Compare Runbox and Swissnode on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail
Norway· Email Services
Needs review
Shortlist Runbox when you need Norwegian/EEA-hosted IMAP email with custom domains, ad-free subscription economics, and standard clients. Skip when you require default zero-access E2EE—consider Proton Mail or Tuta instead—or when you need a full Microsoft 365-style suite.
Switzerland· Email Services
Needs review
Shortlist Swissnode for lean European cPanel domain email plus shared web or KVM VPS when Spain/EU residency is acceptable and you do not need enterprise compliance packs. Skip when you require live Swiss territorial hosting, E2EE mail, or published DPA/subprocessor inventories—consider Hostpoint, Infomaniak, or Proton Mail instead.
Highlighted rows differ between the two products.
| Feature | Runbox | Swissnode |
|---|---|---|
| Country of origin | Norway | Switzerland |
| Category | Email Services | Email Services |
| Open source | Yes | No |
| Self-hosted | No | No |
| Headquarters | Norway | Switzerland |
| Legal entity | Runbox Solutions AS | Swissnode (legal form/registry name not clearly published on marketing site) |
| Governing law | Norwegian law; Personal Data Act implementing GDPR (EEA) | Not clearly stated on marketing pages; confirm in contract (CH contact vs ES ops) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Core email and account content: servers in Oslo (StackInfra) under Norwegian jurisdiction; systems management Copyleft Solutions AS (Norway). Optional third parties per privacy policy: Stripe, PayPal, Coinbase (US payments); Enom (US domains); Gandi (FR); Domeneshop (NO); JaguarPC (US default web hosting, Norway option); NodePing (US, status page). No known US parent. | Vendor states primary hosting moved to a Spain data center after Swiss DC closure; homepage cites Spanish privacy laws. Site IP geolocates to Spain (Ipcore Datacenters). Optional Cloudflare CDN on web plans (US-group). Off-site backup provider not named. No public subprocessor inventory. |
| Summary | Norwegian subscription email hosting from Runbox Solutions AS: Oslo-hosted IMAP mailboxes, custom domains, CalDAV/CardDAV, and optional PGP. Ad-free; not default zero-access. | European cPanel email, shared web hosting, and KVM VPS under the Swissnode brand—vendor-stated Spain data center after Swiss DC closure, with optional Cloudflare CDN on web plans. |
| Tags |
| At a glance | Runbox | Swissnode |
|---|---|---|
| HQ | Oslo, Norway | Not listed |
| Legal entity | Runbox Solutions AS (orgnr 996877027) | Not listed |
| Founded | Service since 2000; current AS form 2011 | Not listed |
| Hosting | Email: StackInfra Oslo; optional web hosting may default US | Not listed |
| Open source | Partial (Runbox 7 web app); not self-hosted | No |
| Commercial model | Paid subscription + trial (no permanent free tier) | Package tiers (monthly/yearly); optional antispam add-on |
| Contact address | Not listed | Binzallee 6, 8055 Zurich, CH (public contact page) |
| Footer / ops address | Not listed | Mutilva Baja, Navarra, Spain |
| Primary hosting (vendor) | Not listed | Spain data center after Swiss DC closure |
| Core products | Not listed | Domain email, cPanel web hosting, KVM VPS |
| Control panels | Not listed | cPanel (shared); Virtualizor (VPS) |
| Self-hosted product | Not listed | No (provider-hosted; VPS gives root on rented VM) |
| Key capabilities | Runbox | Swissnode |
|---|---|---|
| Norwegian email hosting | Yes | Not listed |
| IMAP / POP / SMTP | Yes | Not listed |
| Custom domains | Yes | Not listed |
| 100% renewable (claimed) | Yes | Not listed |
| Runbox 7 open source | Yes | Not listed |
| Optional PGP / S/MIME | Yes | Not listed |
| cPanel domain email | Not listed | Yes |
| KVM VPS | Not listed | Yes |
| Spain data center (vendor) | Not listed | Yes |
| Optional Cloudflare CDN | Not listed | Yes |
| SMB hosting packages | Not listed | Yes |
Norwegian-hosted IMAP email with full-disk encryption
Mailboxes live on servers Runbox places in a StackInfra facility in Oslo under Norwegian jurisdiction, with full-disk encryption at rest and TLS (including PFS) in transit. Access via IMAP, POP, SMTP, or Runbox 7 webmail suits teams that need standard clients rather than a proprietary-only app.
Custom domains, aliases, and multi-account admin
Host mail on your own domain, manage sub-accounts from a main account, and use many aliases on Runbox domains plus unlimited aliases on customer domains. Plus-addressing and filters help separate identities without running separate mailboxes.
CalDAV/CardDAV plus optional PGP or S/MIME
Integrated calendar and contacts sync over CalDAV and CardDAV with common desktop and mobile apps. End-to-end confidentiality is user-controlled via PGP or S/MIME—not zero-access by default—so operators can still index mail for search and scan for malware.
Ad-free, subscription-funded privacy model
Runbox states it does not show ads, does not use third-party trackers such as Google Analytics, and only scans messages for spam/virus protection—not advertising. Revenue is subscription-based with a public trial period, aligning incentives away from data-mining free mail.
Runbox 7 open-source webmail on hydropowered infra
The Runbox 7 web client is published on GitHub for inspection; the hosted server stack remains largely proprietary. Email infrastructure is advertised as 100% certified renewable electricity in Norway, with additional company offset claims—useful for sustainability procurement checklists.
Domain email on cPanel (IMAP/POP/SMTP)
Business mailboxes on your domain with secure webmail, SpamAssassin-style spam control, virus filtering, DKIM, calendars/contacts, autoresponders, forwarders, filters, and mailing lists on mid-tier plans—protocol-compatible with Outlook, Apple Mail, and mobile clients.
cPanel web hosting with Softaculous and LiteSpeed PHP
Shared and reseller web plans with datacenter SSDs, free panel SSL, multi-PHP, SSH above entry tiers, and Softaculous one-click apps—aimed at brochure sites, WordPress, and small PHP apps rather than container platforms.
KVM VPS with RAID-10 enterprise SSDs
Root-level Linux VPS via KVM, enterprise SSDs, RAID-10 arrays, fixed per-VPS network allotments, and Virtualizor-style management for teams that outgrow shared hosting but still want package SKUs.
Optional Cloudflare CDN from the control panel
Web plans advertise easy Cloudflare integration to cache static assets near visitors—useful for performance, with the tradeoff that enabled CDN traffic can traverse a US-group network path.
Backup cadence for VPS (vendor-stated)
Marketing states daily on-site and weekly off-site VPS backups with rebuilds measured in minutes to an hour after failure—restore SLAs and off-site provider identity should be confirmed in the contract.
| Assurance & compliance | Runbox | Swissnode |
|---|---|---|
| Independent security / no-logs audit | Not found Vendor claims minimal logging and short retention windows; no public independent audit report found | Not found No public independent audit report found on swissnode.ch. |
| ISO 27001 | Not found No Runbox ISO 27001 certificate found on primary pages (power supplier ISO 14001 is environmental, not info-sec) | Not found No ISO 27001 claim located on official product/security pages. |
| SOC 2 / SOC 3 | Not found No public SOC 2/3 report located | Not found No SOC 2/3 claim found. |
| GDPR / EU data protection | Vendor claimed Norwegian entity; Personal Data Act implements GDPR; appointed DPO; privacy policy documents rights and retention | Partial Spain/EU hosting supports EU data-protection analysis, and homepage references Spanish privacy laws; usable privacy policy/DPA text not published on site. Customer remains controller for lawful basis. |
| US CLOUD Act exposure (indicative) | Partial No known US parent; core email in Norway. Medium/partial because privacy policy lists US third parties (Stripe, PayPal, Coinbase, Enom, JaguarPC web hosting default, NodePing). Not legal advice. | Partial No known US parent; primary host Spain/EU. Optional Cloudflare CDN is a US-group subprocessor for web static delivery; off-site backups and other SaaS paths not published. Not a clean low-exposure bill; not legal advice. |
| Data processing agreement (B2B) | Not found Processor DPA with Copyleft is mentioned; no public customer-facing B2B DPA template found—ask sales/support | Not found No public DPA download or B2B processing terms found; request in writing. |
| EU AI Act | Not applicable Email hosting product; vendor states no intrusive AI for ad profiling | Not applicable Commodity hosting/email/VPS, not an AI product. |
| Swiss territorial hosting | Not listed | Partial Vendor discloses Swiss DC closed; operations from Spain DC. Contact still Zurich. Do not treat as CH-only residency. |
| Considerations & known limitations | Runbox | Swissnode |
|---|---|---|
| Not default zero-access encryption | Medium Unlike Proton/Tuta, Runbox can access stored mail for spam/virus scanning, indexing, and lawful process. Use PGP/S/MIME when E2EE is required. | Not listed |
| US vendors on optional product paths | Medium Payments (Stripe/PayPal/Coinbase), domain registrar Enom, and default JaguarPC web hosting introduce US processors. Keep web hosting in Norway and minimize US payment data if policy requires. | Not listed |
| No public ISO 27001 / SOC 2 / independent audit | Medium Assurance relies on vendor policy, Norwegian law, and facility claims. Regulated buyers may need NDA evidence or on-site questionnaire. | Not listed |
| Partial open source only | Low Runbox 7 webmail is open source; mail backend is proprietary SaaS—no self-host path. | Not listed |
| Post-closure and backup retention | Low Privacy policy defines multi-month content retention and backup windows after closure (and longer account-info retention for bookkeeping). Request immediate deletion if policy requires faster wipe. | Not listed |
| Swiss brand vs Spain hosting | Not listed | High Product pages state the Swiss data center closed and services run in Spain; homepage cites Spanish privacy laws. Buyers assuming Zurich colocation from the brand or older materials will mis-classify risk and contractual residency. |
| Empty privacy pages / no public DPA or certs | Not listed | High Privacy and cookie URLs do not present substantive policy text; ISO/SOC and DPA artifacts were not found. Regulated or enterprise buyers face a heavy offline diligence burden. |
| Optional Cloudflare CDN (US-group) | Not listed | Medium Web hosting markets Cloudflare integration from cPanel. Enabling CDN can place static content on a US-group network path even when origin is Spain—document this in transfer assessments. |
| Off-site backup provider not named | Not listed | Medium Daily on-site and weekly off-site backups are claimed for VPS, but the off-site location/provider is not published—ask before trusting disaster-recovery or residency narratives. |
| Aging marketing surface | Not listed | Low Public site still shows 2013–2018 copyright and sparse modern trust pages; may signal limited investment in public assurance UX even if infrastructure remains operational. |
When: You need default end-to-end / zero-access encryption for all messages
Consider: Proton Mail or Tuta
Runbox uses optional PGP/S/MIME; operator can access stored mail for filtering and lawful process
When: You want a German privacy-oriented host with similar sustainability positioning
Consider: Posteo
Compare jurisdiction (DE vs NO), domain limits, and feature depth
When: You need Belgian email with integrated collaboration extras
Consider: Mailfence
Different encryption defaults and product scope
When: You need global free-tier convenience and suite lock-in
Consider: Gmail or Outlook.com / Microsoft 365
Accept US jurisdiction and ad/suite economics tradeoffs
When: You need Swiss-resident email/office with a broader product catalog and clearer CH hosting claims
Consider: Hostpoint E-Mail & Cloud Office or Infomaniak kMail
Fuller Swiss platforms; better when territorial Switzerland is non-negotiable.
When: You need end-to-end encrypted mail and open-source clients rather than cPanel hosting
Consider: Proton Mail
Different product class: E2EE vs classic hosted IMAP.
When: You need full collaboration suites, admin compliance tooling, and ecosystem apps
Consider: Microsoft 365 or Google Workspace (US-group control planes)
Richer features; different jurisdiction/CLOUD Act profile.
When: You want a larger EU hosting group with broader cloud SKUs
Consider: IONOS or OVHcloud
Scale and catalog depth over niche Swissnode packaging.