Compare Soverin and web.de on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Outlook.com
Netherlands· Email Services
Needs review
Shortlist Soverin when you want Dutch-operated, paid IMAP email with custom domains, unlimited aliases, and strong mail-auth standards without Google/Microsoft ads. Skip when you need zero-knowledge E2EE—consider Proton Mail or Tuta instead—or a full productivity suite (mailbox.org / Microsoft 365).
Germany· Email Services
Needs review
Shortlist web.de when you need mass-market German freemail with DE-sited mail/cloud, E-Mail made in Germany TLS alliance markers, optional PGP/2FA, and a familiar DACH portal. Skip when you need default E2EE, no advertising data path, self-host, or enterprise admin—consider Posteo, mailbox.org, Tuta, or Proton Mail instead.
Highlighted rows differ between the two products.
| Feature | Soverin | |
|---|---|---|
| Country of origin | Netherlands | Germany |
| Category | Email Services | Email Services |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Netherlands | Germany |
| Legal entity | Soverin B.V. (Amsterdam); owned by The Sharing Group / TSG Online (Dutch) as of September 2025 acquisition announcement | 1&1 Mail & Media GmbH (United Internet AG group) |
| Governing law | Not listed | Germany / EU GDPR |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Low |
| Hosting / residency | Vendor: EU-only processing; data in NL; self-operated Dutch DCs, no hyperscaler. TechRadar: 3 NL DCs. Core mail hosts on Soverin B.V. AS211993. External first-line support partner under DPA/NDA (country unpublished). HIBP k-anon password checks; Let’s Encrypt; domain DNSSEC partner. No AWS/GCP/Azure as primary mailbox hosts in public materials. | Vendor claims email and Online-Speicher stored exclusively in Germany in company-owned data centers (E-Mail/Cloud made in Germany). FreeMail monetized via advertising and IAB TCF consent partners; privacy notice allows EEA third-country transfers with Chapter V safeguards. Portal/optional features use additional processors (e.g. search partners, embeds, homepage builder DUDA Inc., ID vendors). No exhaustive public mail-stack subprocessor list found. |
| Summary | Dutch privacy-first email hosting: custom domains, open IMAP/SMTP/CalDAV, 25 GB mailboxes, no ads or content scanning, servers operated in the Netherlands. | German freemail and portal from United Internet’s 1&1 Mail & Media GmbH: FreeMail with DE-sited mail and cloud, E-Mail made in Germany TLS alliance, optional PGP—consumer SaaS, not default-E2EE privacy mail. |
| Tags |
| At a glance | Soverin | |
|---|---|---|
| HQ | Amsterdam, Netherlands (Soverin B.V.) | Not listed |
| Group | The Sharing Group / TSG Online (acq. Sep 2025) | Not listed |
| Hosting | Dutch data centres; vendor claims self-operated, no hyperscaler | Not listed |
| Protocols | IMAP, SMTP, CalDAV, CardDAV | Not listed |
| Storage | 25 GB per mailbox (vendor-stated) | Not listed |
| Self-host / OSS | No / No | Not listed |
| Commercial model | Annual prepaid; 30-day mailbox money-back; no free tier | Ad-supported FreeMail; paid mailbox/cloud upgrades; Consent or Pay |
| HQ / operator | Not listed | 1&1 Mail & Media GmbH, Montabaur/Karlsruhe, Germany |
| Parent group | Not listed | United Internet AG (Germany) |
| Product type | Not listed | Consumer freemail + portal + cloud (SaaS) |
| Hosting (vendor claim) | Not listed | Company-owned data centers in Germany |
| Open source | Not listed | No |
| Self-host | Not listed | No |
| Key capabilities | Soverin | |
|---|---|---|
| NL / EU operated | Yes | Yes |
| Custom domains | Yes | Not listed |
| IMAP / CalDAV | Yes | Not listed |
| No ads / no tracking | Yes | Not listed |
| ISO 27001 (claimed) | Yes | Not listed |
| DANE / DNSSEC | Yes | Not listed |
| E-Mail made in Germany | Not listed | Yes |
| Germany data centers (claimed) | Not listed | Yes |
| Optional PGP | Not listed | Yes |
| FreeMail + paid upgrades | Not listed | Yes |
| SaaS only | Not listed | Yes |
Custom domains with unlimited aliases
Host mail on your own domain (bring existing or register through Soverin). Unlimited aliases—plus-addressing or domain names—deliver into one mailbox, plus optional random @sinenomine.email private aliases that hide the real address. Suits freelancers and SMEs who need brandable addresses without per-alias fees.
Open IMAP/SMTP plus CalDAV/CardDAV
Use any standards-based client or device for mail, calendar, and contacts—no proprietary app required. Dashboard import helps migrate from other providers. Ideal when IT wants Thunderbird, Apple Mail, or Outlook without locking into a closed webmail ecosystem; not a zero-knowledge E2EE product by default.
Mail-path security: DANE, DKIM, DMARC, IP stripping
Outbound and inbound paths use TLS; Soverin publishes and honours DANE/TLSA, signs with DKIM, publishes SPF/DMARC, enables DNSSEC on managed domains, and strips personal IP addresses from outbound headers. 2FA is available and can be admin-mandated. Buyers still need their own OpenPGP setup for end-to-end content secrecy with external parties.
25 GB mailboxes with per-user encrypted backups
Each mailbox includes a stated 25 GB quota covering mail, calendar, and contacts. Nightly backups use individually generated keys; Soverin states that emptying trash permanently deletes data and that leaving the service removes backups when the key is destroyed. Extra mailboxes can share storage for small teams.
Multi-mailbox and channel-friendly business use
Purchase and assign additional mailboxes on a domain, with admin tooling for teams. Soverin markets to hosters, ISPs, MSPs, and independent professionals for multi-mailbox and white-label scenarios—useful when you want Dutch-operated email without building your own mail stack.
E-Mail made in Germany alliance transport
Founding member of the German provider alliance (WEB.DE, GMX, 1&1, STRATO, T-Online, freenet). TLS on paths inside the alliance, mail stored in Germany, and green checkmarks on alliance addresses in the compose UI. Does not encrypt content to non-alliance or non-PGP recipients end-to-end by default.
FreeMail + paid upgrades with intelligent inbox
Ad-supported FreeMail with integrated calendar, contacts, and Online-Speicher. Intelligent inbox categorizes newsletters, orders, social, and contracts/subscriptions without duplicating messages; optional package tracking via DHL, DPD, and GLS when consented. Paid tiers expand quotas and reduce ad/tracking friction under Consent or Pay.
Optional PGP and free 2FA
Optional PGP end-to-end encryption for sensitive mail (both parties need keys/compatible clients). Optional free two-factor authentication for account login. Baseline mailbox protection relies on account credentials, spam/virus filters, and TLS—not default E2EE for every message.
Cloud made in Germany Online-Speicher
Mailbox-integrated cloud with browser, app, and desktop access; link sharing and Online Office for documents. Vendor claims exclusive German data-center storage and TLS in transit under Cloud made in Germany. Free tier includes a starter cloud quota; larger capacities are paid add-ons. Not a full Google Drive/OneDrive collab suite.
German consumer portal on the same identity
News, services, WEB.Cent cashback, and optional Deutsche Post letter preview sit beside mail. Useful for personal DACH users; increases advertising and partner surface versus a pure mailbox product. Portal embeds and partners are consent-gated where required.
| Assurance & compliance | Soverin | |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party no-logs or full security audit PDF located; privacy claims are first-party. | Not found No public independent no-logs or full security audit package found for FreeMail; alliance pages claim oversight by data-protection function and independent Prüfstellen at a high level only. |
| ISO 27001 | Vendor claimed Vendor states independently audited ISO 27001; certificates available on request via support@soverin.net. Not re-verified against a public registry entry in this pass. | Not found No public ISO 27001 certificate page located for the web.de freemail product during research. |
| SOC 2 / SOC 3 | Not found No SOC 2/3 claim found on primary pages reviewed. | Not found No public SOC 2/3 report found for web.de FreeMail. |
| GDPR / EU data protection | Vendor claimed NL entity; AVG-framed privacy statement; EU-only processing claimed; GDPR Proof messaging on recognitions page. | Vendor claimed German controller (1&1 Mail & Media GmbH); detailed GDPR privacy notice; DE storage claims for mail/cloud. Not a legal certification. |
| US CLOUD Act exposure (indicative) | Partial EuropeanStack assessment: low exposure path—Dutch Soverin B.V., Dutch The Sharing Group owner, claimed self-operated NL hosting without public AWS/GCP/Azure mailbox hosts. Partial because residual subprocessors (support partner jurisdiction, domain partners, HIBP hash checks) need buyer confirmation. Not legal advice. | Partial EU/German entity and parent; no known US parent; mail/cloud claimed on company-owned DE data centers. Partial because privacy notice allows third-country transfers with safeguards, FreeMail uses ad/TCF partners, and no exhaustive public subprocessor inventory. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Privacy statement states it qualifies as an Article 28 AVG processing agreement; other DPAs expressly rejected. Confirm signed annex for enterprise use. | Not found Consumer freemail focus; no clear self-serve public B2B DPA for FreeMail found. Request under contract if treating as processor for an organization. |
| EU AI Act | Not applicable Email hosting product; vendor emphasises no AI scanning/mining of mailbox content for ads. | Not applicable Consumer mail/portal with limited in-product assistants; not an AI-centric product for this checklist. |
| ISO 9001 / ISO 14001 | Vendor claimed Vendor-claimed quality and environmental certifications; certificates on request. | Not listed |
| NIS2 readiness | Vendor claimed Vendor markets NIS2 Ready; buyer press also asserts NIS2 compliance—confirm evidence package. | Not listed |
| NEN 7510 (healthcare NL) | Partial Vendor states NEN 7510 certification is in progress, not completed. | Not listed |
| Considerations & known limitations | Soverin | |
|---|---|---|
| Not zero-knowledge E2EE by default | Medium Unlike Proton/Tuta, Soverin is a classic IMAP host. Provider infrastructure can process content for delivery and spam filtering. Practical impact: unsuitable as a drop-in for policies that require provider-blind encryption without extra client crypto. | Not listed |
| Unnamed external support partner | Medium Privacy statement discloses a first-line support partner with limited account data under DPA/NDA, but does not publish the partner name or country. Practical impact: add an open diligence item for any regulated workload. | Not listed |
| ISO certificates not self-serve public | Low ISO 27001/9001/14001 are claimed with certificates via support rather than a public PDF registry link found in research. Practical impact: procurement should request current attestations before treating certs as verified. | Not listed |
| 2025 group acquisition | Low The Sharing Group acquisition may change subprocessors, tooling, or brand packaging over time even if continuity is promised. Practical impact: re-check DPA and hosting annex annually. | Not listed |
| Email-centric support | Low Public materials emphasise human Dutch-team email support; TechRadar notes no live chat or phone. Practical impact: large orgs needing 24/7 phone SLAs may find coverage thin. | Not listed |
| Ad-financed FreeMail and consent surface | Not listed | Medium FreeMail uses advertising and Consent or Pay. With consent, content may feed interest profiles; FreeMail users cannot drop WEB.DE informiert like paid tiers. Unsuitable where ad-tech processors are banned. |
| No default end-to-end encryption | Not listed | Medium TLS and alliance transport protection are not content E2EE. Optional PGP only covers willing counterparties. Operator can process plaintext for spam, intelligent inbox, and consented ad analysis. |
| Limited public audit/cert artifacts | Not listed | Medium ISO 27001, SOC 2, and independent no-logs audits not found on public product pages. Trust rests on German entity, DE hosting claims, and first-party security copy. |
| Third-country transfers and portal partners | Not listed | Low Privacy notice contemplates non-EEA recipients under Chapter V safeguards. Portal/search/ID/ad features introduce extra processors beyond the mailbox DC story—review consent layer and purpose before sensitive use. |
| FreeMail inactivity content deletion | Not listed | Low Privacy notice: FreeMail email content may be deleted after more than 180 days without login. Not a durable archive without activity or export. |
When: You need zero-knowledge E2EE and a privacy-first mobile/web ecosystem
Consider: Proton Mail or Tuta
Trade open IMAP convenience for stronger default content secrecy vs the provider.
When: You want German-hosted paid mail with broader office-style add-ons
Consider: mailbox.org or Posteo
Compare storage, admin features, and payment anonymity (Posteo) against Soverin’s domain/alias model.
When: You need Google- or Microsoft-class collaboration and global free consumer mail
Consider: Gmail or Microsoft 365 / Outlook.com
Different risk and advertising model; not EU-sovereignty substitutes.
When: You need default E2EE and a privacy-first paid mailbox
Consider: Tuta or Proton Mail
web.de PGP is optional and counterpart-dependent; FreeMail is ad-financed.
When: You want ad-free German/EU mail with strong consumer privacy posture and paid model only
Consider: Posteo or mailbox.org
Less portal monetization; clearer privacy-first product framing than mass freemail.
When: You prefer the same United Internet Mail & Media stack under another brand
Consider: GMX Mail
Nearly aligned trust and capability story; brand and portal mix differ.
When: You need Google/Microsoft-class workspace collab and enterprise compliance packs
Consider: Gmail (Google Workspace) or Outlook.com / Microsoft 365
Trade DE freemail residency story for US-group platforms and deeper admin tooling.