Mailbox.org review
Updated September 28, 2026 · ShieldCue Editorial Team · Facts checked September 26, 2026
We earn a commission when you sign up through links on this site. Partner status can affect where a brand appears in our rankings.
Our verdict
Mailbox.org suits people who want a German-hosted mailbox with audited infrastructure and their own domain, and who can accept a paid-only service where mail is not end-to-end encrypted. Free storage is 0, and the entry offer is a trial rather than a permanent tier.
Key facts
- Best for
- Audited German hosting with a custom domain and paid-only plans
- Price from
- €12 (Source, checked September 26, 2026)
- Free plan limits
- None; 30-day free trial of any plan (Source, checked September 26, 2026)
- End-to-end encryption
- Not end-to-end encrypted: SSL/TLS in transit, optional PGP and S/MIME message encryption, PGP-encrypted inbox on request, Drive files client-side OpenPGP (Source, checked September 26, 2026)
- Jurisdiction
- DE (Source, checked September 26, 2026)
- Custom domains
- Yes (Source, checked September 26, 2026)
- Open source
- No (Source, checked September 26, 2026)
- Legal entity
- Heinlein Hosting GmbH (Source, checked September 26, 2026)
- Headquarters
- Germany (Source, checked September 26, 2026)
- Founded
- 2014 (Source, checked September 26, 2026)
- Support channels
- Email, Phone, Help-centre, Community (Source, checked September 26, 2026)
- Pricing model
- Budget
- Official website
- mailbox.org
Privacy tools
- Price from
- €12 (Source, checked September 26, 2026)
- Free plan
- No (Source, checked September 26, 2026)
- Free plan limits
- None; 30-day free trial of any plan (Source, checked September 26, 2026)
- Platforms
- Web, PWA, iOS, Android (Source, checked September 26, 2026)
- Logging policy
- Server log data (IP address, time, pages) collected anonymously, erased after 4 days; SMTP logs erased after 7 days; no personal data shared with third parties (Source, checked September 26, 2026)
- Jurisdiction
- DE (Source, checked September 26, 2026)
- Open source
- No (Source, checked September 26, 2026)
- Legal entity
- Heinlein Hosting GmbH (Source, checked September 26, 2026)
- Headquarters
- Germany (Source, checked September 26, 2026)
- Founded
- 2014 (Source, checked September 26, 2026)
- Support channels
- Email, Phone, Help-centre, Community (Source, checked September 26, 2026)
- Pricing model
- Budget
Encrypted storage
- Free storage
- 0 (Source, checked September 26, 2026)
- Price per TB per year
- €480 to €960 (Source, checked September 26, 2026)
- Zero-knowledge encryption
- Yes (Source, checked September 26, 2026)
- Jurisdiction
- DE (Source, checked September 26, 2026)
- Compliance certifications
- ISO/IEC 27001:2022, BSI C5 (Type 1 attestation), BSI IT Security Label (BSI TR 03108), BSI Gold status for email security, Software Hosted in Germany, Software made in Germany, Cybersecurity Made in Europe (ECSO seal) (Source, checked September 26, 2026)
- Legal entity
- Heinlein Hosting GmbH (Source, checked September 26, 2026)
- Headquarters
- Germany (Source, checked September 26, 2026)
- Founded
- 2014 (Source, checked September 26, 2026)
- Support channels
- Email, Phone, Help-centre, Community (Source, checked September 26, 2026)
- Pricing model
- Budget
Pros and cons
Pros
- Extra storage runs €480 to €960 per TB per year on the paid plans
- Certifications include ISO/IEC 27001:2022, BSI C5 (Type 1 attestation) and BSI IT Security Label (BSI TR 03108)
- Support runs on email, phone and help centre
- Drive encrypts files on your own device with OpenPGP
Cons
- No free plan: None; 30-day free trial of any plan, and free storage is 0
- Not open source, so assurance rests on hosting location and certification rather than inspectable code
Who it suits
- People who want certified German hosting, with the attestations listed in ISO/IEC 27001:2022, BSI C5 (Type 1 attestation) and BSI IT Security Label (BSI TR 03108)
- Users who already hold PGP or S/MIME keys and want message encryption on an ordinary mailbox
- Teams paying for a custom domain on a contract in Germany
Who should look elsewhere
- Price-first readers, since Apple Hide My Email starts at $0.99 and Apple Inc. at $0.99
- Anyone wanting a permanent free tier, since the free plan limits are None; 30-day free trial of any plan and addy.io starts at $1
- Apple Inc. at $0.99 readers who want a mailbox folded into an existing account rather than a separate contract in Germany
Who runs it
Mailbox.org is run by Heinlein Hosting GmbH, which is registered and headquartered in Germany, so the contract and the courts sit in the same jurisdiction. The company has been operating since 2014 with a hosting background. Support runs on email, phone and help centre, and that background is why the mail plans sit inside a wider hosting operation rather than a mail-only product.
How Mailbox.org compares
8.7 vs 9.1
8.7 vs 8.8
8.7 vs 8.5
8.7 vs 9.5
8.7 vs 9.4
8.7 vs 9.1
8.7 vs 9.2
8.7 vs 9.4
8.7 vs 9.2
8.7 vs 8.8
8.7 vs 9.3
8.7 vs 9.0
8.7 vs 9.0
8.7 vs 9.4
Frequently asked questions
What does Mailbox.org cost to start?+
Plans start at €12, and there is no free plan: None; 30-day free trial of any plan is the entry offer instead, a trial rather than a permanent tier. Extra storage sits outside that price, at €480 to €960 per TB per year, so budget for the mailbox and the drive space separately.
Is there a free plan or any free storage?+
No on both counts. The free plan is not offered, and free storage is 0. What you get instead is None; 30-day free trial of any plan, which lets you try any plan before paying. Custom domains are supported on the paid plans, so budget for the full plan price from the start.
Is Mailbox.org end-to-end encrypted?+
End-to-end encryption is not the default. Mail travels over SSL/TLS, and you can add PGP or S/MIME message encryption or ask for a PGP-encrypted inbox. Drive goes further and encrypts files on your own device with OpenPGP, while free storage on the plan is 0.
What do the logs record and how long are they kept?+
The operator, Heinlein Hosting GmbH, collects server log data anonymously, covering address, time and pages visited, and erases it after a short window. SMTP logs are cleared a little later, and no personal data is shared with third parties.
Who runs Mailbox.org and which law applies?+
The service is run by Heinlein Hosting GmbH, founded in 2014 and based in Germany. Jurisdiction is also DE, so disputes fall under German courts. Support runs on email, phone and help centre, and the certifications behind the operation are listed in ISO/IEC 27001:2022, BSI C5 (Type 1 attestation) and BSI IT Security Label (BSI TR 03108).
Is the software open source?+
Not open source, so the code cannot be read by users. Assurance rests on the certifications in ISO/IEC 27001:2022, BSI C5 (Type 1 attestation) and BSI IT Security Label (BSI TR 03108) and on the software being hosted in Germany. The free plan is not offered either, and free storage is 0.
Which apps can I use, and how do I reach support?+
The apps cover web, PWA and iOS, so the mailbox works in a browser, as an installed app and on phones. Support runs on email, phone and help centre, and live chat is not among those channels, so phone is the quick route for urgent delivery problems.
Sources
- mailbox.org/en/about-us checked September 26, 2026
Backs: Founded, Open source
“In 2024, we celebrated our 10th anniversary and launched the official beta programme for continuous innovation.”
- mailbox.org/en/certified-quality checked September 26, 2026
Backs: Compliance certifications
“ISO 27001 is the international standard for information security. ... BSI C5 is the cloud criteria catalogue of the German Federal Office for Information Security.”
- mailbox.org/en/data-protection checked September 26, 2026
Backs: Logging policy
“Erasure period: after 4 days.”
- mailbox.org/en/legal-information checked September 26, 2026
Backs: Headquarters, Jurisdiction, Legal entity
“Schwedter Str. 8/9A, 10119 Berlin, Germany”
- mailbox.org/en/prices checked September 26, 2026
Backs: Custom domains, Free plan, Free plan limits, Free storage, Pricing model, Price from, Price per TB per year, Support channels
“Custom domain names can be used”
- mailbox.org/en/product/drive checked September 26, 2026
Backs: Zero-knowledge encryption
“Encryption takes place on the client side, so only you have access to the content. This means that your data is also protected from unauthorized access on the server.”
- mailbox.org/en/product/mail checked September 26, 2026
Backs: Platforms
“In addition, you can also use your mailbox in the webmailer and save it on your home screen as a Progressive Web App (PWA).”
- mailbox.org/en/security checked September 26, 2026
Backs: End-to-end encryption
“We use SSL/TLS-encrypted connections: DigiCert security certificates can be recognised by the green padlock in your browser's URL bar. You also have the option of encrypting your emails with S/MIME...”
Compiled from 8 source pages, checked September 26, 2026. We did not open an account.