mailbox.org Mail

mailbox.org Mail is hosted email and groupware from Heinlein Hosting GmbH in Berlin, sold as five modules — Mail, Drive, Meet, Office and Admin — on servers the company owns in two separate Berlin datacentres. Office covers documents, spreadsheets and presentations in the browser alongside calendar, contacts, notes, tasks, chat and polls, with CalDAV and CardDAV for external clients; Meet is video conferencing; Drive is file storage and sharing.

The encryption work is what sets it apart from a generic mailbox. PGP runs in webmail through mailbox Guard, with Mailvelope support and the company’s own HKPS key server; S/MIME is available; and an “encrypted mailbox” option applies PGP to mail already in the inbox. Aliases on @secure.mailbox.org refuse to send at all unless the receiving server offers TLS. Registration can be anonymous and payment can be cash sent by post. Two-factor authentication, app passwords and SSO are included.

Pricing on annual terms is EUR 1 a month for Light with 2 GB of mail, EUR 3 for Standard with 20 GB of mail, 10 GB of Drive, custom domains and 25 aliases, and EUR 9 for Premium with 50 GB and 100 GB. Family accounts take up to ten people. Business plans add a mandatory service package from EUR 25 a month.

The honest gap against Gmail is scale rather than capability: no equivalent of the Google app ecosystem, no third-party add-on marketplace, and search and spam filtering that most reviewers rate a step behind. What a switcher gets instead is German jurisdiction, no advertising and no profiling, and a provider that owns the machines the mail sits on.

The service is operated by Heinlein Hosting GmbH at Schwedter Straße 8/9A, 10119 Berlin, registered at the District Court of Berlin-Charlottenburg under HRB 220010 B, VAT ID DE335125423, with Peer Heinlein as chief executive. It belongs to the Heinlein Group, whose sister company Heinlein Support has done Linux consulting, emergency support and training for more than 30 years and reports more than 150 permanent staff — a self-reported figure, since German GmbH accounts are not practically obtainable. The mailbox service launched in 2014 as an encrypted mailbox and marked its tenth anniversary in 2024.

It is no longer only mail. The suite covers Mail with calendar and address book, Drive for cloud storage, Meet for video conferencing — built on OpenTalk, launched in 2022 — Office for collaborative editing, and an Admin console for business domains and mailboxes. EVAC is newer: a standby platform meant to keep a business reachable through a cyberattack or an IT outage. Plans run from EUR 1 a month for 2 GB of mail storage to EUR 4 for 20 GB of mail plus 10 GB of Drive and Office, and EUR 12 for 50 GB and 100 GB.

The servers run in Berlin data centres on renewable electricity. The service is certified to ISO 27001 and to the BSI’s C5 cloud criteria catalogue, and holds the BSI IT security label at Gold level, which required full DNSSEC alongside DMARC, DKIM, DANE, SPF, MTA-STS and TLS. Stiftung Warentest scored the Light plan 1.8 overall with top marks for privacy, ease of use and set-up. PGP and S/MIME are both supported, and a @secure.mailbox.org alias simply refuses to deliver a message that cannot be sent over TLS.