Swiss end-to-end encrypted email by Proton AG (Geneva); 100M+ users, Foundation-controlled since June 2024.
- FROM
- €4/mo
- CLOUD ACT
- NONE
Apple Inc. (Nasdaq: AAPL). Direct CLOUD Act exposure; consumer-skewed.
DISCLOSURE Some links on this site are affiliate links. We may earn a commission at no extra cost to you. Editorial signals and rankings are never influenced by affiliate relationships.
Ordered by feature parity and migration friction, which is weighted higher than feature breadth.
Swiss end-to-end encrypted email by Proton AG (Geneva); 100M+ users, Foundation-controlled since June 2024.
Hannover-based end-to-end encrypted mail (formerly Tutanota); post-quantum crypto, own DE data centre, ISO 27001.
Berlin-based private email + drive + meet + office bundle (Heinlein Support GmbH); ISO 27001 + BSI C5, €1/mo entry.
All 9 alternatives, benchmarked against iCloud Mail.
Swiss end-to-end encrypted email by Proton AG (Geneva); 100M+ users, Foundation-controlled since June 2024.
Hannover-based end-to-end encrypted mail (formerly Tutanota); post-quantum crypto, own DE data centre, ISO 27001.
Berlin-based private email + drive + meet + office bundle (Heinlein Support GmbH); ISO 27001 + BSI C5, €1/mo entry.
Dutch private email (StartMail B.V., est. ~2014, by Startpage founders), NL-hosted, one-click PGP, unlimited aliases, USD-priced from $4.99/mo annual.
Swiss email + groupware (Infomaniak Group SA, Geneva, since 1994), own Swiss DCs, ISO 27001 + B Corp 2025, free tier with @ik.me address.
Swiss open-source Kolab groupware SaaS (Apheleia IT AG, Bern; Kolab Systems since 2010, Kolab Now since 2013), board incl. FSF Europe founder Georg Greve.
French family-owned email since 1998 (Mail Object; founders Voyat & Lenoir, reacquired from Lagardère 2007), French-hosted, Free tier €0 + Premium from €1/mo.
Norwegian private email since 1999 (Runbox Solutions AS), own NO data centre, 100% renewable hydro, PGP + 2FA + PFS, double carbon-negative.
Independent Dutch paid email (from €3.25/mo); ISO 27001 + NIS2 Ready, all data in Netherlands, full IMAP/SMTP/CalDAV/CardDAV compatibility.
| Product | Hosting | Sovereignty | Cert. | Pricing | Signals | Open |
|---|---|---|---|---|---|---|
|
iCloud Mail
benchmark · US
|
— |
US-LINKED | SOC 2 no EU framework |
Freemium |
E2E
Public DPA
Sub-processors
Open source
|
|
|
Swiss end-to-end encrypted email by Proton AG (Geneva); 100M+ users, Foundation-controlled since June 2024.
|
GENEVA · CH
Switzerland
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
ISO/IEC 27001
|
Freemium
€4 /mo
|
E2E
Public DPA
Sub-processors
Open source
|
→ |
|
Hannover-based end-to-end encrypted mail (formerly Tutanota); post-quantum crypto, own DE data centre, ISO 27001.
|
HANNOVER · DE
Germany
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
ISO/IEC 27001
|
Freemium
€3 /mo
|
E2E
Public DPA
Sub-processors
Open source
|
→ |
|
Berlin-based private email + drive + meet + office bundle (Heinlein Support GmbH); ISO 27001 + BSI C5, €1/mo entry.
|
BERLIN · DE
Germany
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
ISO/IEC 27001
C5
|
Paid
€1 /mo
|
E2E
Public DPA
Sub-processors
Open source
|
→ |
|
Dutch private email (StartMail B.V., est. ~2014, by Startpage founders), NL-hosted, one-click PGP, unlimited aliases, USD-priced from $4.99/mo annual.
|
NL
Netherlands
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
— |
Paid
€5 /mo
|
E2E
Public DPA
Sub-processors
Open source
|
→ |
|
Swiss email + groupware (Infomaniak Group SA, Geneva, since 1994), own Swiss DCs, ISO 27001 + B Corp 2025, free tier with @ik.me address.
|
GENEVA · CH
Switzerland
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
ISO/IEC 27001
ISO9001
+2 more
|
Freemium
€6 /mo
|
E2E
Public DPA
Sub-processors
Open source
|
→ |
|
Swiss open-source Kolab groupware SaaS (Apheleia IT AG, Bern; Kolab Systems since 2010, Kolab Now since 2013), board incl. FSF Europe founder Georg Greve.
|
CH
Switzerland
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
— |
Paid
€5 /mo
|
E2E
Public DPA
Sub-processors
Open source
|
→ |
|
French family-owned email since 1998 (Mail Object; founders Voyat & Lenoir, reacquired from Lagardère 2007), French-hosted, Free tier €0 + Premium from €1/mo.
|
FR
France
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
— |
Freemium
€1 /mo
|
E2E
Public DPA
Sub-processors
Open source
|
→ |
|
Norwegian private email since 1999 (Runbox Solutions AS), own NO data centre, 100% renewable hydro, PGP + 2FA + PFS, double carbon-negative.
|
NO
Norway
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
— |
Paid
€2 /mo
|
E2E
Public DPA
Sub-processors
Open source
|
→ |
|
Independent Dutch paid email (from €3.25/mo); ISO 27001 + NIS2 Ready, all data in Netherlands, full IMAP/SMTP/CalDAV/CardDAV compatibility.
|
NL
Netherlands
|
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
|
ISO/IEC 27001
|
Paid
€3 /mo
|
E2E
Public DPA
Sub-processors
Open source
|
→ |
Beyond compliance: how these alternatives compare on the capabilities you actually use day to day.
| Feature | Proton Mail | Tuta | Mailbox.org | StartMail | Infomaniak Mail (kSuite) | Kolab Now | Mailo | Runbox | Soverin |
|---|---|---|---|---|---|---|---|---|---|
| Encryption | TLS E2E | TLS E2E | TLS | TLS | TLS | TLS | TLS | TLS | TLS |
| Mailbox storage | 15 GB | 20 GB | 2 GB | 20 GB | 20 GB | 5 GB | 20 GB | 2 GB | 25 GB |
| Email aliases | 10 aliases | 15 aliases | 3 aliases | Unlimited | 100 aliases | 100 aliases | Unlimited | ||
| Custom domain | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| IMAP / SMTP | Yes | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Calendar | Yes | Yes | Yes | Yes | No | Yes | Yes | Yes | |
| Contacts | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes | Yes |
Listed for transparency. Every product on this page is benchmarked against this baseline.
Listed for transparency. Every product on this page is benchmarked against this baseline.
Apple Inc. (Nasdaq: AAPL). Direct CLOUD Act exposure; consumer-skewed.
For every product we read the public DPA, sub-processors document, hosting region declaration, and corporate ownership records. Each is timestamped. Signals are editorial, re-verified quarterly. We never accept self-attestation.
Reviewed by the EU Vetted editorial team · Editorial guidelines