StartMail
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Dutch private email (StartMail B.V., est. ~2014, by Startpage founders), NL-hosted, one-click PGP, unlimited aliases, USD-priced from $4.99/mo annual.
StartMail is a European service hosted in the Netherlands, with at most minor, transient US exposure under the CLOUD Act. It is listed under Private email.
Assessment notes
StartMail is operated by StartMail B.V. in the Netherlands, founded around 2014 by Robert E.G. Beens and David Bodnick (the same founders behind the Startpage privacy search engine) with servers physically located in the Netherlands under Dutch privacy law and GDPR, PGP encryption support including one-click encryption and password-protected encrypted messages, unlimited disposable email aliases, and a published transparency report. Notable open questions: (a) the broader Startpage group has had US ad-tech investor exposure historically (the 2019 Privacy One Group / System1 investment was widely covered and triggered community concern. Current 2026 ownership status needs human verification before publishing; ownership_signal: eu_owned is provisional), (b) pricing is published in USD rather than EUR (unusual for a Dutch company), and (c) DPA and sub-processors URLs were not captured at audit.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
End-to-end encryption: NoBuilt-in PGP available; mail is not zero-access encrypted by default.
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About StartMail
StartMail is a privacy-focused email service operated by StartMail B.V. in the Netherlands. It was founded around 2014 by Robert E.G. Beens and David Bodnick (the same founders behind the Startpage privacy-focused search engine) and the two products share the broader Startpage / Surfboard Holding group history. The product positioning is straightforward: encrypted email under Dutch privacy legislation and GDPR, with one-click PGP encryption support, password-protected encrypted messages for recipients without PGP, unlimited disposable / alias email addresses, no advertising and no tracking, and IMAP/SMTP compatibility with standard email clients.
The infrastructure side is clean: StartMail explicitly states that "our servers are located here as well" (referring to the Netherlands) meaning email storage stays under Dutch and EU law. PGP support is a real differentiator versus Gmail / Outlook / iCloud Mail (none of which offer first-class PGP) and against some other privacy-email vendors. A transparency report and a separate data-processing whitepaper are published.
For an EU-sovereignty audit, two open questions are worth noting. First, the Startpage group ownership history: in 2019 Startpage announced a strategic investment from Privacy One Group, a subsidiary of US ad-tech company System1. The deal triggered significant community concern at the time about a US ad-tech investor's relationship to a privacy product. The 2026 status of that investor relationship needs human verification before this listing publishes; ownership_signal: eu_owned is provisional pending that check. Second, StartMail's own pricing page is denominated in USD (Personal $4.99/month annual = $59.88/year; Business $6.99/month annual = $83.88/year), an unusual choice for a Dutch B.V. and a real signal worth surfacing. DPA and sub-processors URLs were not directly captured at audit.
Best fit: privacy-conscious EU users who want PGP-capable email under Dutch law with unlimited aliases, and who are willing to weigh the Startpage-group US-investor history. Buyers who want the strongest possible EU-sovereignty posture should prefer Tuta (DE, founder-owned, post-quantum), Mailbox.org (DE, BSI C5), Posteo (DE, anonymous signup) or Proton Mail (CH, Foundation-controlled), all elsewhere in this directory.
Sub-processor map · none disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of StartMail
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Switzerland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
E2E: Yes Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €3/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
E2E: Yes Public DPA: No Sub-processors: Yes Open source: No -
-
Germany · €1/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
E2E: No Public DPA: Not assessed Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Proton Mail
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
E2E: Yes
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
Tuta
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
E2E: Yes
Public DPA: No
Sub-processors: Yes
Open source: No
|
€3/mo |
Mailbox.org
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
E2E: No
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
€1/mo |