# grommunio — Business Email & Office Suites

grommunio by grommunio GmbH holds a panel rating of 3.5/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: EU-Made; sovereignty: not determined.

- Vendor: grommunio GmbH (https://grommunio.com)
- Category: [Business Email & Office Suites](https://whats-best.ai/software/business-email.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/business-email/grommunio
- Alternatives: https://whats-best.ai/software/business-email/grommunio/alternatives ([markdown](https://whats-best.ai/software/business-email/grommunio/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: grommunio GmbH
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Yes, per the vendor’s own page [S7]

## The panel's verdict

grommunio, an open-source Exchange replacement from grommunio GmbH of Vienna, scores between 5 and 8 across the seven criteria. It is strongest on calendar and office at 8: rooms that auto-accept or decline invitations, delegate access, OnlyOffice co-editing of Word, Excel and PowerPoint formats, chat, video meetings and files in one suite. Migration and portability follows at 7-8: a documented PowerShell script with resume tracking and a delta run after the DNS switch, on 100% open-source code with a free community edition up to 5 users. Weakest are security and compliance at 6 and pricing transparency at 5-6: no certification such as ISO 27001 or BSI C5 appears on the captured pages, the vendor states retention and evidential-value questions belong to the operator, and the Enterprise tier from 1,000 users is priced only on request. On sovereignty the judges split 7-8: the higher scores rest on self-hosting, where the privacy policy states grommunio processes no end-user data; the lower ones weigh the partner-hosted route, where we found no public information on mailbox locations, subprocessors or a data processing agreement.

**Speaks for it:**
- Outlook for Windows connects natively over MAPI/HTTP with nothing to install on the client, alongside EWS, Exchange ActiveSync, IMAP/POP3/SMTP and CalDAV/CardDAV.
- Exchange migration is documented end to end through a shipped PowerShell script with a two-pass mode, resume tracking and a final delta run after the DNS switch.
- The code is published as 100% open source, with a free community edition up to 5 users carrying the full feature set.
- S/MIME is available by default and OpenPGP decrypts in the browser with passphrase-protected keys, no key-server upload and no drafts saved while encrypting.
- Basic, Plus and Business are published at €1.99, €3.99 and €5.49 per user per month, with the vendor stating that all software features are included in every plan.

**Held against it:**
- No certification such as ISO 27001, BSI C5 or SOC 2 appears on the captured pages, and the vendor states that retention and evidential-value questions are the operator's to answer.
- We found no public information on SPF, DKIM, DMARC or MTA-STS set-up, catch-all or plus addressing, or stated message and attachment size limits.
- Sending from an alias address is not permitted by default, matching on-premises Exchange, with a Postfix header rewrite or a shared mailbox with Send As as the documented workarounds.
- The Enterprise tier from 1,000 users is priced only on request, contract term and billing cycle are not stated, and the vendor's own comparison page calls its €4.74 per mailbox / month figure an illustrative estimate, not a quote.
- We found no public information on where certified European partner hosting places mailboxes, on partner subprocessors, or on a published data processing agreement.

**Best for:**
- You run Outlook for Windows and Active Directory today and want a replacement that keeps native Outlook over MAPI/HTTP and directory synchronisation, with no connectors or plugins.
- You are planning a cut-over from Exchange and want the migration path documented before you commit — PST export, two-pass mode, resume tracking and a delta run after the DNS switch.
- You self-host on-premises or in a private cloud and want the data chain on your own servers, with the vendor stating it processes no end-user data in that case.
- You serve several organisations from one installation, using multi-tenancy, an OpenAPI 3.0 REST API, a full command line and LDAP or Active Directory synchronisation.

**Avoid if:**
- Your compliance framework requires a certification such as ISO 27001 or BSI C5 on paper — ask the vendor: the public pages we read do not show it
- You need a quotable per-user price and stated contract terms for a deployment of 1,000 users or more — ask the vendor: the public pages we read do not show it
- You buy through a hosting partner and must verify in advance where the mailboxes sit and which subprocessors are involved — we found no public information on either for the certified European partner route.
- Your users need to send from alias addresses out of the box — it is off by default, matching on-premises Exchange, and requires a Postfix header rewrite or a shared mailbox with Send As.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Small Firm Owner | The IT Administrator | The Public Sector IT Lead | The IT Service Provider | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Mail, domains & deliverability | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Calendar, contacts & office apps | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Security, encryption & compliance archiving | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Administration, identity & partner management | 3.5/5 | 4/5 | 3.5/5 | 4/5 | 4/5 | 3.5/5 |
| Migration, open standards & exit | 4/5 | 3.5/5 | 4/5 | 4/5 | 4/5 | 3.5/5 |
| European sovereignty | 4/5 | 4/5 | 4/5 | 4/5 | 3.5/5 | 3.5/5 |
| Pricing transparency | 3/5 | 3/5 | 2.5/5 | 2.5/5 | 3/5 | 3/5 |
| **Weighted verdict** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** |

### The judges

- **The Small Firm Owner** (v1.0): Runs a tax and accounting firm of twelve in Lower Saxony. Every member of staff lives in Outlook, the shared "kanzlei@" mailbox is the busiest address in the office, and the meeting room is booked by shouting across the corridor. Wants mail on the firm's own domain that arrives, a shared calendar and address book on every phone, a move from the old provider that does not lose a single client thread, and a per-user price that is still the price in the second year.
- **The IT Administrator** (v1.0): IT administrator at a machine builder in Baden-Württemberg with three hundred mailboxes, an on-premises Exchange that reaches end of support, and Active Directory as the source of every account. Wants Outlook to keep working without a plug-in nobody maintains, shared mailboxes and room booking, single sign-on and directory sync, mobile devices that can be wiped, an API for provisioning, and a migration that moves calendars and permissions, not only mail.
- **The Public Sector IT Lead** (v1.0): Head of IT at a district administration in Bavaria with eleven hundred staff, told by the council to leave Microsoft within three years. Has read what Schleswig-Holstein did and what it cost. Needs mail, calendars and documents that a whole administration can work in, open formats and open source where possible, BSI C5 or ISO 27001 on paper, a provider whose owners answer to European law only, and an exit plan before the contract is signed.
- **The IT Service Provider** (v1.0): Runs a six-person IT service company in Austria that looks after mail for forty client firms, from a two-person architect's office to a hotel group. Spends Mondays on mails that landed in spam and phones that stopped syncing. Wants one partner console for every client, DKIM and DMARC set up without a ticket, migrations it can run itself, support that answers within the hour, and margins it can calculate before it quotes.
- **The Data Protection Officer** (v1.0): Data protection officer for a group of nine medical practices in North Rhine-Westphalia, where a referral letter sent by mail is patient data under professional secrecy. Reads the subprocessor list and the transparency report before the feature page, asks who at the provider can open a mailbox and under which law, and wants encryption the practices can actually use with outside doctors, archiving that satisfies the tax office, and a data processing agreement that names every server.
- **The Skeptic** (v1.0): Has seen "hosted in Germany" from a provider whose spam filter and support desk sit in the United States, "Exchange-compatible" that meant IMAP with a calendar plug-in, and a first-year price of one euro that became seven. Asks which protocols Outlook really uses, whether the archive would survive a tax audit, what the certification actually covers — and how ten years of mail, calendars and contacts would leave.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Data subject rights: access · rectification · erasure · restriction of processing · data portability · withdrawal of consent · objection [S9]
- GDPR: yes [S1]
- GDPR CCPA eprivacy: yes · yes · yes [S7]
- Responsibility notice: compliance decisions are the operator's responsibility [S14]
- Third country transfers: explicit consent per Art. 49(1)(a) GDPR · Art. 46 GDPR [S9]
- Warranty: no · yes [S17]

**Data**
- Logs retention: a few days [S9]

**Hosting**
- Deployment options: on-premises · private cloud · sovereign hosting [S1]
- Deployment options: on-premises · private cloud · certified European partner [S4]
- Deployment options: on-premises · private cloud · certified European partner [S3]
- Self hosted: customers · sales partners · no [S9]

**Integrations**
- Admin rest API: yes [S5]
- Antispam rspamd: Rspamd [S6]
- App links: External application links configured server-side in /etc/grommunio-admin-common/config.json [S16]
- Cli reference URL: https://docs.grommunio.com/man/grommunio-admin.html [S17]
- Openapi rest: REST API · yes · 3.0 [S17]
- SSO keycloak: Keycloak · yes [S6]

**Legal**
- Address: Vienna · Donau-City-Str. 7 / door 2 / 30th floor DC Tower · Austria · 1220 [S8]
- Company register: HG Wien · 538037g · 1220 Vienna, Austria [S8]
- Controller: grommunio GmbH · Donau-City-Straße 7 / Door 2 / 30th floor, DC Tower, A-1220 Vienna, Austria · 75763639 · FN 538037g [S9]
- Copyright: grommunio GmbH · CC BY-SA 4.0 or later [S5]
- Copyright: grommunio GmbH · CC BY-SA 4.0 or later [S10]
- Copyright: 2026 · CC BY-SA 4.0 or later [S15]
- Copyright entity: 2026 · grommunio GmbH · CC BY-SA 4.0 or later [S12]
- Dispute resolution: no [S8]
- Documentation license: CC BY-SA 4.0 or later · grommunio GmbH [S18]
- Entity: grommunio GmbH [S6]
- Entity: grommunio GmbH · CC BY-SA 4.0 or later [S17]
- Entity name: grommunio GmbH [S8]
- Entity origin: Vienna · grommunio GmbH · Austria [S4]
- Framework: GDPR · Austrian Data Protection Act (DSG) · Austrian Telecommunications Act (TKG) [S9]
- Hosting note: EU · 2026.10.01 [S18]
- License: grommunio GmbH · CC BY-SA 4.0 or later [S6]
- Supervisory authority: Austria · Bezirkshauptmannschaft Wien [S8]
- Supervisory authority: Barichgasse 40-42, 1030 Vienna, Austria · Austrian Data Protection Authority [S9]
- Uid number: ATU75763639 [S8]

**Pricing**
- Basic price: 6 · 1.99 [S7]
- Business comparison price: 17064 · 4.74 · 22236 [S3]
- Business price: 50 · 5.49 [S7]
- Calculator assumptions: ex VAT · public list prices Austria [S3]
- Calculator disclaimer: no [S3]
- Community free: 5 · 0 · no [S7]
- Enterprise custom: custom · 1000 · yes [S7]
- Free trial: yes [S7]
- Plus price: 6 · 3.99 [S7]

**Product**
- Admin API purpose: central API component managing appliances, domains, users [S17]
- Admin API rest: Admin API is a REST API runnable via grommunio-admin run [S16]
- Admin docs: Admin docs cover install, configure, operate, migrate, maintain [S5]
- Admin UI: yes [S2]
- Admin UI port: 8080 · 8443 [S16]
- Admin UI theme: Configurable themes: grommunio, green, purple, magenta, teal, orange, brown, bluegrey; per-browser dark mode [S16]
- Admin web access: yes [S17]
- Alias send not supported: grommunio by default does not allow sending from alias (secondary) addresses, matching on-premises Exchange behavior [S11]
- Aliases receive only: Mailboxes can have multiple proxy/alias addresses; aliases are primarily for receiving mail [S11]
- Antispam malware: yes · yes [S3]
- Antispam rspamd: yes · Rspamd [S16]
- Appliance image: ISO · OVA · container [S3]
- Applications: Core (Email, Calendar, Contacts, Tasks, Notes), Meet, Chat, Files, Office [S7]
- Archive: search · encryption · 2FA · audit logs · yes [S2]
- Archive description: grommunio Archive is the e-mail archiving component of grommunio, based on the open source archiver Piler, storing deduplicated encrypted copies with full-text search and web UI under /archive/ [S14]
- Archiving discovery: yes [S7]
- Auth manager modes: Authentication manager modes: Always MySQL (default), Always LDAP, Automatic [S16]
- Autodiscover: yes [S2]
- Autodiscover: yes [S3]
- Backgrountasks: Background task view for long-running operations (LDAP sync, folder deletion) with manual task processor start [S16]
- Backup restore: yes [S6]
- Built in collaboration: yes · yes · yes [S3]
- Calendar capabilities: Appointments, meetings, meeting room booking, availability views, shared calendars [S12]
- Calendar default reminder: yes · 15 [S12]
- Calendar delegate access: yes [S12]
- Calendar direct booking config: yes · ENABLE_DIRECT_BOOKING [S12]
- Calendar eas: yes [S2]
- Calendar freebusy: yes [S2]
- Calendar invitation responses: Accept · Tentative · Decline · Propose New Time [S12]
- Calendar meetings: yes [S12]
- Calendar permissions granularity: free/busy only · subjects and locations · all details [S12]
- Calendar printing: yes [S12]
- Calendar private appointments: yes [S12]
- Calendar recurring appointments: yes [S12]
- Calendar room booking: yes [S12]
- Calendar scheduling availability: yes [S12]
- Calendar shared: yes [S2]
- Calendar shared calendars: yes [S12]
- Calendar tracking tab: yes [S12]
- Calendar views: Day · Workweek · Week · Month · List [S12]
- Capabilities: Email · Shared Calendars & Scheduling · Contacts & Global Address Lists · Tasks & Notes · Secure Chat & Video Meetings · File Sharing & Online Office [S1]
- Capabilities: yes · yes · yes · yes · yes · yes [S17]
- Certified partners: 200 [S1]
- Chat cross platform: iOS · Android · Windows · Mac · Linux [S2]
- Chat features: yes · yes [S2]
- Cli: grommunio-admin CLI with subcommands: config, connect, dbconf, domain, fetchmail, fs, ldap, mconf, mlist, passwd, run, shell, taginfo, user, version; bash completion and interactive shell [S16]
- Cli domain commands: create · delete · list · modify · purge · query · recover · show [S10]
- Cli domain create role option: yes [S10]
- Cli domain description: grommunio-admin domain is a CLI subcommand to show and manipulate domains [S10]
- Cli domain expiration field: yes [S10]
- Cli domain homeserver option: yes [S10]
- Cli domain maxuser meaning: maxUser sets the maximum number of users in the domain [S10]
- Cli domain maxuser required: yes [S10]
- Cli domain output formats: pretty · csv · json-flat · json-kv · json-object · json-structured · pretty [S10]
- Cli domain purge files option: yes [S10]
- Cli domain query attributes: ID · activeUsers · address · adminName · chat · chatID · displayname · domainStatus · domainname · endDay · homedir · homeserverID · inactiveUsers · maxUser · orgID · tel · title [S10]
- Cli domain soft delete recover: yes · yes [S10]
- Community edition: yes [S3]
- Community forum: yes · email address · user name · entries · comments [S9]
- Cookies: functional · analytics [S9]
- Data sovereignty: yes [S7]
- Db configuration: Database-stored configuration (grommunio-dbconf) for managing service config files with change-triggered actions [S16]
- Decrypt never leaves browser: no [S15]
- Default key settings: yes [S15]
- Delegation: yes · yes [S3]
- Demo available: yes [S1]
- Description: Native Exchange drop-in replacement built in Europe: email, calendar, contacts, chat, video and files on one platform [S1]
- Developer API: Developer docs cover integration via Admin REST API [S5]
- Distributed servers: Multi-server support with user distribution policies: round-robin, balanced, first, last, random [S16]
- Docs audience: manual for system administrators installing and operating grommunio [S6]
- Docs offline download: PDF · EPUB [S18]
- Docs sections: Three documentation sets: User, Administration, Development [S5]
- Domain management: Admin UI supports adding/editing/deleting domains with properties like max users, organization, homeserver, and domain admin role creation [S16]
- Eas mobile: mobile device support via EAS [S6]
- Enterprise compliance modules: Archive and Mobile Device Management (MDM) [S7]
- Exchange2grommunio script: exchange2grommunio.ps1 · yes [S19]
- Exchange replacement: drop-in replacement for Microsoft Exchange [S7]
- Features in all plans: yes [S7]
- Fetchmail: yes [S16]
- Files basis: Nextcloud [S13]
- Files capabilities: file storage, WebDAV access, sharing and a web interface [S13]
- Files optional component: yes · yes [S13]
- Files sharing: yes [S2]
- Files versioning: yes [S2]
- Groups: Group/mailing list management with type (Normal/Domain), send privilege (All/Internal/Domain/Specific) and addressbook hiding [S16]
- Hypervisors: VMware · Hyper-V · Proxmox/KVM · Xen/XCP-ng · Docker · Kubernetes [S3]
- Iac config: Ansible · Puppet · Terraform · Helm · DSC [S3]
- Import list generation: gromox-mbop foreach.mb echo-username [S19]
- Job applications: jobs@grommunio.com [S9]
- Kerberos SSO: Kerberos SSO · yes [S6]
- Ldap sync: LDAP user sync with OpenLDAP and ActiveDirectory templates, StartTLS, custom attribute mapping, import/sync/detach/orphan cleanup [S16]
- License tab: License upload in Admin UI shows product type (Community/Enterprise), issue/expiry dates and user slot counts [S16]
- Linux no windows: yes · no [S3]
- Live status: Realtime Live Status view of web service requests (MAPI/HTTP, EAS, EWS) with vhost selection [S16]
- Load balancer compatible: haproxy · apisix · KEMP · yes [S17]
- Logs mailq: Log viewer (journalctl-based, 5s autorefresh) and mail queue view for postfix/gromox with flush/requeue/delete actions (10s auto-update) [S16]
- Mail eas: yes [S2]
- Mail outlook compat: yes [S2]
- Mail protocols: IMAP · POP3 · SMTP [S2]
- Mailbox creation modes: migrate into existing · create then migrate · two-pass create-all-then-migrate [S19]
- Mailbox permissions: Mailbox-level permissions: Delegates (send on behalf), Send As (impersonation), Full permissions [S16]
- Mailbox quota limits: Per-user send, receive and storage quota limits configurable [S16]

**Subprocessors**
- Newsletter: MailChimp · US · newsletter · Intuit [S9]

**Support**
- Docs download: yes [S5]
- Docs offline download: PDF · EPUB · yes [S6]
- Priority manufacturer: yes · yes [S7]
- Vendors: grommunio GmbH · partners · community [S17]

96 more facts on the canonical page: https://whats-best.ai/software/business-email/grommunio

## Questions

### Is grommunio European?

Yes. whats-best.ai classifies grommunio as EU-Made.

### Where does grommunio store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does grommunio have a free plan?

Yes. grommunio has a free plan, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/18161).

### What are the best alternatives to grommunio?

As of 6 Nov 2026, the panel rates [Infomaniak kSuite (3.5/5)](https://whats-best.ai/software/business-email/infomaniak-ksuite), [Nextcloud Hub (Groupware & Office) (3.5/5)](https://whats-best.ai/software/business-email/nextcloud-hub) and [Proton for Business (3.5/5)](https://whats-best.ai/software/business-email/proton-business) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Infomaniak kSuite](https://whats-best.ai/software/business-email/infomaniak-ksuite) (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [grommunio alternatives](https://whats-best.ai/software/business-email/grommunio/alternatives).

## What this page leaves out

- 81 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage: https://grommunio.com/ (checked 2026-11-05)
- [S2] Features page: https://grommunio.com/features/ (checked 2026-11-05)
- [S3] Features page (Exchange alternative): https://grommunio.com/exchange-alternative/ (checked 2026-11-05)
- [S4] Security / trust page: https://grommunio.com/security/ (checked 2026-11-05)
- [S5] Documentation: https://docs.grommunio.com/ (checked 2026-11-05)
- [S6] Documentation (administration): https://docs.grommunio.com/admin/ (checked 2026-11-05)
- [S7] Pricing page: https://grommunio.com/pricing/ (checked 2026-11-05)
- [S8] Legal notice: https://grommunio.com/legal-notice/ (checked 2026-11-05)
- [S9] Privacy policy: https://grommunio.com/privacy/ (checked 2026-11-05)
- [S10] Mail, domains & deliverability — found from sitemap: https://docs.grommunio.com/cli/grommunio-admin/domain/ (checked 2026-11-05)
- [S11] Mail, domains & deliverability — found from sitemap: https://docs.grommunio.com/de/kb/aliases/ (checked 2026-11-05)
- [S12] Calendar, contacts & office apps — found from sitemap: https://docs.grommunio.com/web/calendar/ (checked 2026-11-05)
- [S13] Calendar, contacts & office apps — found from sitemap: https://docs.grommunio.com/guides/files-office/ (checked 2026-11-05)
- [S14] Security, encryption & compliance archiving — found from sitemap: https://docs.grommunio.com/guides/archive/ (checked 2026-11-05)
- [S15] Security, encryption & compliance archiving — found from sitemap: https://docs.grommunio.com/web/security/ (checked 2026-11-05)
- [S16] Administration, identity & partner management — found from sitemap: https://docs.grommunio.com/admin/administration/ (checked 2026-11-05)
- [S17] Administration, identity & partner management — found from sitemap: https://docs.grommunio.com/dev/projects/admin-api/ (checked 2026-11-05)
- [S18] Migration, open standards & exit — found from sitemap: https://docs.grommunio.com/migration/ (checked 2026-11-05)
- [S19] Migration, open standards & exit — found from sitemap: https://docs.grommunio.com/migration/ms_exchange/ (checked 2026-11-05)

---

Cite as: whats-best.ai, "grommunio — Business Email & Office Suites", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-email/grommunio

Corrections: https://whats-best.ai/correct/1550?target=page