Business Email & Office Suites
Fastmail for Business
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Fastmail Pty Ltd · www.fastmail.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Fastmail for Business at a glance
- Vendor
- Fastmail Pty Ltd
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates Fastmail for Business 2/5, the mean of 6 judges. Fastmail for Business, from Fastmail Pty Ltd, Australia, earns its best scores on migration and portability, 5 to 6: a self-serve tool imports mail, contacts and calendars from IMAP, CardDAV or CalDAV sources, with everything reachable over JMAP, IMAP, POP, SMTP, CalDAV, CardDAV and WebDAV. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Fastmail for Business, from Fastmail Pty Ltd, Australia, earns its best scores on migration and portability, 5 to 6: a self-serve tool imports mail, contacts and calendars from IMAP, CardDAV or CalDAV sources, with everything reachable over JMAP, IMAP, POP, SMTP, CalDAV, CardDAV and WebDAV. Discounting one judge who scored zero everywhere, mail and deliverability splits 4 to 6 — the 6s credit 100 domains at no extra cost, free aliases and 50 GB per user, the 4s citing no public information on Exchange ActiveSync, native Outlook or SPF, DKIM, DMARC set-up. Security and compliance spans 4 to 6 on documented encryption, passkeys, audited staff access, a transparency report, against no stated certification and end-to-end encryption declined in the vendor's own apps. Calendar and office, administration and identity and sovereignty sit at 4, pricing transparency at 4 to 5: no document editing or video meetings documented, administration thin beyond user tools, an Australian contracting entity offering EU or USA data residency, and €5 per month or €60 for 12 months published without multi-user tier prices.
Speaks for it
- A self-serve tool imports mail, contacts and calendar events from any IMAP, CardDAV or CalDAV source — Gmail, Yahoo, AOL and Outlook.com (mail only) are named — and keeps fetching new mail from the old inbox
- Access runs throughout on open protocols — JMAP, IMAP, POP, SMTP, CalDAV, CardDAV, WebDAV — with documented account data download
- Up to 100 domains at no extra cost, free aliases including a catch-all, and 50 GB per user with up to 300 GB purchasable
- A reseller programme lets a partner create, modify, delete and access user accounts for the organisations it supports, with direct billing available
- A published data processing agreement with Standard Contractual Clauses, encryption in transit and at rest, two-factor sign-in with passkeys, logged and audited staff access, and an annual transparency report
Held against it
- We found no public information on Exchange ActiveSync, native Outlook (MAPI) connectivity, or SPF, DKIM and DMARC set-up for customer domains
- We found no public information on document co-editing, video meetings, tasks, free/busy lookup or room and resource booking
- We found no public information on single sign-on, directory synchronisation, SCIM provisioning, admin roles or exportable admin audit logs
- We found no public information on certifications such as ISO 27001 or BSI C5, and the security page states end-to-end encryption is not offered in the vendor's own apps
- The captured pages give different figures for tax treatment and for deletion after account closure (seven days versus fourteen days), and we found no public price for the multi-user tiers or additional storage
Best for
- You need professional email on your own domains for a small team, with a self-serve move from Gmail, Outlook.com or any IMAP provider
- You are an IT provider or reseller who creates and manages mail accounts for several small organisations and bills them yourself
- You want your mail, calendars and contacts reachable through open standards such as IMAP, CalDAV and JMAP, with a documented download path out
- Your needs stop at shared calendars and a shared address book synced over CalDAV and CardDAV, with mail handled in standard clients
Avoid if
- Your team lives in Outlook on Exchange: the pages document Outlook only as a third-party app connection
- You need end-to-end encryption in the provider's own apps: the security page states it is not offered, with PGP and S/MIME only through third-party clients
- Your procurement requires a European contracting entity or named subprocessors: the contracting entity is Fastmail Pty Ltd in Victoria, Australia, and subprocessors appear only by category
- You must quote a firm annual price for a multi-user team: the captured pages give different tax figures and we found no public per-user price for the multi-user tiers
The scores
| Criterion | Panel median |
|---|---|
| Mail, domains & deliverability | 2.5 of 5 |
| Calendar, contacts & office apps | 2 of 5 |
| Security, encryption & compliance archiving | 2.5 of 5 |
| Administration, identity & partner management | 2 of 5 |
| Migration, open standards & exit | 2.5 of 5 |
| European sovereignty | 2 of 5 |
| Pricing transparency | 2 of 5 |
Mail, domains & deliverability
panel disagrees
Show reasoningHide reasoning
How this is scored
How well the mailbox itself works: custom domains and their DNS set-up, aliases, catch-all, shared and functional mailboxes, distribution lists, mailbox and attachment size limits, IMAP, POP3, SMTP and Exchange ActiveSync or MAPI for Outlook, web and mobile apps, spam and malware filtering, SPF, DKIM, DMARC and MTA-STS, out-of-office and server-side rules, send limits, and the delivery reputation of the sending infrastructure. A self-hosted groupware is judged on the mail server it ships; a suite whose mail app is only a client for another server scores at the level of that client.
0 — No mailbox at all; a product that only sends transactional mail or only reads another provider's mail without a server of its own or a documented one to pair it with.
3 — Mailboxes on a custom domain with IMAP and SMTP and a webmail; aliases, shared mailboxes, filtering and DKIM or DMARC are basic or not described.
5 — Several custom domains with a documented DNS set-up, aliases and distribution lists, shared or functional mailboxes, IMAP and SMTP plus mobile apps, spam and malware filtering, SPF and DKIM signing, mailbox size per plan stated, server-side rules and out-of-office replies.
8 — Exchange ActiveSync or native Outlook (MAPI) support, DMARC reporting and MTA-STS or DANE, catch-all and plus addressing, delegated access and send-as, quarantine an admin can review, send and attachment limits stated, and the deliverability of the outbound infrastructure documented.
10 — A mail platform a large organisation runs on: every protocol above with feature parity stated per client, inbound and outbound gateways configurable, journaling, DANE and MTA-STS enforced, delivery monitoring and bounce analysis for admins, and mail flow documented end to end.
The Small Firm Owner
Mail on our own domain is well documented: up to 100 domains at no extra cost, a setup wizard, free aliases including a catch-all, as many users as needed each with their own inbox and login, access via IMAP, POP, SMTP and JMAP, a full mobile app, spam and phishing protection, and 50 GB per user stated. We found no public information on SPF, DKIM or DMARC, MTA-STS, or Exchange ActiveSync and native Outlook (MAPI) support — with twelve people working in Outlook every day, that decides it for me. 3 7 8 13 21
The IT Administrator
Domains and addressing are strong: up to 100 domains at no extra cost with a setup wizard, free aliases including a catch-all, automatic reply-from-the-address-a-message-was-sent-to, and 50 GB per user with up to 300 GB purchasable, over JMAP, IMAP, POP and SMTP with a full mobile app and spam and phishing protection. Outlook is only documented as a third-party app connection — we found no public information on Exchange ActiveSync or native MAPI — and we found no public information on SPF, DKIM, DMARC or MTA-STS set-up, shared or functional mailboxes, or stated send and attachment limits. 3 7 8 13 21
The Public Sector IT Lead
Custom domains up to one hundred at no extra cost with a setup wizard, aliases including a catch-all, IMAP, POP and SMTP plus JMAP, webmail and mobile apps, spam and phishing filtering, server-side rules and 50 GB per user stated. We found no public information on SPF, DKIM or DMARC signing, shared or functional mailboxes, distribution lists, or Exchange ActiveSync and native Outlook connectivity. 1 3 7 8 13
The IT Service Provider
Custom domains with a setup wizard, free aliases, a catch-all with per-address disable and up to 100 domains at no cost, plus IMAP, POP, SMTP and JMAP access and 50 GB per user stated, cover most of what my smaller clients need. The pages give nothing on SPF, DKIM or DMARC for customer domains, no distribution lists beyond the separate Topicbox brand, no Exchange ActiveSync for the Outlook shops, and send limits are described only as limits to prevent abuse. 3 7 8 13 2
The Data Protection Officer
Custom domains — up to one hundred at no extra cost — a setup wizard, free aliases including a catch-all routing to one or more users or an external address, IMAP, POP, SMTP and JMAP access, spam and phishing protection and a stated 50 GB per user are documented. We found no public information on SPF, DKIM, DMARC or MTA-STS signing, on Exchange ActiveSync or a native Outlook connection, on send limits, or on shared and functional mailboxes. 3 7 8 13
The Skeptic
The mailbox is real and the vendor runs its own server: mail via JMAP, IMAP and POP with sending via JMAP or SMTP, up to 100 custom domains at no extra cost with a setup wizard, free aliases including a catch-all, 50 GB per user stated, and spam and phishing protection. But the pages never say which protocols Outlook really uses — we found no public information on Exchange ActiveSync or native Outlook (MAPI) support, on SPF or DKIM signing, on shared or functional mailboxes, or on stated send and attachment limits; the terms only say limits exist to prevent abuse and that transactional sending is prohibited. 1 2 3 7 8 10 13
Calendar, contacts & office apps
panel disagrees
Show reasoningHide reasoning
How this is scored
What the office plans and writes with: shared and team calendars, free/busy lookup, meeting invitations across providers, room and resource booking, shared address books and a company directory, CalDAV and CardDAV or ActiveSync for phones, Outlook calendar sync, tasks, online office documents with co-editing, file storage that comes with the suite, video meetings and chat inside the bundle, and the desktop and mobile apps.
0 — Mail only, with no calendar or contacts of any kind.
3 — A personal calendar and address book in the webmail; sharing, resources, sync protocols and office apps are basic or not described.
5 — Shared calendars and address books, meeting invitations with free/busy lookup, CalDAV and CardDAV or ActiveSync sync to phones and desktop clients, a company-wide address book, tasks, and either online office documents or a documented integration with an office suite.
8 — Room and resource booking with approval, delegated calendar access, Outlook calendar and contacts sync documented, co-editing of documents and spreadsheets in the browser, file storage with sharing, video meetings in the bundle, and apps for desktop, iOS and Android.
10 — A full office suite that replaces Microsoft 365 for a whole organisation: every function above with Microsoft file formats edited without loss, scheduling across organisations, resource planning, offline editing, an accessible interface stated against a standard, and feature parity across web, desktop and mobile documented.
The Small Firm Owner
Team calendar sharing, event invitations, a shared address book alongside each person's private one, and CalDAV and CardDAV sync to phones and desktop clients are all documented — that is the shared calendar and address book on every phone that I want. We found no public information on free/busy lookup, room or resource booking, tasks, office documents with co-editing, or video meetings in the bundle, so the meeting room keeps being booked by shouting. 7 8 14 15
The IT Administrator
Shared calendars with event invitations, a shared plus personal address book, automatic event change detection, external Google and iCloud calendars, and CalDAV and CardDAV sync into a full mobile app are documented. We found no public information on free/busy lookup, room and resource booking, tasks, or online document co-editing and video meetings in the bundle — the things three hundred people here would need before giving up Exchange. 7 8 14 15
The Public Sector IT Lead
Shared calendars with event invitations, external calendars from Google and iCloud, a shared address book alongside a personal one, and CalDAV and CardDAV sync to phones and desktop clients. We found no public information on free/busy lookup, room and resource booking, tasks, co-editing of documents, or video meetings in the bundle — a district administration cannot replace Microsoft 365 on calendars and contacts alone. 1 7 8 14 15
The IT Service Provider
Shared team calendars with event invitations, a shared address book alongside a personal one, CalDAV and CardDAV sync and external Google and iCloud calendars are documented, which is more than a bare webmail calendar. We found no public information on free/busy lookup, room and resource booking, tasks, or any online document editing or video meetings, so as an office suite it stops at calendar and contacts. 7 14 15 8
The Data Protection Officer
Shared calendars, event invitations, a shared address book alongside personal ones, comprehensive time zone support and a full-featured mobile app are documented, with CalDAV and CardDAV access for phones and desktop clients. We found no public information on free/busy lookup, room and resource booking, tasks, video meetings, or online document editing with co-editing. 7 8 14 15
The Skeptic
Shared calendars with event invitations, a shared address book alongside a private one, CardDAV and CalDAV sync, external Google and iCloud calendars, and timezone support are all documented, with mobile apps in the bundle. We found no public information on free/busy lookup, room and resource booking, tasks, co-editing of office documents, or video meetings and chat — this is a calendar and contacts suite, not an office bundle, and the 300 GB of purchasable storage is described for mail, contacts and calendars with files reachable only through WebDAV. 2 7 8 14 15
Security, encryption & compliance archiving
panel disagrees
Show reasoningHide reasoning
How this is scored
How mail and documents are protected and kept: TLS enforced in transit, encryption at rest, end-to-end encryption or S/MIME and PGP, who at the provider can read a mailbox, two-factor authentication and passkeys, phishing, malware and account-takeover protection, audit-proof archiving that meets GoBD, retention policies and legal hold, eDiscovery, backups and restore of deleted mail, a transparency report on authority requests, and certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No security information of any kind; no encryption, two-factor sign-in or archiving stated.
3 — Encrypted connections and a password login; encryption at rest, two-factor sign-in, archiving and certifications are basic or not described.
5 — TLS in transit and encryption at rest stated, two-factor authentication, spam, phishing and malware protection, restore of deleted mail for a stated period, archiving offered (built in or as an add-on), and a certification such as ISO 27001 stated for the data centres or the service.
8 — End-to-end encryption, S/MIME or PGP supported, GoBD-compliant archiving documented, retention policies and legal hold, enforced two-factor or passkeys for all users, a transparency report on authority requests, and certifications such as ISO 27001 or BSI C5 published with their scope and auditor.
10 — Security that holds up in an audit of a regulated organisation: zero-access or customer-held keys where the provider cannot read mail, eDiscovery, tamper-proof archive with documented verification, every certification published with its report or attestation available, independent security audits or open-source code reviewed, and incident disclosure documented.
The Small Firm Owner
The pages show TLS 1.3 with perfect forward secrecy, encrypted storage on disks in locked racks, two-step verification with passkeys, spam and phishing protection, employee access to data logged and audited, an annual transparency report with per-year request figures, and real-time replication with daily backups. 4 5 6 11 16
The IT Administrator
Encryption in transit with TLS 1.3 and perfect forward secrecy, encrypted disks in locked racks, two-factor and passkeys, logged and audited staff access under least privilege, an annual transparency report with published request counts, and a published DPA with SCCs are all documented. The pages themselves state end-to-end encryption is not offered in their own apps, with PGP and S/MIME via third-party clients instead; we found no public information on ISO 27001 or BSI C5 certifications, GoBD-compliant archiving, retention policies or legal hold. 5 6 11 12 16
The Public Sector IT Lead
TLS 1.3 with perfect forward secrecy, encryption at rest on disks in locked racks, two-factor sign-in with passkeys, logged and audited staff access, daily checksummed backups, and a yearly transparency report with request numbers back to 2021. We found no public information on ISO 27001 or BSI C5 certification, GoBD-compliant archiving, retention policies, legal hold or restore of deleted mail, and the security page itself states end-to-end encryption is not offered in their own apps, with PGP and S/MIME possible only through third-party clients. 4 5 6 12 16
The IT Service Provider
Encryption in transit and at rest, two-factor plus passkeys, staff access logged and audited, a published annual transparency report with five years of request counts and breach notification in the data processing agreement make the protection side well documented. We found no public information on GoBD-compliant archiving, retention policies or legal hold, no certification such as ISO 27001 appears anywhere, and end-to-end encryption is declined in their own apps with PGP and S/MIME available only through third-party clients. 5 6 11 16 12
The Data Protection Officer
Transport security with TLS 1.3 and perfect forward secrecy, encryption at rest, two-factor sign-in and passkeys, logged and audited employee access, and an annual transparency report with yearly request counts are documented, and the vendor states it responds only to Australian warrants. PGP and S/MIME work only through third-party clients, and the vendor itself states it offers no end-to-end encryption in its own apps. We found no public information on certifications such as ISO 27001 or BSI C5, on GoBD-compliant or audit-proof archiving, or on retention policies and legal hold. 5 6 11 16
The Skeptic
We found no public information on ISO 27001, BSI C5 or SOC 2 certifications, and none on audit-proof archiving, retention policies, legal hold or a stated restore period for deleted mail; whether the archive would survive a tax audit is not something these pages answer. 4 5 6 11 12 16 17
Administration, identity & partner management
panel disagrees
Show reasoningHide reasoning
How this is scored
How an IT team or an IT service provider runs it: an admin console for users, groups, mailboxes and domains, admin roles, single sign-on (SAML or OpenID Connect), sync with Active Directory, Entra ID or LDAP, SCIM provisioning, mobile device policies and remote wipe, audit logs of admin and user actions, usage reports, a documented API for provisioning, multi-tenant or reseller accounts for partners managing several customers, and the support channels and response times per plan.
0 — No administration; one login per mailbox and nothing managed centrally.
3 — A web console to add mailboxes and aliases; roles, single sign-on, directory sync and audit logs are basic or not described.
5 — An admin console for users, groups, mailboxes and domains, admin roles, two-factor sign-in enforceable by the admin, password policies, a documented API or command line for provisioning, an activity or audit log, and business support by phone or ticket stated per plan.
8 — Single sign-on (SAML or OpenID Connect), Active Directory, Entra ID or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, audit logs exportable, delegated administration, partner or reseller accounts that manage several customer organisations, and support response times stated.
10 — Administration that scales across many organisations: every setting reachable by API with parity stated, granular role scopes, policies by group, logs streamed to a SIEM, white-label partner offerings with separate billing, and an SLA with service credits published.
The Small Firm Owner
Admin tools to manage additional users, a documented JMAP API with OAuth, 24/7 expert support from real people on every plan, and a reseller programme through which an IT provider can create, manage and access accounts for several organisations are all documented. We found no public information on admin roles, single sign-on, Active Directory or LDAP synchronisation, SCIM provisioning, mobile device policies with remote wipe, or an activity and audit log for administrators. 7 8 9 10 18
The IT Administrator
Admin tools manage additional users across up to 100 shared domains, a reseller program lets one partner create and manage accounts for several customer organisations with optional direct billing, and 24/7 expert support is included in all plans. We found no public information on single sign-on, Active Directory or LDAP sync, SCIM provisioning, admin roles, admin audit logs, or mobile device policies with remote wipe; the documented JMAP API covers per-user mail and contacts, not provisioning. 3 8 10 18 20
The Public Sector IT Lead
Admin tools to manage additional users, a reseller programme under which a partner can create, modify, delete and access user accounts across several organisations, and 24/7 support from real people included in every plan. We found no public information on single sign-on, directory synchronisation, SCIM provisioning, admin roles, mobile device policies with remote wipe, or exportable audit logs — thin for eleven hundred staff. 3 8 10 18
The IT Service Provider
There is a genuine reseller programme — I can create and manage accounts for the organisations I support, have them billed directly to me, and the terms confirm a reseller can access user accounts on the customer's behalf — which is the partner model I want. Beyond admin tools to manage additional users the documented story is thin: no single sign-on, no Active Directory sync, no customer-facing audit log, no stated response times, and the documented API serves user mail, contact and calendar data rather than provisioning. 8 10 18 7
The Data Protection Officer
Admin tools manage users, everyone on a plan can use shared domains, a JMAP API with OAuth and documented endpoints exists, and a reseller program lets partners create and manage accounts for the organisations they support — the terms state the reseller can create, modify, delete and access user accounts on the customer's behalf. We found no public information on admin roles, single sign-on, directory synchronisation, SCIM provisioning, mobile device policies with remote wipe, or exportable audit logs. 7 8 10 18
The Skeptic
Admin tools manage additional users, domains can be shared across the plan, and a reseller programme genuinely exists — a reseller can create, modify, delete and access user accounts for the organisations it supports, with direct billing to the reseller. We found no public information on single sign-on, Active Directory or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, admin roles, or admin audit logs; support is 24/7 from real people but with no stated response times, and the documented API serves mail, contacts and calendars rather than user provisioning. 7 8 9 10 18 20
Migration, open standards & exit
panel disagrees
Show reasoningHide reasoning
How this is scored
How the organisation gets in and out: migration from Exchange, Microsoft 365, Google Workspace or another IMAP provider with a documented tool or service, mail, calendars and contacts carried over, coexistence during a move, standard protocols (IMAP, CalDAV, CardDAV, JMAP, open document formats) rather than proprietary ones, export of a mailbox and of the whole organisation in standard formats (mbox, EML, PST, ICS, vCard), open-source code or a self-hosted edition, what happens to data when the contract ends, and how domains and DNS are handed back.
0 — No way to bring mail in or take it out; a proprietary store with no IMAP access or export.
3 — IMAP access to mail; a migration path, calendar and contacts export and the end-of-contract handling are basic or not described.
5 — A documented migration from Exchange, Microsoft 365 or Google (a tool, an import or a service), mail, calendars and contacts imported, IMAP, CalDAV and CardDAV or ActiveSync access, export of mail, calendars and contacts in standard formats, and the deletion of data after the contract ends stated.
8 — A migration service or tool that moves whole organisations with calendars and permissions, coexistence with free/busy during the move, open document formats supported natively, export of the whole organisation by the admin, an open-source code base or a self-hosted edition, and a data return period after cancellation stated.
10 — An exit that costs nothing but time: every record exportable in open formats with the method documented, a self-hosted open-source edition with feature parity stated, migration in and out documented with the same tools, and a contractual data return and deletion with confirmation.
The Small Firm Owner
The migration path is the one I care most about and it is properly documented: a tool that imports mail, contacts and calendar events from any IMAP, CardDAV or CalDAV provider including Gmail and Outlook.com, and it keeps fetching new mail that arrives in the old inbox after the switch, which protects client threads. Open protocols run through the whole product — IMAP, POP, SMTP, CalDAV, CardDAV, WebDAV, JMAP — customers can download their data, deletion within fourteen days of account closure is stated, and substantial open-source work including the Cyrus server is published; export formats are not named, and we found no public information on a self-hosted edition or organisation-wide export by an admin. 7 11 12 20 21
The IT Administrator
A documented tool imports mail, contacts and calendar events from any IMAP, CardDAV and CalDAV account — Gmail, Yahoo, AOL and Outlook.com (mail only) are named — and account data can be downloaded, with deletion within 7 to 14 days after closure stated in the privacy policy and DPA. Open standards are a genuine strength: JMAP, IMAP, POP, SMTP, CalDAV, CardDAV and WebDAV on the Cyrus server they maintain. We found no public information on Exchange or Microsoft 365 migration carrying calendars and permissions, coexistence with free/busy during a move, or an admin-side export of the whole organisation in named formats. 7 11 20 21
The Public Sector IT Lead
A documented tool imports mail, calendars and contacts over IMAP, CardDAV and CalDAV and can keep fetching from the old inbox after a move; everything runs on open protocols, including JMAP, which Fastmail leads at the IETF, and deletion of all personal data within fourteen days of closure is stated. We found no public information on migration from Exchange or Microsoft 365, export of a whole organisation by an admin, or a data return period — the terms state access ceases immediately on termination. 7 10 12 20 21
The IT Service Provider
A self-serve tool imports mail, contacts and calendars from any IMAP, CardDAV or CalDAV source — including Gmail, Yahoo, AOL and Outlook.com for mail — and can keep fetching new mail from the old inbox after the move, which is how I would run a cut-over myself. Everything leaves through open protocols (IMAP, CalDAV, CardDAV, JMAP, WebDAV), account data download is documented, and the pages state account data is deleted within seven days after closure and within fourteen days under the data processing agreement; we found no public information on a whole-organisation export by the admin or a self-hosted edition. 20 7 11 12 21
The Data Protection Officer
A documented migration tool copies mail, contacts and calendar events from any IMAP, CardDAV or CalDAV source including Gmail and Outlook.com, and the service keeps fetching new mail from the old inbox after the move. Access runs over open protocols — JMAP, IMAP, POP, SMTP, CalDAV, CardDAV and WebDAV — with open-source components published, and data is deleted after closure, though the captured pages give different figures for that window (seven days versus fourteen days). We found no public information on organisation-wide export by an administrator or on migrating permissions. 7 11 12 20 21
The Skeptic
Getting in is a self-service tool that imports mail, contacts and calendar events over IMAP, CardDAV and CalDAV from Gmail, Yahoo, AOL and Outlook.com — the last for mail only — with continued fetching from the old inbox; we found no public information on a migration from Exchange or Microsoft 365 or on whole-organisation moves with permissions. Getting out rests on unusually open ground: the vendor leads the JMAP specification (RFC 8620), runs the Cyrus server, exposes IMAP, POP, SMTP, CalDAV, CardDAV and WebDAV, offers account data download, and deletes data after closure — though export formats are not stated, the published open-source work covers libraries and frameworks rather than a self-hostable product, and the captured pages give different figures for deletion after closure (seven days in the privacy policy, fourteen days in the DPA). 7 10 11 12 20 21
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where mailboxes, calendars, contacts, documents and backups are stored and processed, who at the provider or its subprocessors can access them, and who the subprocessors are (data centres, spam filtering, support, payment, AI features). Independently sourced by the sovereignty pipeline. An EU data region offered by a non-EU parent is part of the chain, not the whole of it. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (spam filtering, support, backups, AI features) run through non-EU providers or a non-EU parent without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated — or a self-hosted edition documented that keeps every mailbox on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Small Firm Owner
The contracting entity is Fastmail Pty Ltd in Melbourne, Australia, with the law of Victoria named in the terms, customers can choose EU or USA data residency with encrypted storage, and a data processing agreement with EU standard contractual clauses is published alongside an annual transparency report. We found no public information on an EU contracting entity or EU representative; the subprocessors are described only as trusted providers for hosting, support and payment, possibly using automated AI tools, and personal information may be transferred to countries including the US, Australia, India, the Netherlands and Austria. Workable for my office, but the chain is not European end to end. 5 9 10 11 12
The IT Administrator
The contracting entity is Fastmail Pty Ltd of Victoria, Australia, with a US satellite office in Philadelphia; EU data residency is a documented choice, transfers to the US, Netherlands, Australia, India and Austria are disclosed, and a published DPA with Standard Contractual Clauses plus an annual transparency report exist. Subprocessors are named only by category — hosting, support, payment processing — without names or locations, and we found no public information on an EU representative or a European entity: the chain is disclosed, but it is not European. 5 9 10 11 12
The Public Sector IT Lead
The contracting entity is Fastmail Pty Ltd of Australia with the exclusive jurisdiction of Victorian courts and a US satellite company, and the data processing agreement authorises transfers to any country or territory; an EU residency choice and standard contractual clauses for EU users are published, and an annual transparency report names actioned requests. Individual subprocessors with their locations are not listed, and we found no public information on certifications — for a public body whose provider must answer to European law only, this is not a chain I can sign. 5 8 9 10 11 12 19
The IT Service Provider
Customers can choose EU or USA primary data residency on encrypted disks in the vendor's own data centres, a data processing agreement with Standard Contractual Clauses is published, and an annual transparency report exists. But the contracting entity is Fastmail Pty Ltd in Victoria, Australia, the privacy policy names transfers to countries including the US, Australia and India, subprocessors appear only as unnamed categories, and no security certification is stated, so the chain is only partly evidenced. 5 10 11 12 16 17
The Data Protection Officer
The contracting entity is Fastmail Pty Ltd in Australia under the law of Victoria, its own security and pricing pages offer a choice of EU or USA residency in data centres that are not named, and a data processing agreement with standard contractual clauses is published. Subprocessors appear only as categories — hosting, support, payment — the agreement authorises processing and transfer to any country or territory, and the privacy policy names the US, Netherlands, Australia, India and Austria as transfer countries. No European representative or European entity is stated. 5 10 11 12
The Skeptic
The contracting entity is Fastmail Pty Ltd of Melbourne, Australia, with a US satellite office in Philadelphia and exclusive jurisdiction in Victorian courts; customers may choose EU or USA as primary data residency, stored encrypted in the provider's own data centers, with Standard Contractual Clauses published for EU/UK transfers and a stated position of answering only Australian warrants. But the DPA authorises processing and transfer to any country or territory, transfers to the US, Netherlands, Australia, India and Austria are disclosed, and the service providers behind hosting, support, payment and AI tooling are not named — we found no public information on an EU contracting entity or representative, named infrastructure, or security certifications. 5 8 9 10 11 12 17
Pricing transparency
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or mailbox per tier, storage per user, what shared mailboxes, aliases and extra domains cost, which features (archiving, office apps, SSO, advanced security, more storage) cost extra, the first-year discount and the regular price after it, minimum users and term, monthly versus annual billing, and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price per user exists, but how cost scales with storage, users, add-ons or after the first year is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (archiving, extra storage, shared mailboxes, SSO, the price after the introductory period) is unpriced or "on request".
8 — Every tier priced publicly per user with storage, add-ons priced, the regular price after any introductory discount stated, minimum users and term stated, monthly and annual billing compared, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of users, storage and add-ons, with every support, migration and archive fee and the cancellation and data-return terms published.
The Small Firm Owner
The individual plan is public at €5 per month or €60 for 12 months with 50 GB per user, up to 300 GB purchasable, billing terms of 1, 12, 24 or 36 months, free aliases and up to 100 domains at no extra cost, and no introductory discount that would change in the second year. The captured pages give different figures for tax treatment — the pricing page says all prices are tax-inclusive, the terms say prices are exclusive of applicable taxes — and we found no public price for a business tier, for additional storage, or for the Duo and Family tiers, so I cannot compute the annual cost for twelve staff from the public pages. 3 8 10 13
The IT Administrator
The Individual plan is €5 per month or €60 for 12 months including 50 GB per user with up to 300 GB purchasable, billing periods of 1 to 36 months, a 30-day trial, prorated plan changes, and aliases plus up to 100 domains at no extra cost. The captured pages give different figures for tax treatment — the pricing page states all prices are tax-inclusive while the terms state prices are exclusive of taxes — and we found no public information on the per-user price of the multi-user business tier or on what the additional storage costs. 3 8 10 13
The Public Sector IT Lead
Public tiers with a starting price of €5 per month and €60 for 12 months, 50 GB per user with up to 300 GB purchasable, billing terms from one to thirty-six months, and up to 100 domains and free aliases. The price of the purchasable extra storage is not stated, refunds are discretionary, and the captured pages give different figures for tax — the pricing page says all prices are tax-inclusive while the terms say prices are exclusive of applicable taxes. 3 8 10 13
The IT Service Provider
The Individual tier is public at €5 per month or €60 for twelve months with 50 GB per user, billing periods of 1, 12, 24 and 36 months, a 30-day trial, prorated plan changes and 100 of your own domains at no extra cost. Extra storage up to 300 GB is documented but not priced, the per-user price of the multi-user tiers is not on the pages we read, and the captured pages give different statements on tax — the pricing page says all prices are tax-inclusive while the terms say prices are exclusive of taxes — which is exactly the ambiguity that wrecks a quotation. 8 10 13
The Data Protection Officer
The pricing page states an individual plan at €5 per month or €60 for 12 months, billing periods of one, twelve, twenty-four and thirty-six months, 50 GB per user extendable to 300 GB, free aliases and free domains up to one hundred, and a 30-day trial. The captured pages give different statements on tax — the pricing page says all prices are tax-inclusive while the terms say prices are exclusive of taxes — and we found no public information on the price of additional storage or of the multi-user tiers. 8 10 13
The Skeptic
Tier prices are public — "€5 per month €60 for 12 months" for one user, billing periods of 1, 12, 24 and 36 months, 50 GB per user with up to 300 GB purchasable, prorated upgrades and downgrades, a 30-day trial and cancellation at any time. But the extra storage and domain registration fees are unpriced, no minimum users or term is stated, and the captured pages give different figures for taxes: the pricing page says "All prices are tax-inclusive" while the terms say prices are "exclusive of taxes" that might apply in your jurisdiction. 1 8 10
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Fastmail for Business
Is Fastmail for Business European?
No. whats-best.ai classifies Fastmail for Business as Rest of world.
Where does Fastmail for Business store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does Fastmail for Business have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to Fastmail for Business?
As of 6 Nov 2026, the panel rates grommunio (3.5/5), Infomaniak kSuite (3.5/5) and Nextcloud Hub (Groupware & Office) (3.5/5) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is grommunio (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Fastmail for Business alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Hosting options, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 12 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 10 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (21)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (business) www.fastmail.com Checked 5 Nov 2026 Details →
- 2 Features page www.fastmail.com Checked 5 Nov 2026 Details →
- 3 Features page (custom domains) www.fastmail.com Checked 5 Nov 2026 Details →
- 4 Features page (reliability) www.fastmail.com Checked 5 Nov 2026 Details →
- 5 Security / trust page www.fastmail.com Checked 5 Nov 2026 Details →
- 6 Features page (privacy) www.fastmail.com Checked 5 Nov 2026 Details →
- 7 API documentation www.fastmail.com Checked 5 Nov 2026 Details →
- 8 Pricing page www.fastmail.com Checked 5 Nov 2026 Details →
- 9 About page www.fastmail.com Checked 5 Nov 2026 Details →
- 10 Terms of service (names the operating company) www.fastmail.com Checked 5 Nov 2026 Details →
- 11 Privacy policy www.fastmail.com Checked 5 Nov 2026 Details →
- 12 Data processing agreement (dpa) www.fastmail.com Checked 5 Nov 2026 Details →
- 13 Mail, domains & deliverability — found from sitemap www.fastmail.com Checked 5 Nov 2026 Details →
- 14 Calendar, contacts & office apps — found from sitemap www.fastmail.com Checked 5 Nov 2026 Details →
- 15 Calendar, contacts & office apps — found from sitemap www.fastmail.com Checked 5 Nov 2026 Details →
- 16 Security, encryption & compliance archiving — found from sitemap www.fastmail.com Checked 5 Nov 2026 Details →
- 17 Security, encryption & compliance archiving — found from sitemap www.fastmail.com Checked 5 Nov 2026 Details →
- 18 Administration, identity & partner management — found from sitemap www.fastmail.com Checked 5 Nov 2026 Details →
- 19 Administration, identity & partner management — found from sitemap www.fastmail.com Checked 5 Nov 2026 Details →
- 20 Migration, open standards & exit — found from sitemap www.fastmail.com Checked 5 Nov 2026 Details →
- 21 Migration, open standards & exit — found from sitemap www.fastmail.com Checked 5 Nov 2026 Details →