Email aliasing

Email aliasing services generate disposable forwarding addresses that stand in front of your real inbox. You give a site an alias instead of your true address; mail sent to the alias is forwarded to your real mailbox, and you can disable or delete the alias if it starts attracting spam or is leaked in a breach. The category covered here is hosted and self-hostable alias-forwarding services for individuals and small teams, not full mailbox providers and not enterprise mail gateways. The comparable feature axes are the alias allowance, custom-domain support, reply-from-alias, PGP forwarding and catch-all.

An aliasing service sits in the path of your inbound mail, which is why the operator's jurisdiction and corporate identity carry the weight here, much as they do for VPNs. The law of the country where the operator is incorporated sets the baseline for what it can be compelled to retain or disclose. If the operator is a US-incorporated company, the US CLOUD Act (Clarifying Lawful Overseas Use of Data Act) applies to the group and can compel it to produce data it controls regardless of server location. The mainstream services in this space are American: Firefox Relay is operated by Mozilla, Apple Hide My Email by Apple, and DuckDuckGo Email Protection by DuckDuckGo. For that reason the useful ranking axis in this category is jurisdiction, a named legal entity, the sub-processors that actually carry your mail, and whether you can self-host, not the CLOUD Act mark alone.

Applied honestly, that axis produces an uncomfortable finding: there is no EU-incorporated commercial email-aliasing company. The four options listed here are the credible non-US challengers, and each carries a specific caveat. SimpleLogin is operated by Proton AG in Switzerland (CLOUD Act exposure: Minor), from €3.5 per month. addy.io is governed by the law of England and Wales and names no operating entity, from €0.87 per month. AdGuard Mail is registered in Cyprus (CLOUD Act exposure: Material), from €2.99 per month. AliasVault is the only EU-registered operator, ownership: EU-owned, but its aliases are receive-only. What follows is what a buyer should actually do with that, product by product.

SimpleLogin was founded in Paris in 2019 and acquired by Proton AG in 2022; it is now operated by that Swiss entity rather than a French one. Forwarded mail is hosted on Proton and UpCloud servers across Germany, Switzerland, the Netherlands and France, so no alias content at rest passes through US infrastructure. Its CLOUD Act exposure is Minor rather than none because its sub-processors include Cloudflare for DNS and hCaptcha for bot protection, which the core Proton products do not use; both are ancillary and neither touches forwarded-mail content at rest. It is the most complete option here, with reply-from-alias, custom domains, catch-all and PGP forwarding on the paid tier.

addy.io (formerly AnonAddy) names no legal entity anywhere in its Terms or Privacy Policy. Its Terms specify the law of England and Wales, its servers are in the Netherlands, and its third parties are Stripe and NOWPayments for payments, Amazon SES for its newsletter and Cloudflare Turnstile for captcha. That keeps CLOUD Act exposure at Minor, because the forwarding path itself stays in the EU. The unresolved point is not technical but corporate: public sources disagree on who operates the service, and no primary source names the operator, so a buyer accepts an unnamed operating entity in exchange for a capable, cheap, self-hostable product from €0.87 per month.

AdGuard Mail forwards mail through Amazon SES, a US-owned service. Because forwarding is the product's core function rather than an ancillary one, that is why its CLOUD Act exposure is Material rather than minor. AdGuard Software Ltd is Cyprus-registered (HE 332952); widely cited secondary sources describe the company as founded in Moscow in 2009 and relocated to Cyprus around 2014, a detail AdGuard's own materials neither state nor deny, and which is recorded here as reported by third parties, not confirmed by the vendor. It has no custom-domain, catch-all or PGP support, and no self-hosted option.

AliasVault is the only EU-registered operator among the four: a product of XIVISOFT, a Dutch sole proprietorship (KVK 51592193), hosted on the operator's own servers in Germany, with ownership recorded as EU-owned and CLOUD Act exposure of None. The decisive limitation is structural and stated on its own homepage: its aliases are receive-only, so you can receive mail at an alias but cannot send or reply from it. It also publishes no data-processing agreement and no sub-processors list, which is what holds it at a middling compliance mark despite an otherwise clean sovereignty profile; the same DPA gap applies to addy.io and AdGuard Mail. The core product is free.

There are also free, open-source aliasing services that are not listed here, and the reason is instructive. Erine.email is one: a live service under the GPLv3, with a most recent commit dated 22 June 2026. It was excluded from the listings because it publishes no privacy policy, no data-processing agreement, and no operator country. That is the bar a listing has to clear on EU Vetted, and being free and open-source does not clear it on its own; there has to be a stated jurisdiction and a minimum of disclosed data-handling terms to assess. Erine.email is worth knowing about as a working tool, but there is not enough disclosed about who runs it, and under which law, to place it in the table.

Self-hosting is a real answer in this category, not a consolation. SimpleLogin, addy.io and AliasVault are all released under the AGPL-3.0 and are self-hostable via Docker. A self-hosted instance on EU infrastructure removes the hosting dependency, and for addy.io it also removes the unresolved-operator question entirely, because you become both controller and processor and no third party ever sees your mail. The trade is operational: you run the mail server, its deliverability and its updates. For a buyer who can carry that, a self-hosted alias service on EU-owned infrastructure is the strongest sovereignty posture this category currently offers.