Business Email & Office Suites
grommunio
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by grommunio GmbH · grommunio.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
grommunio at a glance
- Vendor
- grommunio GmbH
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 5 Nov 2026
- Panel verdict
- The AI panel rates grommunio 3.5/5, the mean of 6 judges. grommunio, an open-source Exchange replacement from grommunio GmbH of Vienna, scores between 5 and 8 across the seven criteria. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
grommunio, an open-source Exchange replacement from grommunio GmbH of Vienna, scores between 5 and 8 across the seven criteria. It is strongest on calendar and office at 8: rooms that auto-accept or decline invitations, delegate access, OnlyOffice co-editing of Word, Excel and PowerPoint formats, chat, video meetings and files in one suite. Migration and portability follows at 7-8: a documented PowerShell script with resume tracking and a delta run after the DNS switch, on 100% open-source code with a free community edition up to 5 users. Weakest are security and compliance at 6 and pricing transparency at 5-6: no certification such as ISO 27001 or BSI C5 appears on the captured pages, the vendor states retention and evidential-value questions belong to the operator, and the Enterprise tier from 1,000 users is priced only on request. On sovereignty the judges split 7-8: the higher scores rest on self-hosting, where the privacy policy states grommunio processes no end-user data; the lower ones weigh the partner-hosted route, where we found no public information on mailbox locations, subprocessors or a data processing agreement.
Speaks for it
- Outlook for Windows connects natively over MAPI/HTTP with nothing to install on the client, alongside EWS, Exchange ActiveSync, IMAP/POP3/SMTP and CalDAV/CardDAV.
- Exchange migration is documented end to end through a shipped PowerShell script with a two-pass mode, resume tracking and a final delta run after the DNS switch.
- The code is published as 100% open source, with a free community edition up to 5 users carrying the full feature set.
- S/MIME is available by default and OpenPGP decrypts in the browser with passphrase-protected keys, no key-server upload and no drafts saved while encrypting.
- Basic, Plus and Business are published at €1.99, €3.99 and €5.49 per user per month, with the vendor stating that all software features are included in every plan.
Held against it
- No certification such as ISO 27001, BSI C5 or SOC 2 appears on the captured pages, and the vendor states that retention and evidential-value questions are the operator's to answer.
- We found no public information on SPF, DKIM, DMARC or MTA-STS set-up, catch-all or plus addressing, or stated message and attachment size limits.
- Sending from an alias address is not permitted by default, matching on-premises Exchange, with a Postfix header rewrite or a shared mailbox with Send As as the documented workarounds.
- The Enterprise tier from 1,000 users is priced only on request, contract term and billing cycle are not stated, and the vendor's own comparison page calls its €4.74 per mailbox / month figure an illustrative estimate, not a quote.
- We found no public information on where certified European partner hosting places mailboxes, on partner subprocessors, or on a published data processing agreement.
Best for
- You run Outlook for Windows and Active Directory today and want a replacement that keeps native Outlook over MAPI/HTTP and directory synchronisation, with no connectors or plugins.
- You are planning a cut-over from Exchange and want the migration path documented before you commit — PST export, two-pass mode, resume tracking and a delta run after the DNS switch.
- You self-host on-premises or in a private cloud and want the data chain on your own servers, with the vendor stating it processes no end-user data in that case.
- You serve several organisations from one installation, using multi-tenancy, an OpenAPI 3.0 REST API, a full command line and LDAP or Active Directory synchronisation.
Avoid if
- Your compliance framework requires a certification such as ISO 27001 or BSI C5 on paper — ask the vendor: the public pages we read do not show it
- You need a quotable per-user price and stated contract terms for a deployment of 1,000 users or more — ask the vendor: the public pages we read do not show it
- You buy through a hosting partner and must verify in advance where the mailboxes sit and which subprocessors are involved — we found no public information on either for the certified European partner route.
- Your users need to send from alias addresses out of the box — it is off by default, matching on-premises Exchange, and requires a Postfix header rewrite or a shared mailbox with Send As.
The scores
| Criterion | Panel median |
|---|---|
| Mail, domains & deliverability | 3.5 of 5 |
| Calendar, contacts & office apps | 4 of 5 |
| Security, encryption & compliance archiving | 3 of 5 |
| Administration, identity & partner management | 4 of 5 |
| Migration, open standards & exit | 4 of 5 |
| European sovereignty | 4 of 5 |
| Pricing transparency | 3 of 5 |
Mail, domains & deliverability
Show reasoningHide reasoning
How this is scored
How well the mailbox itself works: custom domains and their DNS set-up, aliases, catch-all, shared and functional mailboxes, distribution lists, mailbox and attachment size limits, IMAP, POP3, SMTP and Exchange ActiveSync or MAPI for Outlook, web and mobile apps, spam and malware filtering, SPF, DKIM, DMARC and MTA-STS, out-of-office and server-side rules, send limits, and the delivery reputation of the sending infrastructure. A self-hosted groupware is judged on the mail server it ships; a suite whose mail app is only a client for another server scores at the level of that client.
0 — No mailbox at all; a product that only sends transactional mail or only reads another provider's mail without a server of its own or a documented one to pair it with.
3 — Mailboxes on a custom domain with IMAP and SMTP and a webmail; aliases, shared mailboxes, filtering and DKIM or DMARC are basic or not described.
5 — Several custom domains with a documented DNS set-up, aliases and distribution lists, shared or functional mailboxes, IMAP and SMTP plus mobile apps, spam and malware filtering, SPF and DKIM signing, mailbox size per plan stated, server-side rules and out-of-office replies.
8 — Exchange ActiveSync or native Outlook (MAPI) support, DMARC reporting and MTA-STS or DANE, catch-all and plus addressing, delegated access and send-as, quarantine an admin can review, send and attachment limits stated, and the deliverability of the outbound infrastructure documented.
10 — A mail platform a large organisation runs on: every protocol above with feature parity stated per client, inbound and outbound gateways configurable, journaling, DANE and MTA-STS enforced, delivery monitoring and bounce analysis for admins, and mail flow documented end to end.
The Small Firm Owner
Outlook for Windows connects natively over MAPI/HTTP with nothing to install on the client, ActiveSync and EWS cover the phones, and shared mailboxes, MAPI public folders, global address lists and send-as delegation are all documented — our kanzlei@ mailbox keeps working the Exchange way. The admin console sets send, receive and storage quotas per user, and Rspamd spam and malware filtering is built in with its own web interface. I found no public information on SPF, DKIM or DMARC set-up, catch-all, or stated mailbox and message-size figures, and aliases are documented as receive-only by default, with a workaround via a shared mailbox given Send As. 2 3 11 16
The IT Administrator
Native Outlook over MAPI/HTTP with nothing to install on the client, Exchange ActiveSync, EWS and IMAP/POP3/SMTP, shared mailboxes, genuine MAPI public folders, send-as and send-on-behalf, Rspamd spam and malware filtering with an admin dashboard, configurable per-user send, receive and storage quotas, and autodiscover — for my three hundred mailboxes that reads as an Exchange-class server. Sending from an alias address is not permitted by default, mirroring on-premises Exchange, with a documented shared-mailbox and send-as workaround, and we found no public information on DKIM, SPF, DMARC or MTA-STS handling, catch-all, plus addressing or stated send and attachment limits. 2 3 11 16
The Public Sector IT Lead
The decisive fact for us is native Outlook over MAPI/HTTP with no connector in between, alongside Exchange ActiveSync, EWS, IMAP/POP3/SMTP and CalDAV/CardDAV, with domains, per-user send/receive/storage quotas, shared mailboxes, public folders and Rspamd filtering all run from the admin console. Sending from an alias is documented as not permitted by default, matching on-premises Exchange behaviour, with a Postfix workaround described. We found no public information on a documented SPF, DKIM, DMARC or MTA-STS set-up, catch-all or plus addressing, an admin-reviewable quarantine, or stated attachment limits, so those I would have to prove in a pilot before signing. 2 3 6 10 11 16
The IT Service Provider
The mail engine is a genuine Exchange-class server: native Outlook over MAPI/HTTP with no connectors, EWS, ActiveSync, IMAP/POP3/SMTP and CalDAV/CardDAV, autodiscover from just an email address, shared mailboxes with send-as and send-on-behalf, and Rspamd spam and malware filtering with its own admin-reachable web interface. What I found no public information on is SPF, DKIM, DMARC or MTA-STS set-up, catch-all or plus addressing, or stated message-size and sending limits — for forty clients whose mail must not land in spam, that documentation matters. 2 3 6 11 16
The Data Protection Officer
A full mail server ships in the appliance — Postfix as MTA, Rspamd for spam and malware, native Outlook over MAPI/HTTP, ActiveSync and EWS, autodiscover, and delegate and send-as permissions per mailbox. The pages do not document SPF, DKIM or DMARC signing or catch-all behaviour; aliases are documented as receive-only by default, with sending from an alias requiring a Postfix header rewrite or a shared mailbox, and default send or attachment limits are not stated. 2 3 11 16
The Skeptic
Outlook for Windows connects natively over MAPI/HTTP with nothing to install on the client, and EWS, Exchange ActiveSync, IMAP/POP3/SMTP and CalDAV/CardDAV are all listed; Postfix ships as the integrated MTA, Rspamd as the antispam engine with its own admin view, and domains, per-user send/receive/storage quotas and send-as permissions are managed from the admin console. I hold it back because the vendor's own knowledge base states that sending from a secondary alias address is off by default, and we found no public information on DKIM or DMARC signing, MTA-STS, catch-all handling, or stated message and attachment size limits. 2 3 10 11 16
Calendar, contacts & office apps
Show reasoningHide reasoning
How this is scored
What the office plans and writes with: shared and team calendars, free/busy lookup, meeting invitations across providers, room and resource booking, shared address books and a company directory, CalDAV and CardDAV or ActiveSync for phones, Outlook calendar sync, tasks, online office documents with co-editing, file storage that comes with the suite, video meetings and chat inside the bundle, and the desktop and mobile apps.
0 — Mail only, with no calendar or contacts of any kind.
3 — A personal calendar and address book in the webmail; sharing, resources, sync protocols and office apps are basic or not described.
5 — Shared calendars and address books, meeting invitations with free/busy lookup, CalDAV and CardDAV or ActiveSync sync to phones and desktop clients, a company-wide address book, tasks, and either online office documents or a documented integration with an office suite.
8 — Room and resource booking with approval, delegated calendar access, Outlook calendar and contacts sync documented, co-editing of documents and spreadsheets in the browser, file storage with sharing, video meetings in the bundle, and apps for desktop, iOS and Android.
10 — A full office suite that replaces Microsoft 365 for a whole organisation: every function above with Microsoft file formats edited without loss, scheduling across organisations, resource planning, offline editing, an accessible interface stated against a standard, and feature parity across web, desktop and mobile documented.
The Small Firm Owner
Shared calendars with free/busy lookups, meeting rooms that automatically accept free slots and decline conflicts, delegate access for an assistant, granular calendar permissions and recurring appointments are all documented, plus tasks, notes and multiple contact folders with vCard export. Files on a Nextcloud base with sharing and versioning, OnlyOffice co-editing of Word, Excel and PowerPoint in the browser, chat and WebRTC video meetings come in the bundle, with apps for Windows, Apple, Android and Linux. I found no public information on offline editing or a stated accessibility standard, so on paper it stops just short of a complete Microsoft 365 replacement. 2 12 13
The IT Administrator
Meeting-room booking that accepts free slots and declines conflicts automatically, delegate access for assistants, free/busy scheduling with intelligent time suggestions, shared calendars with graded permissions and recurring appointments are all documented, alongside OnlyOffice co-editing of Word, Excel and PowerPoint formats inside a Nextcloud-based file store, video meetings and chat in the bundle, tasks, notes, and CalDAV/CardDAV or ActiveSync to phones. We found no public information on feature parity across web, desktop and mobile, an interface stated against an accessibility standard, or scheduling across organisations. 2 12 13
The Public Sector IT Lead
The calendar evidence reads like something a whole administration can work in: room booking with automatic accept and decline, delegation for assistants, free/busy with time suggestions, shared calendars at three permission depths, and tracking of responses, plus OnlyOffice co-editing of Word, Excel and PowerPoint formats and ODF, files on a Nextcloud base, WebRTC video meetings and chat in the bundle, with Windows, Apple and Android clients. What keeps it off the top step: we found no public information on accessibility against a standard, offline editing, or documented feature parity across web, desktop and mobile, and Word, Excel and PowerPoint desktop licences are explicitly not bundled. 2 3 12 13
The IT Service Provider
Shared calendars with graded permissions, free/busy scheduling views, room booking that accepts and declines automatically, and delegate access for assistants are all documented, and the bundle ships chat, encrypted video meetings, Nextcloud-based file storage and OnlyOffice co-editing of Word, Excel and PowerPoint formats with apps for Windows, Apple, Android and Linux. We found no public information on cross-organisation scheduling, offline editing or accessibility conformance, so it stops short of a full Microsoft 365 replacement on paper. 2 12 13
The Data Protection Officer
Rooms that accept or decline invitations automatically, calendar delegation for assistants, free/busy with three permission levels, and browser co-editing of Word, Excel and PowerPoint formats via OnlyOffice, with chat, video meetings and Nextcloud-based files in the same bundle. Offline editing and an accessibility statement against a standard are not shown on the captured pages. 2 3 12 13
The Skeptic
Rooms book directly into their calendars and decline conflicting times, delegation for assistants and three levels of calendar permissions are documented, and CalDAV/CardDAV plus ActiveSync cover phones, with browser co-editing of Word, Excel and PowerPoint via OnlyOffice, Nextcloud-based file storage, WebRTC video meetings and chat apps for iOS, Android, Windows, Mac and Linux. I stop below the top because Outlook calendar and contacts sync is implied by the native MAPI connection rather than spelled out, and we found no public information on accessibility standards or feature parity across web, desktop and mobile. 2 3 12 13
Security, encryption & compliance archiving
Show reasoningHide reasoning
How this is scored
How mail and documents are protected and kept: TLS enforced in transit, encryption at rest, end-to-end encryption or S/MIME and PGP, who at the provider can read a mailbox, two-factor authentication and passkeys, phishing, malware and account-takeover protection, audit-proof archiving that meets GoBD, retention policies and legal hold, eDiscovery, backups and restore of deleted mail, a transparency report on authority requests, and certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No security information of any kind; no encryption, two-factor sign-in or archiving stated.
3 — Encrypted connections and a password login; encryption at rest, two-factor sign-in, archiving and certifications are basic or not described.
5 — TLS in transit and encryption at rest stated, two-factor authentication, spam, phishing and malware protection, restore of deleted mail for a stated period, archiving offered (built in or as an add-on), and a certification such as ISO 27001 stated for the data centres or the service.
8 — End-to-end encryption, S/MIME or PGP supported, GoBD-compliant archiving documented, retention policies and legal hold, enforced two-factor or passkeys for all users, a transparency report on authority requests, and certifications such as ISO 27001 or BSI C5 published with their scope and auditor.
10 — Security that holds up in an audit of a regulated organisation: zero-access or customer-held keys where the provider cannot read mail, eDiscovery, tamper-proof archive with documented verification, every certification published with its report or attestation available, independent security audits or open-source code reviewed, and incident disclosure documented.
The Small Firm Owner
The encryption story is unusually strong: S/MIME is available by default and OpenPGP as an admin-enabled plugin, with decryption in the browser, private keys passphrase-protected in the mailbox, no key-server upload and no automatic drafts while encrypting; multi-factor sign-in with TOTP, FIDO2 or the identity provider and TLS everywhere are stated, and the archive keeps a deduplicated, encrypted copy of every message with full-text search. For a German tax practice the compliance side is thinner: the archive guide states that which messages must be retained and for how long are legal and organisational questions for the operator, and I found no public information on GoBD-compliant archiving, retention policies with legal hold, a stated restore period for deleted mail, a transparency report, or certifications such as ISO 27001 or BSI C5. 3 4 14 15
The IT Administrator
TLS everywhere with hardened defaults, multi-factor sign-in via TOTP, FIDO2 or the identity provider, S/MIME by default plus browser-side OpenPGP with passphrase-protected keys, an encrypted deduplicated archive built on Piler with full-text search, export, restore and audit logs, and backup & restore are all documented. We found no public information on ISO 27001, BSI C5 or SOC 2 certifications or a transparency report, GoBD archiving is not named, and the vendor states that what must be retained and how evidential value is preserved are the operator's legal and organisational questions. 2 3 4 6 14 15
The Public Sector IT Lead
Encryption is unusually well documented — S/MIME by default, OpenPGP with keys that never leave the browser, multi-factor with TOTP and FIDO2, TLS everywhere out of the box, and an archive built on Piler storing encrypted, deduplicated copies with search and audit logs. But my council asks for BSI C5 or ISO 27001 on paper, and we found no public information on any certification, a transparency report on authority requests, retention policies or legal hold; the archive documentation itself says which messages are retained, for how long and how evidential value is preserved are legal and organisational questions for the operator. 2 3 4 14 15
The IT Service Provider
Encryption is unusually well documented — S/MIME by default and OpenPGP with decryption in the browser, keys passphrase-protected in the mailbox, plus MFA with TOTP, FIDO2 or the identity provider, and an archive based on Piler storing deduplicated encrypted copies with full-text search and audit logs. But we found no public information on certifications such as ISO 27001 or BSI C5 or on a transparency report, and the vendor itself notes that retention and evidential-value questions remain the operator's legal responsibility. 2 3 4 14 15
The Data Protection Officer
S/MIME is on by default and certificates are collected from received signed mail — what I need to send encrypted referral letters to outside doctors — and OpenPGP decrypts in the browser with keys passphrase-protected in the mailbox and no drafts saved while encrypting. But the captured pages name no certification, we found no public information on a transparency report on authority requests, GoBD is not named, and the archive documentation states that retention and evidential value are the operator's legal responsibility; restore periods and encryption at rest of the mail store are not described. 2 3 4 14 15
The Skeptic
S/MIME is on by default and OpenPGP decrypts in the browser with passphrase-protected keys and no unencrypted drafts saved while encrypting — a serious implementation — alongside multi-factor sign-in via TOTP, FIDO2 or your identity provider, and an archive built on Piler storing deduplicated, encrypted copies with full-text search, 2FA and audit logs. But the vendor itself writes that what must be retained and how evidential value is preserved are the operator's legal questions; we found no public information on GoBD-compliant archiving, retention policies, legal hold or a transparency report, and no certification such as ISO 27001 or BSI C5 appears on the captured pages. 3 4 6 14 15
Administration, identity & partner management
Show reasoningHide reasoning
How this is scored
How an IT team or an IT service provider runs it: an admin console for users, groups, mailboxes and domains, admin roles, single sign-on (SAML or OpenID Connect), sync with Active Directory, Entra ID or LDAP, SCIM provisioning, mobile device policies and remote wipe, audit logs of admin and user actions, usage reports, a documented API for provisioning, multi-tenant or reseller accounts for partners managing several customers, and the support channels and response times per plan.
0 — No administration; one login per mailbox and nothing managed centrally.
3 — A web console to add mailboxes and aliases; roles, single sign-on, directory sync and audit logs are basic or not described.
5 — An admin console for users, groups, mailboxes and domains, admin roles, two-factor sign-in enforceable by the admin, password policies, a documented API or command line for provisioning, an activity or audit log, and business support by phone or ticket stated per plan.
8 — Single sign-on (SAML or OpenID Connect), Active Directory, Entra ID or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, audit logs exportable, delegated administration, partner or reseller accounts that manage several customer organisations, and support response times stated.
10 — Administration that scales across many organisations: every setting reachable by API with parity stated, granular role scopes, policies by group, logs streamed to a SIEM, white-label partner offerings with separate billing, and an SLA with service credits published.
The Small Firm Owner
A browser admin console manages users, groups, domains and organisations with role-based access down to read-only domain admins, single sign-on over SAML/OIDC (Keycloak documented), LDAP and Active Directory synchronisation with StartTLS, mobile device policies with remote wipe, tenant management for multiple organisations, and an OpenAPI 3.0 REST API plus a deep command line. Support runs through a network of 200-plus certified partners with manufacturer escalation on higher tiers. I found no public information on SCIM provisioning, exportable audit logs, or concrete support response times per plan — only that Business comes with 'partner support with enhanced response'. 1 2 3 16 17
The IT Administrator
A browser console for users, groups, domains and organisations, an OpenAPI 3.0 REST API and interactive CLI managing appliances, domains and users, Active Directory and OpenLDAP synchronisation with StartTLS and attribute mapping, single sign-on via SAML, OIDC, Kerberos or Keycloak, mobile device management with remote wipe and sync policies, and role-based access down to domain and organisation admins — the exact stack I need to keep Active Directory as the source of every account. We found no public information on SCIM provisioning, exportable audit logs or concrete response times, with only the Enterprise plan carrying a negotiated SLA. 2 3 6 7 16 17
The Public Sector IT Lead
This is built for an IT department: a browser console for users, groups, domains and organizations, a role model from SystemAdmin down to DomainAdmin and OrgAdmin, LDAP and Active Directory synchronisation with several directories at once, SAML/OIDC and Kerberos single sign-on, MDM with remote wipe, and an OpenAPI REST API with a full command line, distributed servers and Ansible, Puppet, Terraform and Helm support. We found no public information on SCIM provisioning, Entra ID synchronisation, exportable audit logs or numerically stated response times, and support is delivered through certified partners with the published tiers describing only an enhanced level of response. 2 3 6 7 16 17
The IT Service Provider
This is close to what I need to run forty firms from one place: a multi-tenant admin UI with organisations and domains, an OpenAPI REST API and a full command line, role-based access down to read-only domain admins, LDAP and Active Directory sync, SAML/OIDC single sign-on, mobile device management with remote wipe, white-labeling and a network of over two hundred certified partners. Support levels are named per plan — up to priority manufacturer escalation with a negotiated SLA at Enterprise — but response times are not stated numerically, and we found no public information on SCIM provisioning or exportable audit logs. 3 7 10 16 17
The Data Protection Officer
Users, domains, organizations and tenants are managed in one console with granular roles, LDAP and Active Directory sync, Kerberos, SAML/OIDC single sign-on, and mobile device management with remote wipe — all scriptable through an OpenAPI REST API and CLI, workable for an IT service provider across several practices. SCIM provisioning, SIEM log streaming and concrete response times are not documented; support response is described only as enhanced at the business tier and the enterprise SLA is negotiated, not published. 3 6 7 16 17
The Skeptic
An OpenAPI 3.0 REST API and a full command-line client sit beside the browser console, with roles from SystemAdmin down to DomainAdmin and OrgAdmin, LDAP and Active Directory synchronisation, SAML/OIDC and Kerberos single sign-on, mobile device management with remote wipe, multi-tenancy for hosting several isolated organisations, and more than 200 certified partners. We found no public information on SCIM provisioning, exportable audit logs or concrete response times — 'enhanced response' on the Business plan and a 'negotiated SLA' at Enterprise are not numbers an IT department can hold anyone to. 1 3 6 7 16 17
Migration, open standards & exit
Show reasoningHide reasoning
How this is scored
How the organisation gets in and out: migration from Exchange, Microsoft 365, Google Workspace or another IMAP provider with a documented tool or service, mail, calendars and contacts carried over, coexistence during a move, standard protocols (IMAP, CalDAV, CardDAV, JMAP, open document formats) rather than proprietary ones, export of a mailbox and of the whole organisation in standard formats (mbox, EML, PST, ICS, vCard), open-source code or a self-hosted edition, what happens to data when the contract ends, and how domains and DNS are handed back.
0 — No way to bring mail in or take it out; a proprietary store with no IMAP access or export.
3 — IMAP access to mail; a migration path, calendar and contacts export and the end-of-contract handling are basic or not described.
5 — A documented migration from Exchange, Microsoft 365 or Google (a tool, an import or a service), mail, calendars and contacts imported, IMAP, CalDAV and CardDAV or ActiveSync access, export of mail, calendars and contacts in standard formats, and the deletion of data after the contract ends stated.
8 — A migration service or tool that moves whole organisations with calendars and permissions, coexistence with free/busy during the move, open document formats supported natively, export of the whole organisation by the admin, an open-source code base or a self-hosted edition, and a data return period after cancellation stated.
10 — An exit that costs nothing but time: every record exportable in open formats with the method documented, a self-hosted open-source edition with feature parity stated, migration in and out documented with the same tools, and a contractual data return and deletion with confirmation.
The Small Firm Owner
Moving off Exchange is the best-documented thing about this product: a PowerShell script automates PST export and import end to end with resume tracking, allow and deny lists, a graceful stop marker, a two-pass mode so staff can start work immediately while history imports in the background, and a final delta run after the DNS/MX switch so that nothing received during the cut-over is lost — my exact requirement. Mail, calendar, contacts, tasks, notes and folder structure come across from Exchange and PST/EDB, with imapsync for IMAP servers and tools for EML, ICS and VCF, and the whole core is 100% open source on GitHub and Codeberg with a genuinely free community edition carrying the full feature set. I found no public information on whole-organisation export back out by the admin or a stated data-return period, and the IMAP path carries no calendars or contacts. 3 4 18 19
The IT Administrator
The exchange2grommunio.ps1 script automates the move end to end — PST export on the Exchange side, import over SSH — carrying mail, calendar, contacts, tasks, notes and folder structure, with a two-pass mode, a delta run after the DNS/MX switch and resumable done/failed tracking; imapsync and Kopano paths are documented too, and the platform is 100 per cent open source with a free self-hosted community edition. We found no public information on migrating mailbox permissions, free/busy coexistence during the cut-over, or a documented whole-organisation export back out. 3 4 18 19
The Public Sector IT Lead
This is where the exit question gets answered: one hundred per cent open source with a free Community edition carrying the full feature set, self-hosted on-premises or in our private cloud, and the Exchange migration documented end to end — a PowerShell script with a two-pass mode for large moves, resumable tracking of successes and failures, and a final delta run after the DNS switch — carrying mail, calendar, contacts, tasks, notes and folder structure. IMAP migration via imapsync, Kopano import and EML, ICS and VCF import tools are also documented, all on open protocols. We found no public information on documented organisation-wide export by the admin or free/busy coexistence during the move, which I would confirm before committing eleven hundred mailboxes. 3 4 18 19
The IT Service Provider
Migration from on-premises Exchange is documented end to end with a PowerShell script I can run myself — mail, calendars, contacts, tasks, notes and folder structure, with resume tracking, a graceful stop marker and a final delta run after the MX switch — plus imapsync for any IMAP source, Kopano tools and EML/ICS/VCF importers. The code is fully open source on GitHub and Codeberg and a free self-hosted community edition carries the full feature set, which is the exit guarantee; we found no public information on export of a whole organisation by the admin or free/busy coexistence during a move. 4 7 18 19
The Data Protection Officer
Migration in is documented end to end: a PowerShell script automates Exchange-to-grommunio with per-mailbox export, resume tracking and a delta run after the MX switch, and separate tools import PST, EML/ICS/VCF and Kopano mailboxes. The code is fully open source and a genuinely free community edition with the complete feature set is offered, so leaving the vendor costs little more than our own effort; a matching export path in open formats and end-of-contract terms are not documented, which matters less when self-hosting. 3 4 18 19
The Skeptic
The Exchange migration is documented down to the shipped PowerShell script: PST export per mailbox, a two-pass mode for large cut-overs, resume files recording done and failed imports, and a final delta run after the DNS/MX switch; imapsync for any IMAP source, a Kopano/Zarafa tool carrying complete mailboxes with MAPI properties, and generic EML, ICS and VCF importers are listed, and the code base is published as 100% open source with a free community edition carrying the full feature set. We found no public information on whole-organisation export by the admin in standard formats, on whether folder permissions travel with the migration, or on data return and deletion after a contract ends. 2 3 4 18 19
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where mailboxes, calendars, contacts, documents and backups are stored and processed, who at the provider or its subprocessors can access them, and who the subprocessors are (data centres, spam filtering, support, payment, AI features). Independently sourced by the sovereignty pipeline. An EU data region offered by a non-EU parent is part of the chain, not the whole of it. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (spam filtering, support, backups, AI features) run through non-EU providers or a non-EU parent without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated — or a self-hosted edition documented that keeps every mailbox on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Small Firm Owner
The contracting and controlling entity is grommunio GmbH of Vienna with a commercial register number and Austrian tax number, the software is engineered in Austria, and the deployment options are on-premises, private cloud or a certified European partner — the privacy policy states that customers or sales partners host the software and grommunio processes none of the personal data in that case. With the core fully open source and published on GitHub and Codeberg, our mailboxes sit on our own servers and the chain is ours; the only named third-country sub-processor is the US newsletter tool MailChimp, used for the vendor's own website. I found no public information on security certifications or a published data processing agreement for a vendor-run scenario. 4 8 9
The IT Administrator
The contracting entity is grommunio GmbH of Vienna with register number, commercial court and UID published, the software is engineered in Europe, and the self-hosted model that would keep every one of my mailboxes on my own servers is documented with the vendor stating it processes no end-user data in that case; the privacy policy names the GDPR, the Austrian Data Protection Act and the Telecommunications Act. We found no public information on security certifications published with their scope or on a data processing agreement for partner-hosted deployments. 3 4 8 9
The Public Sector IT Lead
The contracting entity is grommunio GmbH of Vienna, registered at the Vienna commercial court with an Austrian VAT number, operating under the GDPR, the Austrian Data Protection Act and the Telecommunications Act, with the Austrian Data Protection Authority named as supervisor — a chain that answers to European law only, with no parent company in the captured pages. Crucially, the privacy policy states that customers or sales partners host the software themselves and that grommunio processes none of the personal data in that case, with deployment on-premises, in a private cloud or with a certified European partner — the mailboxes sit on our own servers. No certification and no published data processing agreement appear in the captured pages, and the one non-EU subprocessor named, a US newsletter tool, serves the website mailing list rather than the mail service. 3 4 8 9
The IT Service Provider
The contracting entity is grommunio GmbH, registered in Vienna with a commercial register number, and the GDPR, the Austrian Data Protection Act and the Telecommunications Act are named as the legal framework, with the Austrian Data Protection Authority as supervisory authority. Crucially the software runs on the customer's or the sales partner's servers and grommunio states it processes no end-user data in that case — the chain is the customer's own, which satisfies me as the operator — though we found no public information on a subprocessor list, a published data processing agreement or certifications. 4 8 9
The Data Protection Officer
The contracting entity is proven — grommunio GmbH in Vienna with register number and UID published — and the privacy policy states that customers or sales partners host the software and grommunio processes no end-user data, so on our own servers the data chain is ours. But the commercially advertised route runs through hosting partners, and I found no public information on where those partners keep mailboxes, who their subprocessors are, or a published data processing agreement; no certifications are stated, and the vendor's own website names a US newsletter tool. 3 4 8 9
The Skeptic
The legal notice puts grommunio GmbH in Vienna with a commercial register number and Austrian tax ID, and the privacy policy states plainly that customers or sales partners host the software, in which case grommunio processes no personal data at all — when you self-host, the chain is genuinely your own. But the priced plans route you to a 'certified European partner' without documenting where those mailboxes would sit, we found no public information confirming a published data-processing agreement or any certification such as ISO 27001 or BSI C5, and the only subprocessor the privacy policy names by location is the US-based newsletter tool MailChimp. 3 4 7 8 9
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or mailbox per tier, storage per user, what shared mailboxes, aliases and extra domains cost, which features (archiving, office apps, SSO, advanced security, more storage) cost extra, the first-year discount and the regular price after it, minimum users and term, monthly versus annual billing, and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price per user exists, but how cost scales with storage, users, add-ons or after the first year is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (archiving, extra storage, shared mailboxes, SSO, the price after the introductory period) is unpriced or "on request".
8 — Every tier priced publicly per user with storage, add-ons priced, the regular price after any introductory discount stated, minimum users and term stated, monthly and annual billing compared, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of users, storage and add-ons, with every support, migration and archive fee and the cancellation and data-return terms published.
The Small Firm Owner
Tiers are public and refreshingly honest: Basic €1.99 / user / month from 6 users, Plus €3.99, Business €5.49 from 50 users, Community free up to 5 users and Enterprise custom from 1,000, with the vendor stating that all software features are included in every plan and plans differ only by user count and support level — no introductory discount, so the price in the second year is the same number. The Exchange comparison page states cloud prices are public list prices (Austria, ex VAT) and shows €4.74 per mailbox / month, while calling its own figures illustrative estimates and not a quote. I found no public information on storage per user, prices for the Archive and mobile device management modules, contract term, or monthly versus annual billing. 3 7
The IT Administrator
Basic, Plus and Business are published at €1.99, €3.99 and €5.49 per user per month from 6, 6 and 50 users, a free Community edition covers up to 5 users, all software features are stated to be in every plan so archive and mobile device management carry no separate price, and prices are shown ex VAT. Storage per user, contract term, a monthly-versus-annual comparison and the Enterprise price from 1,000 users are areas where we found no public information, and the vendor's own comparison page notes on-premises licensing is typically not publicly listed. 3 7
The Public Sector IT Lead
The tiers are public with their minimum users: Community free up to 5 users, Basic at €1.99 / user / month from 6 users, Plus at €3.99 / user / month, Business at €5.49 / user / month from 50 users, and the statement that all software features sit in every plan, with only the support level differing. But for eleven hundred staff the relevant tier is Enterprise, priced Custom from 1,000 users, and we found no public information on contract term, monthly versus annual billing, or VAT treatment on the pricing page itself — sales and support run through a partner whose fee is not published, and the comparison figure of €4.74 per mailbox / month is explicitly labelled an illustrative estimate, not a quote. 3 7
The IT Service Provider
Four tiers are public with exact per-user prices — Basic at €1.99, Plus at €3.99 and Business at €5.49 per user per month, Enterprise on request from 1,000 users, plus a free edition up to 5 users — with minimum user counts stated and all software features included in every plan. But the Archive and Mobile Device Management modules carry no price, billing cycle and VAT treatment are not stated on the pricing page, and sales and support run through partners, so my margin is not fully computable before I quote. 3 7
The Data Protection Officer
Four public tiers with per-user prices and minimum user counts, a free edition up to five users, and the welcome statement that all software features are in every plan and only support differs. Storage per user, the price of the archive and mobile device management modules, billing cycle and term are not stated; the comparison page itself flags that cloud prices are Austrian list prices excluding VAT and on-premises licensing is typically not publicly listed. 3 7
The Skeptic
Four tiers carry public per-user monthly prices with minimum user counts — 'Basic €1.99 / user / month From 6 users', 'Plus €3.99', 'Business €5.49 From 50 users', Enterprise 'custom' from 1,000 users — beside a free community edition up to 5 users, a statement that all software features are included in every plan, and a calculator marked 'Austria, ex VAT'. I hold it back because billing period and contract term are not stated, the top tier is priced only on request, and the vendor's own comparison page calls the figures 'illustrative estimates … not a quote', while the cost a hosting partner would charge is not broken out. 3 7
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about grommunio
Is grommunio European?
Yes. whats-best.ai classifies grommunio as EU-Made.
Where does grommunio store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does grommunio have a free plan?
Yes. grommunio has a free plan, per the vendor’s page captured 5 Nov 2026.
What are the best alternatives to grommunio?
As of 6 Nov 2026, the panel rates Infomaniak kSuite (3.5/5), Nextcloud Hub (Groupware & Office) (3.5/5) and Proton for Business (3.5/5) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Infomaniak kSuite (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: grommunio alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Open source, Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 81 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (19)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage grommunio.com Checked 5 Nov 2026 Details →
- 2 Features page grommunio.com Checked 5 Nov 2026 Details →
- 3 Features page (Exchange alternative) grommunio.com Checked 5 Nov 2026 Details →
- 4 Security / trust page grommunio.com Checked 5 Nov 2026 Details →
- 5 Documentation docs.grommunio.com Checked 5 Nov 2026 Details →
- 6 Documentation (administration) docs.grommunio.com Checked 5 Nov 2026 Details →
- 7 Pricing page grommunio.com Checked 5 Nov 2026 Details →
- 8 Legal notice grommunio.com Checked 5 Nov 2026 Details →
- 9 Privacy policy grommunio.com Checked 5 Nov 2026 Details →
- 10 Mail, domains & deliverability — found from sitemap docs.grommunio.com Checked 5 Nov 2026 Details →
- 11 Mail, domains & deliverability — found from sitemap docs.grommunio.com Checked 5 Nov 2026 Details →
- 12 Calendar, contacts & office apps — found from sitemap docs.grommunio.com Checked 5 Nov 2026 Details →
- 13 Calendar, contacts & office apps — found from sitemap docs.grommunio.com Checked 5 Nov 2026 Details →
- 14 Security, encryption & compliance archiving — found from sitemap docs.grommunio.com Checked 5 Nov 2026 Details →
- 15 Security, encryption & compliance archiving — found from sitemap docs.grommunio.com Checked 5 Nov 2026 Details →
- 16 Administration, identity & partner management — found from sitemap docs.grommunio.com Checked 5 Nov 2026 Details →
- 17 Administration, identity & partner management — found from sitemap docs.grommunio.com Checked 5 Nov 2026 Details →
- 18 Migration, open standards & exit — found from sitemap docs.grommunio.com Checked 5 Nov 2026 Details →
- 19 Migration, open standards & exit — found from sitemap docs.grommunio.com Checked 5 Nov 2026 Details →