operate yourself
Long-term cold archives on FreeMail (inactivity deletion policy)
Procurement policies that forbid ad-tech partners or third-country transfer language without contract exhibits

Consider instead when

When: You need default E2EE and a privacy-first paid mailbox
Consider: Tuta or Proton Mail
web.de PGP is optional and counterpart-dependent; FreeMail is ad-financed.
When: You want ad-free German/EU mail with strong consumer privacy posture and paid model only
Consider: Posteo or mailbox.org
Less portal monetization; clearer privacy-first product framing than mass freemail.
When: You prefer the same United Internet Mail & Media stack under another brand
Consider: GMX Mail
Nearly aligned trust and capability story; brand and portal mix differ.
When: You need Google/Microsoft-class workspace collab and enterprise compliance packs
Consider: Gmail (Google Workspace) or Outlook.com / Microsoft 365
Trade DE freemail residency story for US-group platforms and deeper admin tooling.

Open questions for due diligence

Migadu

What are the current named mail hosting, backup, and ancillary subprocessors and their countries?
Can Migadu provide ISO/SOC evidence for the organization or only DC-level certifications?
Is an independent security or penetration-test summary available under NDA?
Does the privacy-page DPA meet your controller’s mandatory clauses without a separate signed agreement?
What encryption-at-rest and key-management practices apply today versus the older public pro/con narrative?

web.de

Will 1&1 Mail & Media sign a B2B DPA and provide a current subprocessor list for mailbox and cloud processing?
Are there ISO 27001, C5, or independent penetration-test summaries available under NDA for Mail & Media freemail infrastructure?
For your use case, is FreeMail with ads acceptable, or must you force paid TrackFree/premium paths and refuse intelligent-inbox/ad consents?
Confirm whether any non-DE backup, support, or analytics processors touch mailbox content beyond the public privacy notice.