# StartMail privacy rating

Paid email service from the Netherlands with built-in PGP encryption, unlimited aliases and custom domains.

## Summary

StartMail scores 66 out of 100 (grade C) on the email providers criteria. It meets 10 of 19 criteria: no ads or data sales, transparency report, TLS configuration, encrypted mailbox storage, open protocols, custom domains, sign up without personal data, IMAP support, SMTP submission and mail transport security. It partly meets no trackers or telemetry, security headers and end-to-end encryption. It does not meet open source, independent audit, tells users about requests, POP3 support, Sender Rewriting Scheme and ARC sealing. It is based in the Netherlands: Nine Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.

- Website: https://www.startmail.com
- Jurisdiction: Netherlands. Nine Eyes member. EU member (GDPR).
- Home page trackers: none found
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Grade: C (66/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | Partial | No third-party tracking or advertising data sharing, but website analytics use self-hosted Matomo, which sets cookies. | https://www.startmail.com/privacy |
| No ads or data sales | Yes | Funded by paid plans. No ads and no data sales. | https://www.startmail.com/pricing |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | Yes | Publishes yearly counts of legal orders processed and what information was provided. | https://www.startmail.com/transparency |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.startmail.com&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.startmail.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | Partial | PGP and password-protected messages are built into the webmail, but encryption is chosen per message. | https://www.startmail.com/encrypted-email |
| Encrypted mailbox storage | Yes | All mail is stored in an encrypted User Vault that opens only with the account password or a recovery key. | https://www.startmail.com/whitepaper |
| Open protocols | Yes | IMAP and SMTP work with any client. POP3 is not supported. | https://support.startmail.com/hc/en-us/articles/360006596718-Server-addresses |
| Custom domains | Yes | The Personal plan includes one custom domain. The Business plan allows unlimited domains. | https://www.startmail.com/pricing |
| Sign up without personal data | Yes | A name and recovery email address are optional. Sign-up uses an hCaptcha check. | https://www.startmail.com/privacy |
| Email security standards | Not tested yet | Not tested yet. |  |
| IMAP support | Yes | imap.startmail.com:993 (implicit TLS). IMAP4rev1 advertised with IDLE. |  |
| POP3 support | No | Not offered. |  |
| SMTP submission | Yes | smtp.startmail.com:465 (implicit TLS). SMTPUTF8, 8BITMIME, PIPELINING and AUTH advertised. |  |
| Mail transport security | Yes | Passes: SPF, DMARC quarantine, MTA-STS enforce, TLS-RPT, DNSSEC, DANE all. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-providers/startmail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/startmail.md