vBoxxConnect
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
vBoxx B.V.
Business email, calendars, contacts, tasks, video conferencing and chat from vBoxx B.V., on the vendor's own hardware in Amsterdam with ISO 27001 certified to the company itself; an integrated Microsoft 365 / Outlook alternative for Benelux teams (TLS, not E2E).
vBoxxConnect is an EU-owned service hosted in the Netherlands, with no identified CLOUD Act exposure. It is listed under Private email.
Assessment notes
vBoxxConnect is the business email and groupware service of vBoxx B.V. (The Hague, KvK 55105092), a privately held Dutch hosting company founded in 2012 that serves the Netherlands and Benelux. It bundles email, contacts, calendars, tasks, video conferencing and chat on a SmarterMail installation that vBoxx runs on its own hardware; per the vendor's FAQ the data sits in maincubes AMS01, Amsterdam, and never leaves the Netherlands. EU-owned, EU-hosted, no US provider on the data path, no CLOUD Act exposure. ISO/IEC 27001 is certified by TÜV NORD to vBoxx B.V. itself (CERT-001474-TN, valid to January 2029), so it counts as a vendor certification here. Encryption is TLS in transit and server-side at rest; it is not zero-access end-to-end encrypted, so the fit is an EU-hosted Microsoft 365 / Outlook alternative rather than a zero-knowledge mailbox. Held at 4/5 because no data processing agreement is published for vBoxxConnect (the public DPA on cloud.vboxx.eu is written for the vBoxxCloud storage service; vBoxx's legal page says DPAs are provided on request) and no vBoxxConnect-specific sub-processor list exists.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
End-to-end encryption: No
-
Public DPA: Not assessed
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About vBoxxConnect
vBoxxConnect is the business email and collaboration service of vBoxx B.V., a privately held hosting company in The Hague (KvK 55105092) founded in 2012 that serves the Netherlands and Benelux. It bundles email with tagging, templates and signatures, shared contacts, multiple calendars with meeting invitations, tasks, password-protected video conferencing with file sharing and chat, and account reports on storage, message volume, spam and viruses. Exchange Web Services, MAPI and Exchange ActiveSync are included on both plans, so Outlook and mobile clients connect natively; free migration, daily backups and multiple domains are included too. The positioning is an integrated, Netherlands-hosted alternative to Microsoft 365 / Outlook and Google Workspace for businesses that want their mail, calendar and meetings inside Dutch infrastructure.
The service runs on a SmarterMail installation (software from SmarterTools, a US vendor, licensed and run on vBoxx's own servers, so the software maker is a licensor, not a processor of customer data). Per the vendor's FAQ, vBoxxConnect data is stored in maincubes AMS01 in Amsterdam, the same data centre as the rest of vBoxx's services, and never leaves the Netherlands; the mail host sits on a Dutch carrier's address space and is reached through Amsterdam. That is an EU-owned, EU-hosted posture with no CLOUD Act exposure. ISO/IEC 27001 is certified by TÜV NORD to vBoxx B.V. itself (CERT-001474-TN, ISO/IEC 27001:2022, valid to 31 January 2029, scope "sales, implementation, maintenance, monitoring and support of cloud-services"), so the directory records it as a vendor certification. Encryption is TLS in transit and server-side at rest; this is business groupware, not a zero-access end-to-end-encrypted mailbox like Proton Mail or Tuta. No data processing agreement is published for vBoxxConnect: the public DPA on cloud.vboxx.eu is written for the vBoxxCloud storage service, and vBoxx's legal page says DPAs are provided on request, which is what the entry records. No vBoxxConnect-specific sub-processor list is published either. Pricing on monthly billing: Starter EUR 4.50 and Business EUR 6.00 per user per month, plus EUR 1 per 10 GB of storage; the price table does not state whether VAT is included. Best fit: Dutch and Benelux SMBs that want one Netherlands-hosted environment for mail, calendar and meetings from a Dutch contracting party.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of vBoxxConnect
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
on requestData Processing Addendum (DPA)— on request
-
missingSub-processors list— missing
-
OpenTerms of Servicevboxx.eu/terms-and-conditions…
Alternatives in this category
-
Switzerland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
E2E: Yes Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €3/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
E2E: Yes Public DPA: No Sub-processors: Yes Open source: No -
-
Germany · €1/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
E2E: No Public DPA: Not assessed Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
|
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
E2E: Yes
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
|
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
E2E: Yes
Public DPA: No
Sub-processors: Yes
Open source: No
|
€3/mo |
|
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
E2E: No
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
€1/mo |