# mailbox.org privacy rating

Paid email, calendar and office service from Berlin, Germany, with built-in PGP encryption and support for custom domains.

## Summary

mailbox.org scores 70 out of 100 (grade C) on the email providers criteria. It meets 11 of 19 criteria: no trackers or telemetry, no ads or data sales, transparency report, TLS configuration, security headers, open protocols, custom domains, sign up without personal data, IMAP support, POP3 support and mail transport security. It partly meets independent audit, end-to-end encryption, encrypted mailbox storage and SMTP submission. It does not meet open source, tells users about requests, Sender Rewriting Scheme and ARC sealing. It is based in Germany: Fourteen Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://mailbox.org
- Jurisdiction: Germany. Fourteen Eyes member. EU member (GDPR).
- Home page trackers: none found
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Grade: C (70/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. Parts of the underlying software, such as Open-Xchange and Dovecot, are open source, but the service code is not published. |  |
| No trackers or telemetry | Yes | The website uses a self-hosted, cookieless Matomo instance with anonymized data. No third-party analytics. | https://mailbox.org/en/data-protection/ |
| No ads or data sales | Yes | Funded by paid plans. No ads and no data sales. | https://mailbox.org/en/prices/ |
| Independent audit | Partial | Holds ISO 27001 and BSI C5 certifications from independent auditors. The audit reports are not public. | https://mailbox.org/en/certified-quality/ |
| Transparency report | Yes | Publishes yearly counts of authority requests by type, origin and outcome. | https://mailbox.org/en/transparency-report/ |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=mailbox.org&hideResults=on |
| Security headers | Yes | Grade A+ (115/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=mailbox.org |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | Partial | PGP and S/MIME are built into the webmail through mailbox Guard, but must be turned on by the user. | https://mailbox.org/en/security/ |
| Encrypted mailbox storage | Partial | Incoming mail can optionally be encrypted with the user's own PGP key. This is off by default and sent mail is not encrypted. | https://kb.mailbox.org/en/private/encryption/your-encrypted-mailbox/ |
| Open protocols | Yes | IMAP, POP3 and SMTP work with any client. | https://kb.mailbox.org/en/private/e-mail/e-mail-configuration/ |
| Custom domains | Yes | Available from the Standard plan up. | https://mailbox.org/en/prices/ |
| Sign up without personal data | Yes | A name is required but not verified, so a pseudonym can be used. No phone number is needed. | https://kb.mailbox.org/en/private/security-and-privacy/anonymous-new-registration/ |
| Email security standards | Not tested yet | Not tested yet. |  |
| IMAP support | Yes | imap.mailbox.org:993 (implicit TLS). IMAP4rev1 advertised with IDLE. |  |
| POP3 support | Yes | pop3.mailbox.org:995 (implicit TLS). CAPA: CAPA, TOP, UIDL, RESP-CODES, PIPELINING, AUTH-RESP-CODE, USER, SASL. |  |
| SMTP submission | Partial | smtp.mailbox.org:465 (implicit TLS). Missing: SMTPUTF8. |  |
| Mail transport security | Yes | Passes: SPF, DMARC reject, MTA-STS enforce, TLS-RPT, DNSSEC, DANE all. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-providers/mailbox-org/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/mailbox-org.md