← Back to Directory
Logo: Migadu

Migadu

Swiss-operated, standards-based email hosting for custom domains: unlimited addresses and multi-domain accounts priced by usage quotas, not per mailbox.

privacysaasapiemail-hostingstandards-basedmulti-domain
Visit WebsiteAsk an EU migration specialistFeedback & corrections

Migadu is standards-oriented email hosting for your own domains, operated by Migadu-Mail GmbH in Switzerland. You point DNS at Migadu and use ordinary SMTP, IMAP4, POP3, and webmail. Any modern client that speaks those protocols works.

It exists for multi-domain and multi-project mail that would be expensive or awkward on seat-based suites. Plans are flat per Migadu account, not per mailbox. Within account quotas you can create large numbers of addresses and host many domains.

The concrete differentiator is that usage-quota commercial model rather than per-inbox billing, on a Swiss-operated, standards-based host.

Swiss operatorUsage-priced multi-domainSMTP/IMAP/POP3Mail hosted in FranceMulti-admin + APINo ads / no tracking

Shortlist Migadu when you need Swiss-operated, standards IMAP/SMTP hosting with unlimited addresses across many domains under flat account quotas—especially agencies and multi-domain SMEs. Skip when you need provider E2EE defaults, contractual SLA on the default offer, mailbox 2FA, or bulk/transactional sending; consider Proton Mail/Tuta for E2EE, or mailbox.org/Mailfence/Posteo/Runbox for other European professional-mail tradeoffs.

Key capabilities

Plans are flat per Migadu account. Within daily in/out quotas and soft storage guidance, create large numbers of mailboxes and host many domains without per-address fees—useful for agencies and multi-project teams. Soft storage does not hard-bounce mail; sustained over-quota use can force upgrades or limits.

No proprietary client protocol. Connect Thunderbird, Apple Mail, Outlook, mutt, and others over TLS (typical endpoints imap.migadu.com:993, smtp.migadu.com:465, pop.migadu.com:995). ManageSieve filtering, aliases, pattern rewrites, identities, footers, auto-responders, and optional catch-alls cover classic postmaster needs. Data remains portable via standard protocols.

Agencies can hold many client domains under one roof, open multiple administrators (domain-scoped on higher plans), set per-domain/mailbox limits, and monitor traffic. A REST API (documented as early beta) manages domains, mailboxes, identities, forwardings, aliases, and rewrites for automation. Domain deletion stays UI-only as a safety measure.

Optional built-in DNS ships mail records preconfigured; Migadu also offers DNS setup help at no extra fee and publishes diagnostics/activation flows. Support is ticket-based from people who operate the mail stack—not outsourced chat—with plan-dependent urgency outside office hours.

Vendor policy states no advertising, no tracking of mailbox content for ads, and no website analytics cookies beyond session needs. Processing is framed for service delivery, abuse prevention, and legal obligations. Payment data still goes to Stripe and PayPal under separate processor terms.

At a glance

HQ / entity
Migadu-Mail GmbH, Switzerland
Founded
2014 (vendor About)
Mail hosting
Data centers in France (vendor Pro/Cons)
Commercial model
Flat per-account plans by daily message quotas + soft storage
Open source product?
No — built on open-source stack; service is proprietary SaaS
Self-host
No
Ownership
Bootstrapped; no outside capital (vendor claim)

Best fit when

  • Agencies and freelancers hosting many client domains under one account with multi-admin or API provisioning
  • Organizations that want custom-domain mail with standard clients and portable IMAP—not a proprietary suite lock-in
  • Teams tired of per-seat pricing for large address spaces with modest real traffic
  • Buyers who value a small bootstrapped Swiss operator that publishes blunt product limits
  • Setups that need aliases, rewrites, identities, SIEVE, and postmaster-style controls more than collab apps

Poor fit when

  • Primary need is end-to-end encrypted mail by default (Proton Mail, Tuta, or user-side OpenPGP workflows)
  • High-volume transactional, marketing, or bulk outbound mail
  • Requirement for default contractual SLA, phone support, or multi-language admin UI
  • Mandatory mailbox 2FA on every IMAP login
  • Want a free long-term plan or Migadu-branded @provider addresses without owning a domain

Consider instead when

  • When: You need provider-managed end-to-end encryption as the default product promise

    Consider: Proton Mail or Tuta

    Migadu is standards hosting with TLS; content secrecy against the operator is not the design center.

  • When: You want another European professional host with a different admin/encryption/residency package

    Consider: mailbox.org, Mailfence, Posteo, or Runbox

    Compare DPA detail, audit packaging, and whether multi-domain usage pricing still wins for your address sprawl.

  • When: You need full workspace suite (docs, meet, identity) rather than email hosting alone

    Consider: Google Workspace, Microsoft 365, or Infomaniak-style European suites

    Migadu deliberately stays postmaster-focused.

  • When: You need bulk or high-rate application email

    Consider: A dedicated ESP (not Migadu); Amazon SES is the common Big Tech baseline—pair with EU ESPs if residency matters

    Migadu rate-limits and bans intentional bulk use.

Jurisdiction & ownership

Legal entity
Migadu-Mail GmbH
Governing law
Canton of Appenzell Ausserrhoden, Swiss Confederation (terms)
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Medium
Hosting / residency
Mail servers stated in France (EU). Payment subprocessors Stripe and PayPal (US) for billing data. Full mail infrastructure/backup subprocessor list not published by name on primary pages.

No known US parent. CLOUD Act exposure is indicative only: residual US process surface mainly via payment processors and any unnamed infrastructure providers—not a clean bill of health from HQ country alone. Not legal advice.

  • Independent security / no-logs auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionVendor claimed
  • +3

Considerations & known limitations

  • MediumUS payment subprocessors (Stripe, PayPal)

    Billing-related personal data can transfer to US processors under Migadu’s privacy policy. Mail content path is France/EU per vendor, but payment data is a separate CLOUD Act / transfer surface.

  • MediumIncomplete public infrastructure subprocessor list

    Primary pages name France hosting and certified DCs without a full vendor inventory for compute, storage, and backups. Procurement should request the current list and regions in writing.

  • MediumNo E2EE product default; no classic mailbox 2FA

    Standards mail with TLS; vendor recommends user-side OpenPGP for strong content secrecy. IMAP 2FA is not offered; app-specific-style identities are not second-factor MFA.

  • MediumDaily quotas and human-mail policy

    Account-wide daily in/out caps and anti-bulk rules make Migadu unsuitable as a transactional/marketing ESP. Over-limit mail can be deferred or rejected after tolerance.

  • LowNo default SLA on standard plans

    Vendor states standard offers lack SLAs; email is treated as asynchronous and occasionally disrupted. Enterprise SLA only via separate commercial discussion.

  • MediumNo public independent security audit

    Privacy and no-ad-scanning claims are first-party. No independent audit report found for no-logs or security controls.

Open questions for due diligence

  • What are the current named mail hosting, backup, and ancillary subprocessors and their countries?
  • Can Migadu provide ISO/SOC evidence for the organization or only DC-level certifications?
  • Is an independent security or penetration-test summary available under NDA?
  • Does the privacy-page DPA meet your controller’s mandatory clauses without a separate signed agreement?
  • What encryption-at-rest and key-management practices apply today versus the older public pro/con narrative?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

Per account. Flat plans meter daily incoming/outgoing message volume and soft storage across all domains and mailboxes on that account. Extra addresses do not add line items. When you exceed daily caps, Migadu warns and can defer or reject mail after a tolerance band—so size the plan to real traffic, not address count. There is no ongoing free plan; a time-limited trial is available without a card. Retail amounts change on the official pricing page.

No as a primary use case. Migadu is for human mail. High-rate or bulk sending hits account/domain/mailbox rate limits, triggers abuse review, and intentional abuse can mean permanent ban and blacklisting. Occasional form-mail is fine; marketing blasts and high-volume transactional streams need a dedicated ESP (for example SES-class or European ESP alternatives).

Not as product defaults. Mail uses standard protocols with TLS in transit. The vendor’s own pro/con page argues that operator-held encryption at rest does not protect you from the operator and recommends OpenPGP (or similar) between correspondents for true content secrecy. Classic mailbox 2FA over IMAP is not available; identities with custom passwords work more like app-specific credentials than second-factor MFA. Choose Proton Mail, Tuta, or similar if E2EE defaults are mandatory.

Company: Switzerland (Migadu-Mail GmbH). Mail servers: vendor states France. Privacy materials treat GDPR and Swiss DPA as applicable and present the privacy page as a DPA. Stripe and PayPal process payments with transfers to the USA. There is no known US corporate parent. Indicative assessment: lower ownership risk than US-group suites, but not zero US process surface on payment data—and infrastructure subprocessors for mail are not fully named publicly. Confirm hosting chain and DPA wording with counsel for your risk profile.

Yes. Multi-administrator access can limit staff to selected domains (Micro plan lacks multi-admin). The public API at api.migadu.com/v1 (HTTP Basic with user + API key) covers domains, mailboxes, identities, forwardings, aliases, and rewrites; it is labeled early beta and omits some irreversible actions such as domain delete. Pair with IMAPSync-style migration guides when moving in or out.

Expect roughly a few minutes of delay for many admin configuration changes; English-only admin UI; ticket support without phone; no default SLA on standard plans; free TLDs refused; soft storage (no hard bounce for full disk, but upgrade pressure if you far exceed guidance); and spam filtering based on open-source tooling with user-adjustable aggressiveness—not perfect zero false positives/negatives. If multi-hour IMAP outages are unacceptable under any circumstance, Migadu’s own materials say you should look elsewhere or discuss enterprise terms.