← Back to Directory
Logo: mailbox (formerly mailbox.org)

mailbox (formerly mailbox.org)

German paid digital workplace from Heinlein Hosting GmbH: secure email with PGP/S/MIME, Drive, browser Office, Meet, and business Admin on dual Berlin data centres.

emailproductivityprivacygdprgerman-hostingbsi-c5iso-27001collaboration
Visit WebsiteAsk an EU migration specialistFeedback & corrections

mailbox (rebranded from mailbox.org in 2025) is a paid, ad-free digital workplace from Berlin-based Heinlein Hosting GmbH. It packages secure email, calendar and contacts, cloud Drive, browser office apps, and Meet video into one German-hosted suite for private users, SMEs, schools, and public-sector teams.

It exists as a German Microsoft 365 / Google Workspace alternative under German and EU law, without a permanent free tier. Mail is the core, with PGP via the built-in Guard flow (or Mailvelope), S/MIME for business, and transport hardening the vendor highlights publicly.

The concrete differentiator is that full workplace suite on dual independent Berlin data centres, plus Business Admin for domain and mailbox management. Meet uses an OpenTalk stack hosted in those German sites, according to the privacy notice.

German-operatedBerlin dual-site hostingPGP + S/MIMEBSI C5 Type 1 (claimed)ISO 27001 (claimed)Mail + Drive + Meet + Office

Shortlist mailbox when you need a German-operated email-plus-collaboration suite (Mail, Drive, Office, Meet, Admin/API) on dual Berlin sites with published BSI C5 Type 1 and ISO 27001 claims. Skip when you require free forever mail or default zero-knowledge for all messages—consider Proton Mail or Tuta instead.

Key capabilities

Webmail Guard for PGP without extra software (or Mailvelope with local keys), S/MIME for sign/encrypt, 2FA and app passwords, multi-stage spam/virus rejection, plus public transport controls (DNSSEC, DANE, MTA-STS, DMARC/DKIM/SPF, TLS checker, @secure.mailbox.org aliases). Benefits security-minded teams that still need interoperable IMAP/SMTP; content is not zero-knowledge by default unless you encrypt.

Cloud files on the provider's own German infrastructure with two independent Berlin locations, WebDAV, mobile apps, guest share links, expandable quota, and optional client-side OpenPGP encryption of stored files. Fits teams replacing consumer cloud drives while keeping residency claims concrete; confirm plan quotas on the official site.

Edit common office formats in the browser, share calendars and contacts via open CalDAV/CardDAV standards, plus tasks, notes, polls, and TLS-secured XMPP chat. Aimed at SMEs and schools that want collaboration without a full Microsoft desktop stack; advanced Excel macros and deep Office add-ins are not the target.

Browser-based conferencing integrated with calendar and mail: link invites for external guests, breakout rooms, screen share, chat, surveys, and moderator controls. Privacy documentation references the OpenTalk stack; sessions run through mailbox's German data centres. Evaluate E2EE defaults and recording policies against your meeting compliance needs.

Central management of domains, mailboxes, quotas, spam/virus settings, IP allowlists, and backups, with an HTTP API for larger orgs and resellers (api.mailbox.org). Supports onboarding help and partner-assisted migration. Better for multi-seat German operations than pure consumer inboxes; not a full IdP replacement without SSO design work.

At a glance

HQ
Berlin, Germany
Legal entity
Heinlein Hosting GmbH
Hosting
Own servers, dual independent Berlin sites
Model
Paid subscription SaaS; trial available; no permanent free tier
Self-host
No (managed SaaS)
Open standards
IMAP/SMTP, CalDAV/CardDAV, WebDAV, PGP, S/MIME

Best fit when

  • German or EU orgs replacing Gmail/Microsoft 365 for mail and light collaboration under German law
  • Teams that need IMAP/SMTP plus CalDAV/CardDAV and optional custom domains
  • Buyers that will use PGP Guard or S/MIME deliberately for sensitive mail
  • SMEs and schools wanting Drive, browser Office, and Meet without a US hyperscaler
  • Organisations that need multi-seat Admin, DPA, and an automation API

Poor fit when

  • Users who need a permanent free tier
  • Buyers requiring default zero-knowledge mail for every user without crypto setup
  • Teams that must self-host the full stack on their own infrastructure
  • Enterprises whose workflows depend on deep Microsoft Graph or Google Workspace add-ons

Consider instead when

  • When: You need default end-to-end encrypted mail as the primary product

    Consider: Proton Mail or Tuta

    Stronger E2EE-first posture; lighter full workplace suite than mailbox

  • When: You want minimal German privacy email without Drive/Office/Meet

    Consider: Posteo

    Leaner mailbox; fewer collaboration modules

  • When: You need full desktop Office parity and global SaaS integrations

    Consider: Microsoft 365 (incumbent) with separate residency controls

    Different risk and ecosystem tradeoff—not an EU peer

Jurisdiction & ownership

Legal entity
Heinlein Hosting GmbH (Berlin; CEO Peer Heinlein)
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Low
Hosting / residency
Core mailbox, Drive, and Meet on Heinlein-operated servers in German data centres in Berlin (two independent locations). Website analytics: self-hosted Matomo. Marketing site may embed Vimeo/YouTube. No public AWS/GCP/Azure product hosting region found for customer mail data.

Indicative only—not legal advice. German entity, no known US parent, self-operated DE hosting for product data. Confirm payment processors and full AVV annex; residual website embed and payment paths may involve non-EU parties outside the core mail path.

  • Independent security / no-logs auditNot found
  • ISO 27001Vendor claimed
  • SOC 2 / SOC 3Not found
  • BSI C5Vendor claimed
  • +4

Considerations & known limitations

  • MediumMail is not zero-knowledge by default

    Without PGP/S/MIME, stored message content remains operator-accessible under legal process. Practical impact: train users or mandate Guard/S/MIME for confidential traffic.

  • LowC5 Type 1 is point-in-time

    Type 1 attestations describe design/implementation at a point in time. Re-check type (1 vs 2), scope, and renewal dates for public-sector RFPs.

  • LowPayment and edge processors need confirmation

    Core hosting is self-operated DE, but privacy text references external payment services; marketing embeds US video hosts. Ask for the current processor list with the DPA.

  • MediumNot a full Microsoft 365 ecosystem substitute

    Browser Office and Meet cover common collaboration; deep desktop macros, Graph automations, and third-party M365 marketplaces will not map 1:1.

  • LowNo customer self-host option

    Organisations that must operate mail on their own iron need another stack; mailbox is multi-tenant SaaS.

Open questions for due diligence

  • What is the exact current BSI C5 scope, type, and validity period on the attestation document?
  • Which payment processors and any other subprocessors appear in the live AVV annex?
  • What is the default Meet encryption mode (TLS-only vs optional E2EE) for your plan, and is recording available?
  • Which SSO/IdP integrations are supported for your business tier beyond generic SSO mentions?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

mailbox is a hosted SaaS product operated by Heinlein Hosting GmbH on the company's German infrastructure. It is not offered as a customer-operated self-host package. Related Heinlein Group products (for example OpenTalk) exist in the broader ecosystem, but the mailbox suite itself is the managed service. Choose it when you want German-operated SaaS, not when you must run mail servers yourself.

Transport is TLS-hardened. Optional content encryption uses PGP (Guard or Mailvelope) and S/MIME; Drive supports client-side OpenPGP for files. Mail stored without PGP/S/MIME is protected by provider controls and legal process, not pure zero-knowledge. That differs from providers that default all mailbox content to E2EE. Plan training and Guard/S/MIME enrolment if confidential content must stay opaque to the operator.

Core mail, Drive, and Meet data are described as stored on own servers in Berlin data centres (two independent sites), under a German legal entity with no known US parent. That is a relatively low indicative US CLOUD Act ownership risk versus US hyperscale SaaS. It is still not a legal opinion: confirm the live subprocessor/payment list in the DPA, note that marketing pages may embed US video hosts, and treat BSI C5 Type 1 as a time-bounded attestation to re-check.

Yes—business documentation states customers can conclude a DPA (AVV) online. Public assurance claims include ISO/IEC 27001:2022, BSI C5 Type 1, BSI IT security label for mail plans, and periodic transparency reports on authority requests. Request current certificates, C5 type/period, and the processor annex in RFP diligence rather than relying only on marketing seals.

Pick Proton Mail or Tuta when default end-to-end encrypted mail is the primary requirement and a lighter collaboration set is acceptable. Pick Posteo for a simpler German privacy mailbox without Drive/Office/Meet. Pick mailbox when you need German dual-site hosting plus Drive, browser Office, Meet, and multi-user Admin/API in one paid suite. Compare admin depth and cert packages against Mailfence if Belgium-based secure email is also shortlisted.