Compare RAIDBOXES Emails and Runbox on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail
Germany· Email Services
Needs review
Shortlist when you already (or will) host the domain and WordPress stack at RAIDBOXES and need practical multi-mailbox domain email under a German operator with an online DPA. Skip when you need multi-domain density, default E2EE, or email fully independent of a hoster—consider Migadu, Tuta, Posteo, or mailbox.org instead.
Norway· Email Services
Needs review
Shortlist Runbox when you need Norwegian/EEA-hosted IMAP email with custom domains, ad-free subscription economics, and standard clients. Skip when you require default zero-access E2EE—consider Proton Mail or Tuta instead—or when you need a full Microsoft 365-style suite.
Highlighted rows differ between the two products.
| Feature | RAIDBOXES Emails | Runbox |
|---|---|---|
| Country of origin | Germany | Norway |
| Category | Email Services | Email Services |
| Open source | No | Yes |
| Self-hosted | No | No |
| Headquarters | Germany | Norway |
| Legal entity | Raidboxes GmbH, Hafenstraße 32, 48153 Münster (Amtsgericht Münster HRB 16184) | Runbox Solutions AS |
| Governing law | German law (company domicile Münster) | Norwegian law; Personal Data Act implementing GDPR (EEA) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Email: vendor claims exclusive German data centres and first-party Mail Hosting 2.0 infrastructure (IMAP/SMTP on securemail.pro hostnames); privacy policy still names Heinlein Hosting/mailbox.org under paid email boxes (possible legacy lag). Platform/website: AWS EMEA SARL and DigitalOcean listed for web hosting of the online offer; US-group SaaS includes Intercom, Calendly, Chargebee, Sentry, Google analytics/ads, Mailgun, and others for support, billing, and marketing. | Core email and account content: servers in Oslo (StackInfra) under Norwegian jurisdiction; systems management Copyleft Solutions AS (Norway). Optional third parties per privacy policy: Stripe, PayPal, Coinbase (US payments); Enom (US domains); Gandi (FR); Domeneshop (NO); JaguarPC (US default web hosting, Norway option); NodePing (US, status page). No known US parent. |
| Summary | German domain email hosting from Raidboxes GmbH (Münster): Mail Hosting 2.0 with IMAP/SMTP, multi-mailbox plans, optional PGP, and dashboard fit for WordPress agencies—domain must be hosted at RAIDBOXES. | Norwegian subscription email hosting from Runbox Solutions AS: Oslo-hosted IMAP mailboxes, custom domains, CalDAV/CardDAV, and optional PGP. Ad-free; not default zero-access. |
| Tags |
| At a glance | RAIDBOXES Emails | Runbox |
|---|---|---|
| HQ | Münster, Germany | Oslo, Norway |
| Legal entity | Raidboxes GmbH (HRB 16184) | Runbox Solutions AS (orgnr 996877027) |
| Group | team.blue (Belgium) since 2022 | Not listed |
| Product | Mail Hosting 2.0 domain email | Not listed |
| Access | IMAP / SMTP + webmail | Not listed |
| Domain constraint | Domain hosted at RAIDBOXES for new mailboxes | Not listed |
| Open source | No | Partial (Runbox 7 web app); not self-hosted |
| Self-hosted | No | Not listed |
| Founded | Not listed | Service since 2000; current AS form 2011 |
| Hosting | Not listed | Email: StackInfra Oslo; optional web hosting may default US |
| Commercial model | Not listed | Paid subscription + trial (no permanent free tier) |
| Key capabilities | RAIDBOXES Emails | Runbox |
|---|---|---|
| German operator | Yes | Not listed |
| IMAP / SMTP | Yes | Not listed |
| Mail Hosting 2.0 | Yes | Not listed |
| Online DPA | Yes | Not listed |
| WordPress-adjacent | Yes | Not listed |
| Optional PGP | Yes | Yes |
| Norwegian email hosting | Not listed | Yes |
| IMAP / POP / SMTP | Not listed | Yes |
| Custom domains | Not listed | Yes |
| 100% renewable (claimed) | Not listed | Yes |
| Runbox 7 open source | Not listed | Yes |
Mail Hosting 2.0 on RAIDBOXES infrastructure
IMAP/SMTP mailboxes on dedicated hostnames (mail-rb.securemail.pro / smtp-rb.securemail.pro) after the move off the prior mailbox.org cooperation. Vendor claims German data-centre locations and triple-redundant mail servers. Best for teams that want domain mail under the same German WordPress host rather than a separate privacy-mail brand.
Multi-mailbox plans with aliases, forwards, and catch-all
Tiered plans allocate a fixed number of mailboxes and a shared storage pool, plus per-mailbox alias and forwarding quotas, autoresponders, and catch-all (requires a dedicated catch-all mailbox). One connected domain per plan—confirm multi-domain needs before shortlisting.
Spam/virus filters, TLS, optional PGP, ad-free inboxes
All plans include spam and virus filtering, SSL/TLS for transfer, a blacklist checker, webmail, and ad-free inboxes. PGP is optional rather than default end-to-end encryption for every message—teams that need mandatory E2EE workflows should evaluate Tuta or a full mailbox.org stack instead.
Dashboard-adjacent domain and WordPress ops
Mailboxes are ordered from the RAIDBOXES dashboard and are intended to sit next to WordPress hosting and domain management. New RAIDBOXES mailboxes require the domain to be hosted with RAIDBOXES; legacy mailbox.org-linked domains follow a separate migration path documented in the help centre.
Online B2B DPA and German operator
Raidboxes GmbH (Münster) offers an online data processing agreement (AV contract) with technical-organisational measures. Useful for agencies that already sign a DPA for WordPress hosting and want the same counterparty for domain email—still review TOMs and subprocessor scope for mailbox vs platform tooling.
Norwegian-hosted IMAP email with full-disk encryption
Mailboxes live on servers Runbox places in a StackInfra facility in Oslo under Norwegian jurisdiction, with full-disk encryption at rest and TLS (including PFS) in transit. Access via IMAP, POP, SMTP, or Runbox 7 webmail suits teams that need standard clients rather than a proprietary-only app.
Custom domains, aliases, and multi-account admin
Host mail on your own domain, manage sub-accounts from a main account, and use many aliases on Runbox domains plus unlimited aliases on customer domains. Plus-addressing and filters help separate identities without running separate mailboxes.
CalDAV/CardDAV plus optional PGP or S/MIME
Integrated calendar and contacts sync over CalDAV and CardDAV with common desktop and mobile apps. End-to-end confidentiality is user-controlled via PGP or S/MIME—not zero-access by default—so operators can still index mail for search and scan for malware.
Ad-free, subscription-funded privacy model
Runbox states it does not show ads, does not use third-party trackers such as Google Analytics, and only scans messages for spam/virus protection—not advertising. Revenue is subscription-based with a public trial period, aligning incentives away from data-mining free mail.
Runbox 7 open-source webmail on hydropowered infra
The Runbox 7 web client is published on GitHub for inspection; the hosted server stack remains largely proprietary. Email infrastructure is advertised as 100% certified renewable electricity in Norway, with additional company offset claims—useful for sustainability procurement checklists.
| Assurance & compliance | RAIDBOXES Emails | Runbox |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party security or no-logs audit report found for RAIDBOXES Emails on primary pages. | Not found Vendor claims minimal logging and short retention windows; no public independent audit report found |
| ISO 27001 | Not found No company-wide ISO 27001 certificate for Raidboxes GmbH found on product/security pages; AWS region ISO mentions are not RAIDBOXES certs. | Not found No Runbox ISO 27001 certificate found on primary pages (power supplier ISO 14001 is environmental, not info-sec) |
| SOC 2 / SOC 3 | Not found No public SOC 2/3 report located for RAIDBOXES Emails. | Not found No public SOC 2/3 report located |
| GDPR / EU data protection | Vendor claimed German controller (Raidboxes GmbH); product claims DE server locations and GDPR-aligned deletion; online DPA available. Confirm active mail stack vs privacy-policy mailbox.org listing. | Vendor claimed Norwegian entity; Personal Data Act implements GDPR; appointed DPO; privacy policy documents rights and retention |
| US CLOUD Act exposure (indicative) | Partial EU/German entity, no known US parent (team.blue BE group). Medium residual exposure via US-group platform subprocessors (AWS/DigitalOcean for online offer hosting; Intercom, Chargebee, Google tooling, Mailgun, etc.). Mail content path claimed DE-only. Not legal advice. | Partial No known US parent; core email in Norway. Medium/partial because privacy policy lists US third parties (Stripe, PayPal, Coinbase, Enom, JaguarPC web hosting default, NodePing). Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Online AV/DPA flow at raidboxes.io/en/dpa/ and DocuSign TOM path documented in help centre. | Not found Processor DPA with Copyleft is mentioned; no public customer-facing B2B DPA template found—ask sales/support |
| EU AI Act | Not applicable Domain email hosting product, not an AI system offering. | Not applicable Email hosting product; vendor states no intrusive AI for ad profiling |
| B Corp certification | Vendor claimed Raidboxes GmbH listed as Certified B Corporation on B Lab directory; impact certification, not an information-security audit. | Not listed |
| Considerations & known limitations | RAIDBOXES Emails | Runbox |
|---|---|---|
| Domain must be hosted at RAIDBOXES | Medium New mailboxes require the domain on RAIDBOXES. That is convenient for WP customers and a lock-in factor if you only wanted independent mail. | Not listed |
| One connected domain per plan | Medium Multi-domain operators need multiple plans or another provider; not a Migadu-style multi-domain account model. | Not listed |
| PGP optional, not default E2EE | Medium Threat models that assume provider-side unreadability by default are a better fit for Tuta or similar products. | Not listed |
| US-group platform subprocessors | Medium Privacy policy discloses AWS EMEA, DigitalOcean, Intercom, Chargebee, Google tools, Mailgun, and others for website/support/billing/marketing—even while email marketing claims German mail servers. Scope diligence to mailbox vs platform data paths. | Not listed |
| Privacy policy may lag Mail Hosting 2.0 | Low §Email box still lists mailbox.org/Heinlein while marketing claims first-party hosting—confirm live stack and subprocessor annex for your contract. | Not listed |
| No public ISO/SOC/mail audit | Medium B Corp is not a security certification. Enterprise security questionnaires may need NDA materials or alternative providers with published audits. | Medium Assurance relies on vendor policy, Norwegian law, and facility claims. Regulated buyers may need NDA evidence or on-site questionnaire. |
| Not default zero-access encryption | Not listed | Medium Unlike Proton/Tuta, Runbox can access stored mail for spam/virus scanning, indexing, and lawful process. Use PGP/S/MIME when E2EE is required. |
| US vendors on optional product paths | Not listed | Medium Payments (Stripe/PayPal/Coinbase), domain registrar Enom, and default JaguarPC web hosting introduce US processors. Keep web hosting in Norway and minimize US payment data if policy requires. |
| Partial open source only | Not listed | Low Runbox 7 webmail is open source; mail backend is proprietary SaaS—no self-host path. |
| Post-closure and backup retention | Not listed | Low Privacy policy defines multi-month content retention and backup windows after closure (and longer account-info retention for bookkeeping). Request immediate deletion if policy requires faster wipe. |
When: You need multi-domain, usage-based professional mail without WordPress host lock-in
Consider: Migadu
Swiss-operated, standards-based hosting priced by quotas rather than per-domain WordPress adjacency
When: You need default E2EE and a privacy-first client model
Consider: Tuta
Different threat model; less IMAP flexibility than RAIDBOXES
When: You want privacy-oriented German personal/business mail without hosting coupling
Consider: Posteo or mailbox (formerly mailbox.org)
mailbox is also the former RAIDBOXES mail partner and a deeper digital-workplace option
When: You need Google/Microsoft suite collaboration, not just domain mailboxes
Consider: Google Workspace or Microsoft 365
US Big Tech residency and CLOUD Act profile differ sharply—use only if suite features dominate
When: You need default end-to-end / zero-access encryption for all messages
Consider: Proton Mail or Tuta
Runbox uses optional PGP/S/MIME; operator can access stored mail for filtering and lawful process
When: You want a German privacy-oriented host with similar sustainability positioning
Consider: Posteo
Compare jurisdiction (DE vs NO), domain limits, and feature depth
When: You need Belgian email with integrated collaboration extras
Consider: Mailfence
Different encryption defaults and product scope
When: You need global free-tier convenience and suite lock-in
Consider: Gmail or Outlook.com / Microsoft 365
Accept US jurisdiction and ad/suite economics tradeoffs