← Back to Directory
Logo: Runbox

Runbox

Norwegian subscription email hosting from Runbox Solutions AS: Oslo-hosted IMAP mailboxes, custom domains, CalDAV/CardDAV, and optional PGP. Ad-free; not default zero-access.

Open source
privacyemail-hostinggdprnorwayrenewable-energyopen-source-webmail
Visit WebsiteAsk an EU migration specialistFeedback & corrections

Runbox is a subscription-funded email hosting service operated by Runbox Solutions AS in Oslo, Norway. It provides hosted mailboxes with IMAP, POP, and SMTP, plus Runbox 7 webmail, CardDAV contacts, CalDAV calendar, file storage, custom domains, and aliases.

It exists as ad-free Norwegian email under EEA and GDPR rules rather than as a zero-access encrypted messenger. The company has offered commercial email hosting since 2000 and describes itself as independent and largely employee-owned.

The concrete differentiator is that Oslo-hosted, standards-based mailbox with optional PGP, not default zero-access encryption.

Norwegian email hostingIMAP / POP / SMTPCustom domains100% renewable (claimed)Runbox 7 open sourceOptional PGP / S/MIME

Shortlist Runbox when you need Norwegian/EEA-hosted IMAP email with custom domains, ad-free subscription economics, and standard clients. Skip when you require default zero-access E2EE—consider Proton Mail or Tuta instead—or when you need a full Microsoft 365-style suite.

Key capabilities

Mailboxes live on servers Runbox places in a StackInfra facility in Oslo under Norwegian jurisdiction, with full-disk encryption at rest and TLS (including PFS) in transit. Access via IMAP, POP, SMTP, or Runbox 7 webmail suits teams that need standard clients rather than a proprietary-only app.

Host mail on your own domain, manage sub-accounts from a main account, and use many aliases on Runbox domains plus unlimited aliases on customer domains. Plus-addressing and filters help separate identities without running separate mailboxes.

Integrated calendar and contacts sync over CalDAV and CardDAV with common desktop and mobile apps. End-to-end confidentiality is user-controlled via PGP or S/MIME—not zero-access by default—so operators can still index mail for search and scan for malware.

Runbox states it does not show ads, does not use third-party trackers such as Google Analytics, and only scans messages for spam/virus protection—not advertising. Revenue is subscription-based with a public trial period, aligning incentives away from data-mining free mail.

The Runbox 7 web client is published on GitHub for inspection; the hosted server stack remains largely proprietary. Email infrastructure is advertised as 100% certified renewable electricity in Norway, with additional company offset claims—useful for sustainability procurement checklists.

At a glance

HQ
Oslo, Norway
Legal entity
Runbox Solutions AS (orgnr 996877027)
Founded
Service since 2000; current AS form 2011
Hosting
Email: StackInfra Oslo; optional web hosting may default US
Open source
Partial (Runbox 7 web app); not self-hosted
Commercial model
Paid subscription + trial (no permanent free tier)

Best fit when

  • Teams that want Oslo-hosted mailboxes under Runbox Solutions AS and Norwegian law, with full IMAP client freedom
  • Organizations needing custom domains, multi-account admin, and generous alias patterns without self-hosting an MTA
  • Buyers who prioritize subscription-funded, ad-free email over free ad-supported Gmail/Outlook tiers
  • Procurement that values renewable-energy data-center claims and Ethical Consumer Best Buy style ESG signals
  • Users comfortable managing optional PGP/S/MIME when message-level E2EE is needed for specific threads

Poor fit when

  • Requirements for default zero-access encryption where the provider cannot read mailbox content (prefer Proton Mail or Tuta)
  • Need for a fully self-hosted or fully open-source mail server stack
  • Heavy dependence on Microsoft 365 collaboration (Teams, SharePoint, advanced Exchange) rather than plain email hosting
  • Mandatory public ISO 27001 or SOC 2 evidence before shortlist—none found on public Runbox pages in this research pass
  • Optional product paths (default US web hosting via JaguarPC) when a strict no-US-vendor rule covers every SKU

Consider instead when

  • When: You need default end-to-end / zero-access encryption for all messages

    Consider: Proton Mail or Tuta

    Runbox uses optional PGP/S/MIME; operator can access stored mail for filtering and lawful process

  • When: You want a German privacy-oriented host with similar sustainability positioning

    Consider: Posteo

    Compare jurisdiction (DE vs NO), domain limits, and feature depth

  • When: You need Belgian email with integrated collaboration extras

    Consider: Mailfence

    Different encryption defaults and product scope

  • When: You need global free-tier convenience and suite lock-in

    Consider: Gmail or Outlook.com / Microsoft 365

    Accept US jurisdiction and ad/suite economics tradeoffs

Jurisdiction & ownership

Legal entity
Runbox Solutions AS
Governing law
Norwegian law; Personal Data Act implementing GDPR (EEA)
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Medium
Hosting / residency
Core email and account content: servers in Oslo (StackInfra) under Norwegian jurisdiction; systems management Copyleft Solutions AS (Norway). Optional third parties per privacy policy: Stripe, PayPal, Coinbase (US payments); Enom (US domains); Gandi (FR); Domeneshop (NO); JaguarPC (US default web hosting, Norway option); NodePing (US, status page). No known US parent.

Indicative only—not legal advice. Email residency is Norwegian, but US payment/domain/web-hosting vendors in the public processor list raise transfer diligence for those optional paths. Staff outside adequate jurisdictions said to use SCCs.

  • Independent security / no-logs auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionVendor claimed
  • +3

Considerations & known limitations

  • MediumNot default zero-access encryption

    Unlike Proton/Tuta, Runbox can access stored mail for spam/virus scanning, indexing, and lawful process. Use PGP/S/MIME when E2EE is required.

  • MediumUS vendors on optional product paths

    Payments (Stripe/PayPal/Coinbase), domain registrar Enom, and default JaguarPC web hosting introduce US processors. Keep web hosting in Norway and minimize US payment data if policy requires.

  • MediumNo public ISO 27001 / SOC 2 / independent audit

    Assurance relies on vendor policy, Norwegian law, and facility claims. Regulated buyers may need NDA evidence or on-site questionnaire.

  • LowPartial open source only

    Runbox 7 webmail is open source; mail backend is proprietary SaaS—no self-host path.

  • LowPost-closure and backup retention

    Privacy policy defines multi-month content retention and backup windows after closure (and longer account-info retention for bookkeeping). Request immediate deletion if policy requires faster wipe.

Open questions for due diligence

  • Will Runbox sign a customer-facing B2B DPA listing all subprocessors for your tenant configuration?
  • Can optional web hosting and domain registration be restricted to EEA-only providers for your account?
  • Is any independent penetration test or SOC/ISO report available under NDA?
  • What is the current employee ownership share and any non-EU shareholding since the 2018 figure on the About page?
  • Confirm backup geography (privacy policy: secure servers separate from main system—are they also Norway-only?)
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

No. Runbox encrypts mail in transit (TLS) and at rest on disk, but stored mailboxes are not zero-access by default: the operator can access content for spam/virus filtering, search indexing, and lawful process. For message-level E2EE, use PGP or S/MIME in your client or compatible browser tooling. Choose Proton Mail or Tuta if automatic zero-access encryption is a hard requirement.

Core email content is described as stored on servers in Oslo, Norway under Runbox Solutions AS. Systems management partner Copyleft Solutions AS is also Norwegian. The privacy policy lists optional third parties including Stripe/PayPal/Coinbase (payments, USA), Enom (domains, USA), JaguarPC (web hosting default USA), and NodePing (status monitoring, USA). Scope those paths in a DPIA if you enable domains, web hosting, or card payments.

Yes. Runbox supports IMAP, POP, and SMTP with SSL/TLS for clients such as Thunderbird, Apple Mail, Outlook, and mobile IMAP apps. App passwords work with 2FA. Calendar and contacts sync via CalDAV and CardDAV. Server settings are documented in the Runbox Help Centre.

Partially open source only: the Runbox 7 web app (and related searchindex library) is public on GitHub. The hosted mail backend is not offered as a self-hosted product. If you need a fully self-managed mail stack, look at self-hosted platforms rather than Runbox SaaS.

Runbox is a paid subscription service with plan tiers by storage and feature limits, a time-limited free trial, and no permanent free consumer tier comparable to Gmail. Confirm current plan limits and trial terms on runbox.com—do not rely on third-party price tables.

Per the company, disclosure of user data requires a valid Norwegian court order (or equivalent lawful Norwegian process). Foreign authority requests generally must pass Norwegian diplomatic and judicial channels before police can compel production. This is company policy plus Norwegian law—not a cryptographic guarantee. Where legally permitted, Runbox says it will notify the user of requests.