Compare Runbox and web.de on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Outlook.com
Norway· Email Services
Needs review
Shortlist Runbox when you need Norwegian/EEA-hosted IMAP email with custom domains, ad-free subscription economics, and standard clients. Skip when you require default zero-access E2EE—consider Proton Mail or Tuta instead—or when you need a full Microsoft 365-style suite.
Germany· Email Services
Needs review
Shortlist web.de when you need mass-market German freemail with DE-sited mail/cloud, E-Mail made in Germany TLS alliance markers, optional PGP/2FA, and a familiar DACH portal. Skip when you need default E2EE, no advertising data path, self-host, or enterprise admin—consider Posteo, mailbox.org, Tuta, or Proton Mail instead.
Highlighted rows differ between the two products.
| Feature | Runbox | |
|---|---|---|
| Country of origin | Norway | Germany |
| Category | Email Services | Email Services |
| Open source | Yes | No |
| Self-hosted | No | No |
| Headquarters | Norway | Germany |
| Legal entity | Runbox Solutions AS | 1&1 Mail & Media GmbH (United Internet AG group) |
| Governing law | Norwegian law; Personal Data Act implementing GDPR (EEA) | Germany / EU GDPR |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Low |
| Hosting / residency | Core email and account content: servers in Oslo (StackInfra) under Norwegian jurisdiction; systems management Copyleft Solutions AS (Norway). Optional third parties per privacy policy: Stripe, PayPal, Coinbase (US payments); Enom (US domains); Gandi (FR); Domeneshop (NO); JaguarPC (US default web hosting, Norway option); NodePing (US, status page). No known US parent. | Vendor claims email and Online-Speicher stored exclusively in Germany in company-owned data centers (E-Mail/Cloud made in Germany). FreeMail monetized via advertising and IAB TCF consent partners; privacy notice allows EEA third-country transfers with Chapter V safeguards. Portal/optional features use additional processors (e.g. search partners, embeds, homepage builder DUDA Inc., ID vendors). No exhaustive public mail-stack subprocessor list found. |
| Summary | Norwegian subscription email hosting from Runbox Solutions AS: Oslo-hosted IMAP mailboxes, custom domains, CalDAV/CardDAV, and optional PGP. Ad-free; not default zero-access. | German freemail and portal from United Internet’s 1&1 Mail & Media GmbH: FreeMail with DE-sited mail and cloud, E-Mail made in Germany TLS alliance, optional PGP—consumer SaaS, not default-E2EE privacy mail. |
| Tags |
| At a glance | Runbox | |
|---|---|---|
| HQ | Oslo, Norway | Not listed |
| Legal entity | Runbox Solutions AS (orgnr 996877027) | Not listed |
| Founded | Service since 2000; current AS form 2011 | Not listed |
| Hosting | Email: StackInfra Oslo; optional web hosting may default US | Not listed |
| Open source | Partial (Runbox 7 web app); not self-hosted | No |
| Commercial model | Paid subscription + trial (no permanent free tier) | Ad-supported FreeMail; paid mailbox/cloud upgrades; Consent or Pay |
| HQ / operator | Not listed | 1&1 Mail & Media GmbH, Montabaur/Karlsruhe, Germany |
| Parent group | Not listed | United Internet AG (Germany) |
| Product type | Not listed | Consumer freemail + portal + cloud (SaaS) |
| Hosting (vendor claim) | Not listed | Company-owned data centers in Germany |
| Self-host | Not listed | No |
| Key capabilities | Runbox | |
|---|---|---|
| Norwegian email hosting | Yes | Not listed |
| IMAP / POP / SMTP | Yes | Not listed |
| Custom domains | Yes | Not listed |
| 100% renewable (claimed) | Yes | Not listed |
| Runbox 7 open source | Yes | Not listed |
| Optional PGP / S/MIME | Yes | Not listed |
| DE-operated freemail | Not listed | Yes |
| E-Mail made in Germany | Not listed | Yes |
| Germany data centers (claimed) | Not listed | Yes |
| Optional PGP | Not listed | Yes |
| FreeMail + paid upgrades | Not listed | Yes |
| SaaS only | Not listed | Yes |
Norwegian-hosted IMAP email with full-disk encryption
Mailboxes live on servers Runbox places in a StackInfra facility in Oslo under Norwegian jurisdiction, with full-disk encryption at rest and TLS (including PFS) in transit. Access via IMAP, POP, SMTP, or Runbox 7 webmail suits teams that need standard clients rather than a proprietary-only app.
Custom domains, aliases, and multi-account admin
Host mail on your own domain, manage sub-accounts from a main account, and use many aliases on Runbox domains plus unlimited aliases on customer domains. Plus-addressing and filters help separate identities without running separate mailboxes.
CalDAV/CardDAV plus optional PGP or S/MIME
Integrated calendar and contacts sync over CalDAV and CardDAV with common desktop and mobile apps. End-to-end confidentiality is user-controlled via PGP or S/MIME—not zero-access by default—so operators can still index mail for search and scan for malware.
Ad-free, subscription-funded privacy model
Runbox states it does not show ads, does not use third-party trackers such as Google Analytics, and only scans messages for spam/virus protection—not advertising. Revenue is subscription-based with a public trial period, aligning incentives away from data-mining free mail.
Runbox 7 open-source webmail on hydropowered infra
The Runbox 7 web client is published on GitHub for inspection; the hosted server stack remains largely proprietary. Email infrastructure is advertised as 100% certified renewable electricity in Norway, with additional company offset claims—useful for sustainability procurement checklists.
E-Mail made in Germany alliance transport
Founding member of the German provider alliance (WEB.DE, GMX, 1&1, STRATO, T-Online, freenet). TLS on paths inside the alliance, mail stored in Germany, and green checkmarks on alliance addresses in the compose UI. Does not encrypt content to non-alliance or non-PGP recipients end-to-end by default.
FreeMail + paid upgrades with intelligent inbox
Ad-supported FreeMail with integrated calendar, contacts, and Online-Speicher. Intelligent inbox categorizes newsletters, orders, social, and contracts/subscriptions without duplicating messages; optional package tracking via DHL, DPD, and GLS when consented. Paid tiers expand quotas and reduce ad/tracking friction under Consent or Pay.
Optional PGP and free 2FA
Optional PGP end-to-end encryption for sensitive mail (both parties need keys/compatible clients). Optional free two-factor authentication for account login. Baseline mailbox protection relies on account credentials, spam/virus filters, and TLS—not default E2EE for every message.
Cloud made in Germany Online-Speicher
Mailbox-integrated cloud with browser, app, and desktop access; link sharing and Online Office for documents. Vendor claims exclusive German data-center storage and TLS in transit under Cloud made in Germany. Free tier includes a starter cloud quota; larger capacities are paid add-ons. Not a full Google Drive/OneDrive collab suite.
German consumer portal on the same identity
News, services, WEB.Cent cashback, and optional Deutsche Post letter preview sit beside mail. Useful for personal DACH users; increases advertising and partner surface versus a pure mailbox product. Portal embeds and partners are consent-gated where required.
| Assurance & compliance | Runbox | |
|---|---|---|
| Independent security / no-logs audit | Not found Vendor claims minimal logging and short retention windows; no public independent audit report found | Not found No public independent no-logs or full security audit package found for FreeMail; alliance pages claim oversight by data-protection function and independent Prüfstellen at a high level only. |
| ISO 27001 | Not found No Runbox ISO 27001 certificate found on primary pages (power supplier ISO 14001 is environmental, not info-sec) | Not found No public ISO 27001 certificate page located for the web.de freemail product during research. |
| SOC 2 / SOC 3 | Not found No public SOC 2/3 report located | Not found No public SOC 2/3 report found for web.de FreeMail. |
| GDPR / EU data protection | Vendor claimed Norwegian entity; Personal Data Act implements GDPR; appointed DPO; privacy policy documents rights and retention | Vendor claimed German controller (1&1 Mail & Media GmbH); detailed GDPR privacy notice; DE storage claims for mail/cloud. Not a legal certification. |
| US CLOUD Act exposure (indicative) | Partial No known US parent; core email in Norway. Medium/partial because privacy policy lists US third parties (Stripe, PayPal, Coinbase, Enom, JaguarPC web hosting default, NodePing). Not legal advice. | Partial EU/German entity and parent; no known US parent; mail/cloud claimed on company-owned DE data centers. Partial because privacy notice allows third-country transfers with safeguards, FreeMail uses ad/TCF partners, and no exhaustive public subprocessor inventory. Not legal advice. |
| Data processing agreement (B2B) | Not found Processor DPA with Copyleft is mentioned; no public customer-facing B2B DPA template found—ask sales/support | Not found Consumer freemail focus; no clear self-serve public B2B DPA for FreeMail found. Request under contract if treating as processor for an organization. |
| EU AI Act | Not applicable Email hosting product; vendor states no intrusive AI for ad profiling | Not applicable Consumer mail/portal with limited in-product assistants; not an AI-centric product for this checklist. |
| Considerations & known limitations | Runbox | |
|---|---|---|
| Not default zero-access encryption | Medium Unlike Proton/Tuta, Runbox can access stored mail for spam/virus scanning, indexing, and lawful process. Use PGP/S/MIME when E2EE is required. | Not listed |
| US vendors on optional product paths | Medium Payments (Stripe/PayPal/Coinbase), domain registrar Enom, and default JaguarPC web hosting introduce US processors. Keep web hosting in Norway and minimize US payment data if policy requires. | Not listed |
| No public ISO 27001 / SOC 2 / independent audit | Medium Assurance relies on vendor policy, Norwegian law, and facility claims. Regulated buyers may need NDA evidence or on-site questionnaire. | Not listed |
| Partial open source only | Low Runbox 7 webmail is open source; mail backend is proprietary SaaS—no self-host path. | Not listed |
| Post-closure and backup retention | Low Privacy policy defines multi-month content retention and backup windows after closure (and longer account-info retention for bookkeeping). Request immediate deletion if policy requires faster wipe. | Not listed |
| Ad-financed FreeMail and consent surface | Not listed | Medium FreeMail uses advertising and Consent or Pay. With consent, content may feed interest profiles; FreeMail users cannot drop WEB.DE informiert like paid tiers. Unsuitable where ad-tech processors are banned. |
| No default end-to-end encryption | Not listed | Medium TLS and alliance transport protection are not content E2EE. Optional PGP only covers willing counterparties. Operator can process plaintext for spam, intelligent inbox, and consented ad analysis. |
| Limited public audit/cert artifacts | Not listed | Medium ISO 27001, SOC 2, and independent no-logs audits not found on public product pages. Trust rests on German entity, DE hosting claims, and first-party security copy. |
| Third-country transfers and portal partners | Not listed | Low Privacy notice contemplates non-EEA recipients under Chapter V safeguards. Portal/search/ID/ad features introduce extra processors beyond the mailbox DC story—review consent layer and purpose before sensitive use. |
| FreeMail inactivity content deletion | Not listed | Low Privacy notice: FreeMail email content may be deleted after more than 180 days without login. Not a durable archive without activity or export. |
When: You need default end-to-end / zero-access encryption for all messages
Consider: Proton Mail or Tuta
Runbox uses optional PGP/S/MIME; operator can access stored mail for filtering and lawful process
When: You want a German privacy-oriented host with similar sustainability positioning
Consider: Posteo
Compare jurisdiction (DE vs NO), domain limits, and feature depth
When: You need Belgian email with integrated collaboration extras
Consider: Mailfence
Different encryption defaults and product scope
When: You need global free-tier convenience and suite lock-in
Consider: Gmail or Outlook.com / Microsoft 365
Accept US jurisdiction and ad/suite economics tradeoffs
When: You need default E2EE and a privacy-first paid mailbox
Consider: Tuta or Proton Mail
web.de PGP is optional and counterpart-dependent; FreeMail is ad-financed.
When: You want ad-free German/EU mail with strong consumer privacy posture and paid model only
Consider: Posteo or mailbox.org
Less portal monetization; clearer privacy-first product framing than mass freemail.
When: You prefer the same United Internet Mail & Media stack under another brand
Consider: GMX Mail
Nearly aligned trust and capability story; brand and portal mix differ.
When: You need Google/Microsoft-class workspace collab and enterprise compliance packs
Consider: Gmail (Google Workspace) or Outlook.com / Microsoft 365
Trade DE freemail residency story for US-group platforms and deeper admin tooling.