Private and open-source alternatives to Zoho Mail
15 email providers rated against the same public privacy criteria as Zoho Mail, with our picks first.
Why look for an alternative?
- Open source: no. Closed source.
- No trackers or telemetry: partial. Zoho states it blocks non-essential third-party cookies on its sites and mostly uses first-party cookies for analytics.
- Independent audit: no. No independent audit is published.
- Transparency report: no. No transparency report or government request policy is published.
- Tells users about requests: no. No published policy on notifying users about data requests.
- End-to-end encryption: partial. S/MIME and OpenPGP encryption are available but not on by default.
- Encrypted mailbox storage: partial. Mail is encrypted at rest with keys Zoho holds.
- Sign up without personal data: no. Sign-up asks for a name, contact number and email address.
- SMTP submission: partial. smtp.zoho.com:465 (implicit TLS). Missing: SMTPUTF8, 8BITMIME, PIPELINING.
- Mail transport security: no. Passes: SPF, DMARC reject, TLS-RPT. Missing: MTA-STS missing, DNSSEC, DANE none.
- Sender Rewriting Scheme: no. No published documentation on SRS for forwarded mail.
- ARC sealing: no. No published documentation on ARC signing or validation.
See the full Zoho Mail rating.
The alternatives
Forward Email Grade A Our pick
Open-source email service with encrypted mailboxes, custom domains, and IMAP, POP3, SMTP, CalDAV and CardDAV on every paid plan.
Why it is our pick: The whole service is published on GitHub, server code included. Each mailbox is a separately encrypted SQLite file, IMAP, POP3, SMTP, CalDAV and CardDAV work with any app, and custom domains are included on low-cost plans.
Based in the United States (Five Eyes). Forward Email scores 93 out of 100 (grade A) on the email providers criteria. It meets 17 of 19 criteria: open source, no ads or data sales, independent audit, tells users about requests, TLS configuration, security headers, end-to-end encryption, encrypted mailbox storage, open protocols, custom domains, sign up without personal data, IMAP support, POP3 support, SMTP submission, mail transport security, Sender Rewriting Scheme and ARC sealing.
mailbox.org Grade C
Paid email, calendar and office service from Berlin, Germany, with built-in PGP encryption and support for custom domains.
Based in Germany (Fourteen Eyes). mailbox.org scores 70 out of 100 (grade C) on the email providers criteria. It meets 11 of 19 criteria: no trackers or telemetry, no ads or data sales, transparency report, TLS configuration, security headers, open protocols, custom domains, sign up without personal data, IMAP support, POP3 support and mail transport security.
StartMail Grade C
Paid email service from the Netherlands with built-in PGP encryption, unlimited aliases and custom domains.
Based in the Netherlands (Nine Eyes). StartMail scores 66 out of 100 (grade C) on the email providers criteria. It meets 10 of 19 criteria: no ads or data sales, transparency report, TLS configuration, encrypted mailbox storage, open protocols, custom domains, sign up without personal data, IMAP support, SMTP submission and mail transport security.
Kolab Now Grade C
Paid email and groupware service from Apheleia IT in Switzerland, built on the open-source Kolab platform, with calendars, contacts, files and video calls.
Based in Switzerland. Kolab Now scores 64 out of 100 (grade C) on the email providers criteria. It meets 10 of 19 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration, open protocols, custom domains, IMAP support, POP3 support, SMTP submission and mail transport security.
Proton Mail Grade C
End-to-end encrypted email service from Switzerland, with apps for web, Android, iOS and desktop.
Based in Switzerland. Proton Mail scores 64 out of 100 (grade C) on the email providers criteria. It meets 8 of 19 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration, end-to-end encryption, encrypted mailbox storage, custom domains and mail transport security.
CounterMail Grade C
Paid email service in Sweden that encrypts mail with OpenPGP and stores it encrypted. New registrations are closed.
Based in Sweden (Fourteen Eyes). CounterMail scores 62 out of 100 (grade C) on the email providers criteria. It meets 9 of 19 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, end-to-end encryption, encrypted mailbox storage, open protocols, custom domains, sign up without personal data and IMAP support.
Posteo Grade C
Paid, ad-free email service from Germany that runs without collecting names or addresses and accepts anonymous payment.
Based in Germany (Fourteen Eyes). Posteo scores 62 out of 100 (grade C) on the email providers criteria. It meets 9 of 19 criteria: no trackers or telemetry, no ads or data sales, transparency report, TLS configuration, encrypted mailbox storage, open protocols, sign up without personal data, IMAP support and POP3 support.
Tuta Grade C
End-to-end encrypted email and calendar service from Germany, with open-source apps for web, desktop and mobile.
Based in Germany (Fourteen Eyes). Tuta scores 61 out of 100 (grade C) on the email providers criteria. It meets 9 of 18 criteria: no trackers or telemetry, no ads or data sales, transparency report, security headers, end-to-end encryption, encrypted mailbox storage, custom domains, sign up without personal data and mail transport security.
Disroot Grade D
Volunteer-run platform from the Netherlands offering email and other open services.
Based in the Netherlands (Nine Eyes). Disroot scores 59 out of 100 (grade D) on the email providers criteria. It meets 9 of 19 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration, open protocols, custom domains, IMAP support, POP3 support and mail transport security.
Riseup Grade D
Email, mailing list and VPN service run by an autonomous tech collective in Seattle for activists and social movements. Accounts need an invite, and the service is funded by donations.
Based in the United States (Five Eyes). Riseup scores 59 out of 100 (grade D) on the email providers criteria. It meets 9 of 19 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, encrypted mailbox storage, open protocols, sign up without personal data, IMAP support, POP3 support and SMTP submission.
Purelymail Grade D
Low-cost email hosting from the United States with custom domains, standard protocols and mail stored encrypted with the user's password.
Based in the United States (Five Eyes). Purelymail scores 55 out of 100 (grade D) on the email providers criteria. It meets 8 of 19 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, encrypted mailbox storage, open protocols, custom domains, sign up without personal data and IMAP support.
Mailfence Grade D
Email service from Belgium with built-in OpenPGP encryption and signing, plus calendar, contacts and document storage.
Based in Belgium (Fourteen Eyes). Mailfence scores 54 out of 100 (grade D) on the email providers criteria. It meets 8 of 19 criteria: no trackers or telemetry, no ads or data sales, transparency report, TLS configuration, custom domains, IMAP support, POP3 support and mail transport security.
Infomaniak Mail Grade D
Email service from Swiss company Infomaniak, with free ik.me addresses and paid hosting for custom domains, plus web and mobile apps.
Based in Switzerland. Infomaniak Mail scores 53 out of 100 (grade D) on the email providers criteria. It meets 6 of 19 criteria: no ads or data sales, TLS configuration, open protocols, custom domains, IMAP support and POP3 support.
Fastmail Grade D
Paid email service from Australia with custom domains and standard protocols.
Based in Australia (Five Eyes). Fastmail scores 50 out of 100 (grade D) on the email providers criteria. It meets 9 of 19 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration, open protocols, custom domains, IMAP support, POP3 support and ARC sealing.
Runbox Grade D
Paid email service from Norway with custom domain hosting, standard protocols and an open-source webmail app.
Based in Norway (Nine Eyes). Runbox scores 49 out of 100 (grade D) on the email providers criteria. It meets 7 of 18 criteria: no trackers or telemetry, no ads or data sales, transparency report, open protocols, custom domains, IMAP support and POP3 support.