# Fastmail for Business — Business Email & Office Suites

Fastmail for Business by Fastmail Pty Ltd holds a panel rating of 2/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Fastmail Pty Ltd (https://www.fastmail.com/business/)
- Category: [Business Email & Office Suites](https://whats-best.ai/software/business-email.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/business-email/fastmail
- Alternatives: https://whats-best.ai/software/business-email/fastmail/alternatives ([markdown](https://whats-best.ai/software/business-email/fastmail/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Fastmail Pty Ltd
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 5 Nov 2026

## The panel's verdict

Fastmail for Business, from Fastmail Pty Ltd, Australia, earns its best scores on migration and portability, 5 to 6: a self-serve tool imports mail, contacts and calendars from IMAP, CardDAV or CalDAV sources, with everything reachable over JMAP, IMAP, POP, SMTP, CalDAV, CardDAV and WebDAV. Discounting one judge who scored zero everywhere, mail and deliverability splits 4 to 6 — the 6s credit 100 domains at no extra cost, free aliases and 50 GB per user, the 4s citing no public information on Exchange ActiveSync, native Outlook or SPF, DKIM, DMARC set-up. Security and compliance spans 4 to 6 on documented encryption, passkeys, audited staff access, a transparency report, against no stated certification and end-to-end encryption declined in the vendor's own apps. Calendar and office, administration and identity and sovereignty sit at 4, pricing transparency at 4 to 5: no document editing or video meetings documented, administration thin beyond user tools, an Australian contracting entity offering EU or USA data residency, and €5 per month or €60 for 12 months published without multi-user tier prices.

**Speaks for it:**
- A self-serve tool imports mail, contacts and calendar events from any IMAP, CardDAV or CalDAV source — Gmail, Yahoo, AOL and Outlook.com (mail only) are named — and keeps fetching new mail from the old inbox
- Access runs throughout on open protocols — JMAP, IMAP, POP, SMTP, CalDAV, CardDAV, WebDAV — with documented account data download
- Up to 100 domains at no extra cost, free aliases including a catch-all, and 50 GB per user with up to 300 GB purchasable
- A reseller programme lets a partner create, modify, delete and access user accounts for the organisations it supports, with direct billing available
- A published data processing agreement with Standard Contractual Clauses, encryption in transit and at rest, two-factor sign-in with passkeys, logged and audited staff access, and an annual transparency report

**Held against it:**
- We found no public information on Exchange ActiveSync, native Outlook (MAPI) connectivity, or SPF, DKIM and DMARC set-up for customer domains
- We found no public information on document co-editing, video meetings, tasks, free/busy lookup or room and resource booking
- We found no public information on single sign-on, directory synchronisation, SCIM provisioning, admin roles or exportable admin audit logs
- We found no public information on certifications such as ISO 27001 or BSI C5, and the security page states end-to-end encryption is not offered in the vendor's own apps
- The captured pages give different figures for tax treatment and for deletion after account closure (seven days versus fourteen days), and we found no public price for the multi-user tiers or additional storage

**Best for:**
- You need professional email on your own domains for a small team, with a self-serve move from Gmail, Outlook.com or any IMAP provider
- You are an IT provider or reseller who creates and manages mail accounts for several small organisations and bills them yourself
- You want your mail, calendars and contacts reachable through open standards such as IMAP, CalDAV and JMAP, with a documented download path out
- Your needs stop at shared calendars and a shared address book synced over CalDAV and CardDAV, with mail handled in standard clients

**Avoid if:**
- Your team lives in Outlook on Exchange: the pages document Outlook only as a third-party app connection
- You need end-to-end encryption in the provider's own apps: the security page states it is not offered, with PGP and S/MIME only through third-party clients
- Your procurement requires a European contracting entity or named subprocessors: the contracting entity is Fastmail Pty Ltd in Victoria, Australia, and subprocessors appear only by category
- You must quote a firm annual price for a multi-user team: the captured pages give different tax figures and we found no public per-user price for the multi-user tiers

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Small Firm Owner | The IT Administrator | The Public Sector IT Lead | The IT Service Provider | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Mail, domains & deliverability | 3/5 | 3/5 | 2.5/5 | 2/5 | 2/5 | 0/5 |
| Calendar, contacts & office apps | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 0/5 |
| Security, encryption & compliance archiving | 2/5 | 3/5 | 2/5 | 2.5/5 | 2.5/5 | 0/5 |
| Administration, identity & partner management | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 0/5 |
| Migration, open standards & exit | 2.5/5 | 3/5 | 2.5/5 | 2.5/5 | 3/5 | 0/5 |
| European sovereignty | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 0/5 |
| Pricing transparency | 2/5 | 2/5 | 2.5/5 | 2/5 | 2/5 | 0/5 |
| **Weighted verdict** | **2.5/5** | **2.5/5** | **2/5** | **2/5** | **2.5/5** | **0/5** |

### The judges

- **The Small Firm Owner** (v1.0): Runs a tax and accounting firm of twelve in Lower Saxony. Every member of staff lives in Outlook, the shared "kanzlei@" mailbox is the busiest address in the office, and the meeting room is booked by shouting across the corridor. Wants mail on the firm's own domain that arrives, a shared calendar and address book on every phone, a move from the old provider that does not lose a single client thread, and a per-user price that is still the price in the second year.
- **The IT Administrator** (v1.0): IT administrator at a machine builder in Baden-Württemberg with three hundred mailboxes, an on-premises Exchange that reaches end of support, and Active Directory as the source of every account. Wants Outlook to keep working without a plug-in nobody maintains, shared mailboxes and room booking, single sign-on and directory sync, mobile devices that can be wiped, an API for provisioning, and a migration that moves calendars and permissions, not only mail.
- **The Public Sector IT Lead** (v1.0): Head of IT at a district administration in Bavaria with eleven hundred staff, told by the council to leave Microsoft within three years. Has read what Schleswig-Holstein did and what it cost. Needs mail, calendars and documents that a whole administration can work in, open formats and open source where possible, BSI C5 or ISO 27001 on paper, a provider whose owners answer to European law only, and an exit plan before the contract is signed.
- **The IT Service Provider** (v1.0): Runs a six-person IT service company in Austria that looks after mail for forty client firms, from a two-person architect's office to a hotel group. Spends Mondays on mails that landed in spam and phones that stopped syncing. Wants one partner console for every client, DKIM and DMARC set up without a ticket, migrations it can run itself, support that answers within the hour, and margins it can calculate before it quotes.
- **The Data Protection Officer** (v1.0): Data protection officer for a group of nine medical practices in North Rhine-Westphalia, where a referral letter sent by mail is patient data under professional secrecy. Reads the subprocessor list and the transparency report before the feature page, asks who at the provider can open a mailbox and under which law, and wants encryption the practices can actually use with outside doctors, archiving that satisfies the tax office, and a data processing agreement that names every server.
- **The Skeptic** (v1.0): Has seen "hosted in Germany" from a provider whose spam filter and support desk sit in the United States, "Exchange-compatible" that meant IMAP with a calendar plug-in, and a first-year price of one euro that became seven. Asks which protocols Outlook really uses, whether the archive would survive a tax audit, what the certification actually covers — and how ten years of mail, calendars and contacts would leave.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- 2FA recommended: yes [S11]
- Acl rights: Australian Consumer Law, schedule 2, Competition and Consumer Act 2010 [S10]
- AI policy: Anthropic · no [S11]
- Breach notification: Breach notification as soon as practicable [S12]
- Confidentiality: Employees, agents and subprocessors bound by confidentiality obligations [S12]
- Data retention exception: Retention only for legal obligations and platform integrity/security [S12]
- Data subject verification: Identity verification required for data subject requests [S12]
- DPA sccs breach notification: yes [S17]
- DPA sccs supervisory audit: yes [S17]
- DPA sccs third party beneficiary: yes [S17]
- DPA updates: DPA may be updated for changes in Data Protection Laws [S12]
- Employee access controls: Employee access to personal data requires justification, is logged and audited (principle of least privilege) [S6]
- Encryption: yes [S11]
- Export controls: Developers must comply with export control and sanctions laws; questions to legal@fastmail.com [S19]
- Google API: yes [S11]
- International transfers: Customer authorizes transfers to any country or territory [S12]
- No sale: no [S11]
- Privacy rights: access · correct · deletion · withdraw consent · transfer · object · restrict processing [S11]
- Sccs: Standard Contractual Clauses (SCCs) for EU/UK transfers [S11]
- Tls standards: yes · yes [S5]
- Transfer countries: US · Netherlands · Australia · India · Austria [S11]
- Transparency report: Publishes a data transparency report showing how many requests actioned each year [S6]
- Transparency report: yes [S11]

**Data**
- Account closure deletion days: 14 [S12]
- Account information definition: Includes technical details like logs (IP, email metadata) [S12]
- Children: 18 [S11]
- Collected: name · primary username (Fastmail email) · billing and contact details · organization and domain names · IP address · browser type [S11]
- Communications data definition: Email content, attachments, and related metadata [S12]
- Communications data role: Fastmail is a Processor for Communications Data (email content, attachments, and related metadata) [S12]
- Content type definition: email and associated content · data about the accountholder [S16]
- Deletion period: 7 [S11]
- DPA sccs termination return delete: yes · yes [S17]
- Export: yes · yes [S11]
- Export available: yes [S12]
- Nonpayment deletion: Deletion window 30 days to 1 year depending on account duration [S12]
- On request deletion: yes [S12]
- Payment: tokenized [S11]
- Post termination retention: yes [S10]
- Processing: storing emails, contacts, calendar entries and files · device sync · search · contact suggestions [S11]
- Requests 2021: 2021 · 33 · 16 [S16]
- Requests 2022: 2022 · 11 · 9 [S16]
- Requests 2023: 2023 · 16 · 12 [S16]
- Requests 2024: 2024 · 16 · 13 [S16]
- Requests 2025: 2025 · 16 · 5 [S16]
- Retention email address: 12 [S11]
- Retention ip logs: 12 [S11]
- Sharing with providers: trusted service providers (hosting, support, payment processing), possibly using automated/AI tools [S11]

**Hosting**
- Data residency options: EU · USA · yes [S5]

**Integrations**
- API docs: yes [S2]
- API docs: yes [S20]
- API documentation: yes [S1]
- API tokens: JMAP · everything else [S7]
- Audit right: yes [S19]
- Backwards incompatible changes: Backwards incompatible API changes possible; notice attempted, updates via @Fastmail Twitter and changelogs [S19]
- Calendars protocols: CalDAV · yes [S7]
- Commercial use: no · yes [S19]
- Cors enabled: yes [S7]
- Developer privacy requirements: Developers offering apps to external users must maintain a user agreement and privacy policy and notify Fastmail of breaches affecting Core Services users [S19]
- Dropbox: yes [S1]
- Feedback license: Feedback license: unlimited, worldwide, irrevocable, perpetual, sublicensable, transferable, royalty-free [S19]
- Files protocols: WebDAV [S7]
- Jmap session URL: https://api.fastmail.com/jmap/session [S7]
- Mail protocols: JMAP · SMTP · JMAP · IMAP · POP [S7]
- Masked email API: API integrations for creating masked email addresses, used by 1Password and Bitwarden [S18]
- Migration: mail · calendars · contacts · yes [S9]
- Named integrations: 1Password (Masked Email), Dropbox (attachment access), YouCanBookMe, SavvyCal, SaneBox, BitWarden (Masked Email), Morgen [S1]
- No competing use: APIs may not be used to replicate or compete with the Core Services [S19]
- Oauth authorize URL: https://api.fastmail.com/oauth/authorize [S7]
- Oauth code expiry: 10 [S7]
- Oauth device isolation: no [S7]
- Oauth grant flow: RFC 6749 · Authorization Code [S7]
- Oauth pkce required: yes · RFC 7636 · SHA-256 [S7]
- Oauth public clients: no [S7]
- Oauth refresh token rotation: yes [S7]
- Oauth revocation endpoint: https://api.fastmail.com/oauth/revoke · RFC7009 [S7]
- Oauth scopes: urn:ietf:params:jmap:core · urn:ietf:params:jmap:mail · urn:ietf:params:jmap:submission · urn:ietf:params:jmap:vacationresponse · urn:ietf:params:jmap:contacts · https://www.fastmail.com/dev/maskedemail [S7]
- Oauth supported: yes [S7]
- Oauth token URL: https://api.fastmail.com/oauth/refresh [S7]
- Open source samples: yes · yes [S7]
- Public API license: Non-exclusive, revocable, worldwide, non-transferable, limited license to access public APIs and documentation for integrating Applications with Core Services [S19]
- Rate limits: yes [S19]

**Legal**
- Abn: 31 142 646 580 [S9]
- Claims time limit: 12 [S10]
- Company: Fastmail Pty Ltd [S7]
- Company name: Fastmail Pty Ltd [S4]
- Company name: 2026 · Fastmail Pty Ltd [S21]
- DPA sccs audit right: yes [S17]
- DPA sccs basis: C(2010)593 · 95/46/EC [S17]
- DPA sccs exporter: FastMail [S17]
- DPA sccs governing law: law of the Member State in which the data exporter is established [S17]
- DPA sccs importer: the Customer who has entered into the DPA for the provision of FastMail Services [S17]
- DPA sccs no variation: yes [S17]
- DPA sccs subprocessing consent: yes [S17]
- Entire agreement: API Terms plus API Developer Policy form the binding Contract [S19]
- Entity: Fastmail Pty Ltd [S2]
- Entity: Fastmail Pty Ltd [S3]
- Entity: Fastmail Pty Ltd [S5]
- Entity: Fastmail Pty. Ltd. · PO Box 234, Collins St West, Victoria 8007, Australia [S9]
- Entity: Fastmail Pty Ltd [S8]
- Entity: 31 142 646 580 · Fastmail Pty Ltd · PO Box 234, Collins Street West, VIC 8007, Australia · Australia [S11]
- Entity: 31 142 646 580 · Fastmail Pty Limited [S12]
- Entity: Fastmail Pty Ltd [S18]
- Entity: Fastmail Pty Ltd [S20]
- Governing law: Victoria, Australia · courts sitting in the State of Victoria, Australia [S10]
- Governing law: Victoria, Australia · courts located in Victoria, Australia [S19]
- Law enforcement requests: Responds only to Australian law enforcement warrants; forbidden from disclosing to foreign authorities; no dragnet access [S6]
- Legal entity: Fastmail Pty Ltd [S16]
- Liability cap: 100 [S19]
- Operating entity: 142 646 580 · Fastmail Pty Ltd · PO Box 234, Collins St West 8007, Australia [S10]
- Order of precedence: API Terms · Fastmail API Developer Policy · other referenced documents [S19]
- Policies: Terms of service · Privacy policy [S20]
- Precedence: Clauses prevail over DPA, which prevails over other agreements [S12]
- Privacy email: privacy@fastmailteam.com [S9]
- Publicity rights: Fastmail may use developer company name and logo for marketing, subject to trademark guidelines [S19]

**Pricing**
- Additional storage max: 50 · 300 [S8]
- Billing periods: 1 · 12 · 24 · 36 [S8]
- Domain refunds: no [S10]
- Individual price: 1 · 60 · 5 · 12 months · 30 [S8]
- No lock in: no · no [S1]
- Payment methods: credit/debit cards · PayPal · Apple Pay · Google Pay · cash · cheques · bank transfers · money orders [S8]
- Plan change proration: yes · yes [S8]
- Refund policy: no [S8]
- Refund policy: yes · yes [S10]
- Tax inclusive: yes · yes [S8]
- Tax treatment: yes [S10]
- Trial: yes · 30 [S3]
- Trial: 30 · yes [S14]
- Trial: 30 [S15]
- Trial: 30 [S20]
- Trial days: yes · 30 [S4]
- Trial days: 30 [S5]

**Product**
- Admin tools: yes [S8]
- Affiliate payouts: referral becomes a customer · monthly [S18]
- Affiliate program: yes [S18]
- Age requirement: 18 [S10]
- Aliases: free extra addresses routing to one or more users or external address [S3]
- Availability: 24/7 availability claimed [S2]
- Availability 24 7: email and calendar always available, never lost, damaged, or corrupted [S4]
- Brands: Topicbox [S11]
- Calendar: yes [S2]
- Calendar and mobile app: yes · yes [S1]
- Calendar search dragdrop: yes · yes [S14]
- Calendar sharing: yes · yes [S8]
- Catch all alias: catch-all alias with per-address disable [S3]
- Compose call from contact: Compose message or start phone call from a contact with a tap [S15]
- Continued fetching: yes [S20]
- Custom domain email: yes [S1]
- Custom domain email: yes [S2]
- Cyrus server: Cyrus stores email, contacts and calendars; originally started by Carnegie Mellon; Fastmail is primary contributor and maintainer [S21]
- Data residency: EU · USA [S8]
- Ddos protection: yes [S4]
- Domain limit: 100 · no [S13]
- Domain registration: yes · paid customers with tenure > 7 days [S13]
- Domain setup wizard: yes [S1]
- Domain sharing: yes [S8]
- Duo user count: 2 [S8]
- E2e encryption in own apps: no [S5]
- Encryption: yes · yes [S2]
- Encryption: yes [S8]
- Encryption and 2FA: yes · yes [S1]
- Event change detection: yes [S14]
- External calendars: Google · iCloud [S14]
- Family user count: 6 [S8]

**Support**
- 24 7 availability: yes [S1]
- Help center: yes · yes [S8]
- Security channel: Report a security issue · yes [S9]
- US fax: (917) 591-3008 [S9]

90 more facts on the canonical page: https://whats-best.ai/software/business-email/fastmail

## Questions

### Is Fastmail for Business European?

No. whats-best.ai classifies Fastmail for Business as Rest of world.

### Where does Fastmail for Business store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does Fastmail for Business have a free plan?

Not stated on the vendor’s pages as of 5 Nov 2026.

### What are the best alternatives to Fastmail for Business?

As of 6 Nov 2026, the panel rates [grommunio (3.5/5)](https://whats-best.ai/software/business-email/grommunio), [Infomaniak kSuite (3.5/5)](https://whats-best.ai/software/business-email/infomaniak-ksuite) and [Nextcloud Hub (Groupware & Office) (3.5/5)](https://whats-best.ai/software/business-email/nextcloud-hub) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [grommunio](https://whats-best.ai/software/business-email/grommunio) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Fastmail for Business alternatives](https://whats-best.ai/software/business-email/fastmail/alternatives).

## What this page leaves out

- 12 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 10 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage (business): https://www.fastmail.com/business/ (checked 2026-11-05)
- [S2] Features page: https://www.fastmail.com/features/ (checked 2026-11-05)
- [S3] Features page (custom domains): https://www.fastmail.com/features/domains/ (checked 2026-11-05)
- [S4] Features page (reliability): https://www.fastmail.com/features/reliability/ (checked 2026-11-05)
- [S5] Security / trust page: https://www.fastmail.com/features/security/ (checked 2026-11-05)
- [S6] Features page (privacy): https://www.fastmail.com/features/privacy/ (checked 2026-11-05)
- [S7] API documentation: https://www.fastmail.com/dev/ (checked 2026-11-05)
- [S8] Pricing page: https://www.fastmail.com/pricing/ (checked 2026-11-05)
- [S9] About page: https://www.fastmail.com/company/about/ (checked 2026-11-05)
- [S10] Terms of service (names the operating company): https://www.fastmail.com/policies/terms-of-service/ (checked 2026-11-05)
- [S11] Privacy policy: https://www.fastmail.com/policies/privacy/ (checked 2026-11-05)
- [S12] Data processing agreement (dpa): https://www.fastmail.com/policies/dpa/ (checked 2026-11-05)
- [S13] Mail, domains & deliverability — found from sitemap: https://www.fastmail.com/how-to/email-for-your-domain/ (checked 2026-11-05)
- [S14] Calendar, contacts & office apps — found from sitemap: https://www.fastmail.com/features/calendar/ (checked 2026-11-05)
- [S15] Calendar, contacts & office apps — found from sitemap: https://www.fastmail.com/features/contacts/ (checked 2026-11-05)
- [S16] Security, encryption & compliance archiving — found from sitemap: https://www.fastmail.com/policies/transparency-report/ (checked 2026-11-05)
- [S17] Security, encryption & compliance archiving — found from sitemap: https://www.fastmail.com/policies/archive/dpa/eustandardclauses/ (checked 2026-11-05)
- [S18] Administration, identity & partner management — found from sitemap: https://www.fastmail.com/company/partners/ (checked 2026-11-05)
- [S19] Administration, identity & partner management — found from sitemap: https://www.fastmail.com/policies/api-terms-of-service/ (checked 2026-11-05)
- [S20] Migration, open standards & exit — found from sitemap: https://www.fastmail.com/features/migrate/ (checked 2026-11-05)
- [S21] Migration, open standards & exit — found from sitemap: https://www.fastmail.com/company/open-source/ (checked 2026-11-05)

---

Cite as: whats-best.ai, "Fastmail for Business — Business Email & Office Suites", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-email/fastmail

Corrections: https://whats-best.ai/correct/1559?target=page