# Infomaniak Mail privacy rating

Email service from Swiss company Infomaniak, with free ik.me addresses and paid hosting for custom domains, plus web and mobile apps.

## Summary

Infomaniak Mail scores 53 out of 100 (grade D) on the email providers criteria. It meets 6 of 19 criteria: no ads or data sales, TLS configuration, open protocols, custom domains, IMAP support and POP3 support. It partly meets open source, no trackers or telemetry, transparency report, end-to-end encryption, encrypted mailbox storage, SMTP submission and mail transport security. It does not meet independent audit, tells users about requests, security headers, sign up without personal data, Sender Rewriting Scheme and ARC sealing. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade C-.

- Website: https://www.infomaniak.com/en/ksuite/service-mail
- Source code: https://github.com/Infomaniak/android-kMail
- License: GPL-3.0
- Jurisdiction: Switzerland. Not in the Five, Nine or Fourteen Eyes. GDPR-style data protection law.
- Home page trackers: none found
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Also rated: [Infomaniak](https://privacyratings.com/server-hosting/infomaniak/) (Server hosting), [Infomaniak kDrive](https://privacyratings.com/cloud-storage/infomaniak-kdrive/) (Encrypted cloud storage)
- Grade: D (53/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | The Infomaniak Mail apps are GPL-3.0, but the server is closed source. | https://github.com/Infomaniak/android-kMail/blob/main/LICENSE |
| No trackers or telemetry | Partial | Exodus finds Matomo and Sentry in the Android app. The website uses self-hosted Matomo and ad-measurement tools only with consent. | https://reports.exodus-privacy.eu.org/en/reports/com.infomaniak.mail/latest/ |
| No ads or data sales | Yes | Funded by paid services. No ads, and data is not sold. | https://www.infomaniak.com/en/free-email |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | Partial | The privacy policy states that data is only disclosed to authorities under a decision valid under Swiss law. No request counts are published. | https://www.infomaniak.com/en/legal/confidentiality-policy |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=ksuite.infomaniak.com&hideResults=on |
| Security headers | No | Grade C- (45/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=ksuite.infomaniak.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | Partial | Optional OpenPGP encryption with keys stored by Infomaniak, and password-protected mail for outside recipients. Not on by default. | https://www.infomaniak.com/en/support/faq/1582/secure-an-email-sending-with-an-encryption-key |
| Encrypted mailbox storage | Partial | Encrypted messages are stored with keys Infomaniak holds and unlocks at login. | https://www.infomaniak.com/en/support/faq/1582/secure-an-email-sending-with-an-encryption-key |
| Open protocols | Yes | IMAP, POP3 and SMTP work with any client. | https://www.infomaniak.com/en/support/faq/2430/configure-thunderbird-with-imap-email |
| Custom domains | Yes | Available with the paid Mail Service. | https://www.infomaniak.com/en/ksuite/service-mail |
| Sign up without personal data | No | A valid email address is required to verify a new account. | https://www.infomaniak.com/en/support/faq/2232/create-an-infomaniak-account |
| Email security standards | Not tested yet | Not tested yet. |  |
| IMAP support | Yes | mail.infomaniak.com:993 (implicit TLS). IMAP4rev1 advertised with IDLE. |  |
| POP3 support | Yes | mail.infomaniak.com:995 (implicit TLS). CAPA: LAST, TOP, USER, PIPELINING, UIDL, SASL. |  |
| SMTP submission | Partial | mail.infomaniak.com:465 (implicit TLS). Missing: SMTPUTF8. |  |
| Mail transport security | Partial | Passes: SPF, DMARC reject, DNSSEC, DANE all. Missing: MTA-STS missing, TLS-RPT. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-providers/infomaniak-mail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/infomaniak-mail.md