Skip to content
Independently verified · Quarterly re-audit
EU VETTED

AliasVault

VERIFIED
Email aliasing · Netherlands
Founded 2024 · aliasvault.com ↗

Dutch sole proprietorship (XIVISOFT / Leendert de Borst), open-source password manager with built-in receive-only email aliases; email aliases cannot send or reply, only receive. Free cloud tier hosted in Germany, AGPL-3.0 and fully self-hostable.

In short

AliasVault, in the Email aliasing category, is an EU-owned service with Germany as its hosting location and no identified CLOUD Act exposure.

Assessment notes

AliasVault is a product of XIVISOFT, a Dutch sole proprietorship (eenmanszaak) operated by founder Leendert de Borst, KVK 51592193 (vendor-stated, not independently cross-checked against the Dutch register); the registered address is stated only as "available upon request". The official cloud offering runs on the operator's own servers in Germany, within the EU, and the AGPL-3.0 source is fully self-hostable via Docker. No third-party trackers or US sub-processors are named in the Privacy Policy (a self-hosted Plausible.io instance is the only named service, run on AliasVault's own servers), so CLOUD Act exposure is assessed as none. The determining factor holding compliance_score at 3/5 despite the clean eu_owned and hosting profile is that no DPA and no sub-processors list are published, which this directory's rubric caps at 3/5 regardless of an otherwise clean sovereignty profile; AliasVault is also a young (2024-founded), single-founder operation without a formal customer-facing data-processing contract yet.

CLOUD ACT
OWNERSHIP
SUB-PROCS
0 none disclosed
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About AliasVault

AliasVault is a product of XIVISOFT, a Dutch sole proprietorship (eenmanszaak) operated by founder Leendert de Borst, KVK (Dutch Chamber of Commerce) number 51592193; the registered address is stated as "available upon request" rather than published, and no VAT number is stated. It combines a zero-knowledge password manager with built-in email-alias generation: every saved identity gets its own alias inbox inside the app. The official cloud offering (app.aliasvault.com) runs on the operator's own servers in Germany, within the EU; the Privacy Policy states this is "fully compliant with GDPR". The single most important buying fact is a structural limitation stated on AliasVault's own homepage: "Email aliases are receive-only, meaning you cannot send or reply to emails from your aliases", with a 10MB size limit on incoming mail. The core product is free and the vendor states it "will always remain that way"; Premium and Family tiers (higher limits, VIP alias domains, custom domains, automatic backups) are announced but not yet live as of this review. The client and server are open source under AGPL-3.0 (github.com/aliasvault/aliasvault, most recent release 0.30.0 on 2026-07-02) and fully self-hostable via Docker, which is also the only way to get a custom domain today, since none is available on the free cloud tier. No DPA or sub-processors list is published; the only named third party in the Privacy Policy is a self-hosted instance of Plausible.io analytics, run on AliasVault's own servers rather than Plausible's own hosted service.

SUB-PROCESSORS

Sub-processor map · none disclosed

Source ↗
Vendor discloses zero sub-processors. All data processing happens in-house.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-07-09).
FEATURES

Capability matrix

Custom domain No
Reply from alias No
PGP-encrypted forwarding No
Catch-all domain No
INTEGRATION & ACCESS
REST API No
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option Yes
PRICING

Pricing & tiers

FREE
Custom pricing

Contact vendor for tier or volume pricing.

View pricing page ↗
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    www.aliasvault.com/privacy-policy…
    Open ↗
  • Terms of Service
    www.aliasvault.com/terms-and-conditions…
    Open ↗
ALTERNATIVES

Alternatives in this category

SimpleLogin
Switzerland · Founded 2019
EU-BASED

Paris-founded (2019) email-alias service acquired by Proton AG in 2022; unlimited aliases, custom domains, PGP forwarding and catch-all on Premium, hosted across Proton/UpCloud data centres in DE, CH, NL and FR.

Public DPA Sub-processors Open source
FROM
€3.5/mo
CLOUD ACT
MINOR
addy.io
United Kingdom · Founded 2019
EU-BASED

England-and-Wales-governed email-alias service (formerly AnonAddy), hosted in the Netherlands; unlimited aliases, PGP-encrypted forwarding and reply-from-alias on paid tiers, open-source and self-hostable. Its operating legal entity is not named in its own Terms or Privacy Policy.

Public DPA Sub-processors Open source
FROM
€0.87/mo
billed annually
CLOUD ACT
MINOR
AdGuard Mail
Cyprus · Founded 2024
EU-HOSTED

Cyprus-registered (AdGuard Software Ltd) free/paid email-alias and temp-mail service that reached general availability (v1.0) in June 2025; core forwarding runs on Amazon SES (US), and no DPA is published.

Public DPA Sub-processors Open source
FROM
€2.99/mo
CLOUD ACT
MATERIAL