Compare Runbox and Soverin on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Outlook.com
Norway· Email Services
Needs review
Shortlist Runbox when you need Norwegian/EEA-hosted IMAP email with custom domains, ad-free subscription economics, and standard clients. Skip when you require default zero-access E2EE—consider Proton Mail or Tuta instead—or when you need a full Microsoft 365-style suite.
Netherlands· Email Services
Needs review
Shortlist Soverin when you want Dutch-operated, paid IMAP email with custom domains, unlimited aliases, and strong mail-auth standards without Google/Microsoft ads. Skip when you need zero-knowledge E2EE—consider Proton Mail or Tuta instead—or a full productivity suite (mailbox.org / Microsoft 365).
Highlighted rows differ between the two products.
| Feature | Runbox | Soverin |
|---|---|---|
| Country of origin | Norway | Netherlands |
| Category | Email Services | Email Services |
| Open source | Yes | No |
| Self-hosted | No | No |
| Headquarters | Norway | Netherlands |
| Legal entity | Runbox Solutions AS | Soverin B.V. (Amsterdam); owned by The Sharing Group / TSG Online (Dutch) as of September 2025 acquisition announcement |
| Governing law | Norwegian law; Personal Data Act implementing GDPR (EEA) | Not listed |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Low |
| Hosting / residency | Core email and account content: servers in Oslo (StackInfra) under Norwegian jurisdiction; systems management Copyleft Solutions AS (Norway). Optional third parties per privacy policy: Stripe, PayPal, Coinbase (US payments); Enom (US domains); Gandi (FR); Domeneshop (NO); JaguarPC (US default web hosting, Norway option); NodePing (US, status page). No known US parent. | Vendor: EU-only processing; data in NL; self-operated Dutch DCs, no hyperscaler. TechRadar: 3 NL DCs. Core mail hosts on Soverin B.V. AS211993. External first-line support partner under DPA/NDA (country unpublished). HIBP k-anon password checks; Let’s Encrypt; domain DNSSEC partner. No AWS/GCP/Azure as primary mailbox hosts in public materials. |
| Summary | Norwegian subscription email hosting from Runbox Solutions AS: Oslo-hosted IMAP mailboxes, custom domains, CalDAV/CardDAV, and optional PGP. Ad-free; not default zero-access. | Dutch privacy-first email hosting: custom domains, open IMAP/SMTP/CalDAV, 25 GB mailboxes, no ads or content scanning, servers operated in the Netherlands. |
| Tags |
| At a glance | Runbox | Soverin |
|---|---|---|
| HQ | Oslo, Norway | Amsterdam, Netherlands (Soverin B.V.) |
| Legal entity | Runbox Solutions AS (orgnr 996877027) | Not listed |
| Founded | Service since 2000; current AS form 2011 | Not listed |
| Hosting | Email: StackInfra Oslo; optional web hosting may default US | Dutch data centres; vendor claims self-operated, no hyperscaler |
| Open source | Partial (Runbox 7 web app); not self-hosted | Not listed |
| Commercial model | Paid subscription + trial (no permanent free tier) | Annual prepaid; 30-day mailbox money-back; no free tier |
| Group | Not listed | The Sharing Group / TSG Online (acq. Sep 2025) |
| Protocols | Not listed | IMAP, SMTP, CalDAV, CardDAV |
| Storage | Not listed | 25 GB per mailbox (vendor-stated) |
| Self-host / OSS | Not listed | No / No |
| Key capabilities | Runbox | Soverin |
|---|---|---|
| Norwegian email hosting | Yes | Not listed |
| IMAP / POP / SMTP | Yes | Not listed |
| Custom domains | Yes | Yes |
| 100% renewable (claimed) | Yes | Not listed |
| Runbox 7 open source | Yes | Not listed |
| Optional PGP / S/MIME | Yes | Not listed |
| NL / EU operated | Not listed | Yes |
| IMAP / CalDAV | Not listed | Yes |
| No ads / no tracking | Not listed | Yes |
| ISO 27001 (claimed) | Not listed | Yes |
| DANE / DNSSEC | Not listed | Yes |
Norwegian-hosted IMAP email with full-disk encryption
Mailboxes live on servers Runbox places in a StackInfra facility in Oslo under Norwegian jurisdiction, with full-disk encryption at rest and TLS (including PFS) in transit. Access via IMAP, POP, SMTP, or Runbox 7 webmail suits teams that need standard clients rather than a proprietary-only app.
Custom domains, aliases, and multi-account admin
Host mail on your own domain, manage sub-accounts from a main account, and use many aliases on Runbox domains plus unlimited aliases on customer domains. Plus-addressing and filters help separate identities without running separate mailboxes.
CalDAV/CardDAV plus optional PGP or S/MIME
Integrated calendar and contacts sync over CalDAV and CardDAV with common desktop and mobile apps. End-to-end confidentiality is user-controlled via PGP or S/MIME—not zero-access by default—so operators can still index mail for search and scan for malware.
Ad-free, subscription-funded privacy model
Runbox states it does not show ads, does not use third-party trackers such as Google Analytics, and only scans messages for spam/virus protection—not advertising. Revenue is subscription-based with a public trial period, aligning incentives away from data-mining free mail.
Runbox 7 open-source webmail on hydropowered infra
The Runbox 7 web client is published on GitHub for inspection; the hosted server stack remains largely proprietary. Email infrastructure is advertised as 100% certified renewable electricity in Norway, with additional company offset claims—useful for sustainability procurement checklists.
Custom domains with unlimited aliases
Host mail on your own domain (bring existing or register through Soverin). Unlimited aliases—plus-addressing or domain names—deliver into one mailbox, plus optional random @sinenomine.email private aliases that hide the real address. Suits freelancers and SMEs who need brandable addresses without per-alias fees.
Open IMAP/SMTP plus CalDAV/CardDAV
Use any standards-based client or device for mail, calendar, and contacts—no proprietary app required. Dashboard import helps migrate from other providers. Ideal when IT wants Thunderbird, Apple Mail, or Outlook without locking into a closed webmail ecosystem; not a zero-knowledge E2EE product by default.
Mail-path security: DANE, DKIM, DMARC, IP stripping
Outbound and inbound paths use TLS; Soverin publishes and honours DANE/TLSA, signs with DKIM, publishes SPF/DMARC, enables DNSSEC on managed domains, and strips personal IP addresses from outbound headers. 2FA is available and can be admin-mandated. Buyers still need their own OpenPGP setup for end-to-end content secrecy with external parties.
25 GB mailboxes with per-user encrypted backups
Each mailbox includes a stated 25 GB quota covering mail, calendar, and contacts. Nightly backups use individually generated keys; Soverin states that emptying trash permanently deletes data and that leaving the service removes backups when the key is destroyed. Extra mailboxes can share storage for small teams.
Multi-mailbox and channel-friendly business use
Purchase and assign additional mailboxes on a domain, with admin tooling for teams. Soverin markets to hosters, ISPs, MSPs, and independent professionals for multi-mailbox and white-label scenarios—useful when you want Dutch-operated email without building your own mail stack.
| Assurance & compliance | Runbox | Soverin |
|---|---|---|
| Independent security / no-logs audit | Not found Vendor claims minimal logging and short retention windows; no public independent audit report found | Not found No public third-party no-logs or full security audit PDF located; privacy claims are first-party. |
| ISO 27001 | Not found No Runbox ISO 27001 certificate found on primary pages (power supplier ISO 14001 is environmental, not info-sec) | Vendor claimed Vendor states independently audited ISO 27001; certificates available on request via support@soverin.net. Not re-verified against a public registry entry in this pass. |
| SOC 2 / SOC 3 | Not found No public SOC 2/3 report located | Not found No SOC 2/3 claim found on primary pages reviewed. |
| GDPR / EU data protection | Vendor claimed Norwegian entity; Personal Data Act implements GDPR; appointed DPO; privacy policy documents rights and retention | Vendor claimed NL entity; AVG-framed privacy statement; EU-only processing claimed; GDPR Proof messaging on recognitions page. |
| US CLOUD Act exposure (indicative) | Partial No known US parent; core email in Norway. Medium/partial because privacy policy lists US third parties (Stripe, PayPal, Coinbase, Enom, JaguarPC web hosting default, NodePing). Not legal advice. | Partial EuropeanStack assessment: low exposure path—Dutch Soverin B.V., Dutch The Sharing Group owner, claimed self-operated NL hosting without public AWS/GCP/Azure mailbox hosts. Partial because residual subprocessors (support partner jurisdiction, domain partners, HIBP hash checks) need buyer confirmation. Not legal advice. |
| Data processing agreement (B2B) | Not found Processor DPA with Copyleft is mentioned; no public customer-facing B2B DPA template found—ask sales/support | Vendor claimed Privacy statement states it qualifies as an Article 28 AVG processing agreement; other DPAs expressly rejected. Confirm signed annex for enterprise use. |
| EU AI Act | Not applicable Email hosting product; vendor states no intrusive AI for ad profiling | Not applicable Email hosting product; vendor emphasises no AI scanning/mining of mailbox content for ads. |
| ISO 9001 / ISO 14001 | Not listed | Vendor claimed Vendor-claimed quality and environmental certifications; certificates on request. |
| NIS2 readiness | Not listed | Vendor claimed Vendor markets NIS2 Ready; buyer press also asserts NIS2 compliance—confirm evidence package. |
| NEN 7510 (healthcare NL) | Not listed | Partial Vendor states NEN 7510 certification is in progress, not completed. |
| Considerations & known limitations | Runbox | Soverin |
|---|---|---|
| Not default zero-access encryption | Medium Unlike Proton/Tuta, Runbox can access stored mail for spam/virus scanning, indexing, and lawful process. Use PGP/S/MIME when E2EE is required. | Not listed |
| US vendors on optional product paths | Medium Payments (Stripe/PayPal/Coinbase), domain registrar Enom, and default JaguarPC web hosting introduce US processors. Keep web hosting in Norway and minimize US payment data if policy requires. | Not listed |
| No public ISO 27001 / SOC 2 / independent audit | Medium Assurance relies on vendor policy, Norwegian law, and facility claims. Regulated buyers may need NDA evidence or on-site questionnaire. | Not listed |
| Partial open source only | Low Runbox 7 webmail is open source; mail backend is proprietary SaaS—no self-host path. | Not listed |
| Post-closure and backup retention | Low Privacy policy defines multi-month content retention and backup windows after closure (and longer account-info retention for bookkeeping). Request immediate deletion if policy requires faster wipe. | Not listed |
| Not zero-knowledge E2EE by default | Not listed | Medium Unlike Proton/Tuta, Soverin is a classic IMAP host. Provider infrastructure can process content for delivery and spam filtering. Practical impact: unsuitable as a drop-in for policies that require provider-blind encryption without extra client crypto. |
| Unnamed external support partner | Not listed | Medium Privacy statement discloses a first-line support partner with limited account data under DPA/NDA, but does not publish the partner name or country. Practical impact: add an open diligence item for any regulated workload. |
| ISO certificates not self-serve public | Not listed | Low ISO 27001/9001/14001 are claimed with certificates via support rather than a public PDF registry link found in research. Practical impact: procurement should request current attestations before treating certs as verified. |
| 2025 group acquisition | Not listed | Low The Sharing Group acquisition may change subprocessors, tooling, or brand packaging over time even if continuity is promised. Practical impact: re-check DPA and hosting annex annually. |
| Email-centric support | Not listed | Low Public materials emphasise human Dutch-team email support; TechRadar notes no live chat or phone. Practical impact: large orgs needing 24/7 phone SLAs may find coverage thin. |
When: You need default end-to-end / zero-access encryption for all messages
Consider: Proton Mail or Tuta
Runbox uses optional PGP/S/MIME; operator can access stored mail for filtering and lawful process
When: You want a German privacy-oriented host with similar sustainability positioning
Consider: Posteo
Compare jurisdiction (DE vs NO), domain limits, and feature depth
When: You need Belgian email with integrated collaboration extras
Consider: Mailfence
Different encryption defaults and product scope
When: You need global free-tier convenience and suite lock-in
Consider: Gmail or Outlook.com / Microsoft 365
Accept US jurisdiction and ad/suite economics tradeoffs
When: You need zero-knowledge E2EE and a privacy-first mobile/web ecosystem
Consider: Proton Mail or Tuta
Trade open IMAP convenience for stronger default content secrecy vs the provider.
When: You want German-hosted paid mail with broader office-style add-ons
Consider: mailbox.org or Posteo
Compare storage, admin features, and payment anonymity (Posteo) against Soverin’s domain/alias model.
When: You need Google- or Microsoft-class collaboration and global free consumer mail
Consider: Gmail or Microsoft 365 / Outlook.com
Different risk and advertising model; not EU-sovereignty substitutes.