Business Email & Office Suites
IONOS E-Mail & Office
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by IONOS SE · www.ionos.de
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
IONOS E-Mail & Office at a glance
- Vendor
- IONOS SE
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Default not stated; pages mention Germany source, captured 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates IONOS E-Mail & Office 3/5, the mean of 6 judges. The bench reads IONOS E-Mail & Office as a German mail-and-office package, strong on hosting, archiving and stated prices, thin on administration and exit. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
The bench reads IONOS E-Mail & Office as a German mail-and-office package, strong on hosting, archiving and stated prices, thin on administration and exit. Sovereignty is its strongest criterion, scoring 6 to 8, the table's top score: IONOS SE, registered under HRB 24498 in Montabaur, hosts in georedundant, ISO 27001-certified German data centres, keeps Nextcloud Workspace data exclusively in Germany, publishes a data processing agreement and states BSI C5. Security and compliance holds a flat 6 on the archiving add-on. Calendar and office and pricing transparency score 6 to 7, built on shared calendars, free Outlook 2024 licences, Euro-Office co-editing and permanent VAT-inclusive prices — Mail Basic 1+ at 5 € per month, Mail Business at 6 €. The weakest bands are administration and identity and migration and portability, both 3 to 4: the pages document a vendor-run Control Center and 24/7 support, while the judges found no public information on single sign-on, directory synchronisation or standard-format export. The scores split on mail and deliverability, 4 to 6, with no public information found on DKIM, DMARC or distribution lists.
Speaks for it
- GoBD-compliant, revision-safe archiving of all inbound and outbound mail including attachments, with logged access and per-mailbox rights activated in the Control Center.
- Mail in the provider's own georedundant, ISO 27001-certified data centres in Germany, Nextcloud Workspace data exclusively in Germany, and a published data processing agreement.
- Permanent, monthly-cancellable prices with VAT included — Mail Basic 1+ at 5 € per month, Mail Business at 6 € per month — with regular prices shown after introductory discounts.
- Free migration in: a migration tool to European servers, forwarding from the old address, and.de domain transfer-in.
- Hosted Exchange tier with free Outlook 2024 licences, Outlook Web App and 100 GB public folders.
Held against it
- No public information on DKIM, DMARC, aliases or distribution lists, leaving DNS and deliverability work only partly covered on the public pages.
- No public information on single sign-on, customer directory synchronisation, SCIM provisioning, admin roles, mobile device policies with remote wipe or exportable audit logs.
- Only the inbound move is documented, with no public information on export of mail in standard formats, calendar migration or data handling when the contract ends.
- No public price for the GoBD archiving add-on, Hosted Exchange or mailbox expansion, and no monthly-versus-annual billing comparison.
- No subprocessor list with locations for the mail service on the captured pages, while the privacy notice permits transfers outside the EU under safeguards and names hashed marketing transfers to Meta, LinkedIn, TikTok, Reddit and Google Customer Match.
Best for
- You run a German small firm or practice that needs GoBD-compliant, revision-safe mail archiving alongside two-factor sign-in and stated, monthly-cancellable prices.
- You want mail and workspace data hosted in Germany by IONOS SE of Montabaur, registered under HRB 24498 and listed in Frankfurt, with a published data processing agreement and ISO 27001 and BSI C5 stated.
- Your office lives in Outlook and wants a hosted Exchange option with free Outlook 2024 licences alongside shared calendars, contacts and tasks.
- You are moving in from another provider and value a free migration tool, forwarding from the old address and monthly cancellation.
Avoid if
- You administer hundreds of mailboxes with your own directory, single sign-on and provisioning tooling — the documented model is IONOS-managed servers plus a Control Center, and administration and identity scores 3 to 4.
- You need a documented exit before signing — the inbound move is documented, the judges found no public information on export in standard formats or on data handling when the contract ends, and migration and portability scores 3 to 4.
- Your outbound deliverability depends on DKIM and DMARC — the pages document SPF, the judges found no public information on DKIM or DMARC, and the scores spread from 4 to 6.
- You must exclude any transfer of customer data outside the EU — the privacy notice permits transfers outside the EU under safeguards and names hashed marketing transfers to Meta, LinkedIn, TikTok, Reddit and Google Customer Match.
The scores
| Criterion | Panel median |
|---|---|
| Mail, domains & deliverability | 3 of 5 |
| Calendar, contacts & office apps | 3.5 of 5 |
| Security, encryption & compliance archiving | 3 of 5 |
| Administration, identity & partner management | 2 of 5 |
| Migration, open standards & exit | 2 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 3 of 5 |
Mail, domains & deliverability
Show reasoningHide reasoning
How this is scored
How well the mailbox itself works: custom domains and their DNS set-up, aliases, catch-all, shared and functional mailboxes, distribution lists, mailbox and attachment size limits, IMAP, POP3, SMTP and Exchange ActiveSync or MAPI for Outlook, web and mobile apps, spam and malware filtering, SPF, DKIM, DMARC and MTA-STS, out-of-office and server-side rules, send limits, and the delivery reputation of the sending infrastructure. A self-hosted groupware is judged on the mail server it ships; a suite whose mail app is only a client for another server scores at the level of that client.
0 — No mailbox at all; a product that only sends transactional mail or only reads another provider's mail without a server of its own or a documented one to pair it with.
3 — Mailboxes on a custom domain with IMAP and SMTP and a webmail; aliases, shared mailboxes, filtering and DKIM or DMARC are basic or not described.
5 — Several custom domains with a documented DNS set-up, aliases and distribution lists, shared or functional mailboxes, IMAP and SMTP plus mobile apps, spam and malware filtering, SPF and DKIM signing, mailbox size per plan stated, server-side rules and out-of-office replies.
8 — Exchange ActiveSync or native Outlook (MAPI) support, DMARC reporting and MTA-STS or DANE, catch-all and plus addressing, delegated access and send-as, quarantine an admin can review, send and attachment limits stated, and the deliverability of the outbound infrastructure documented.
10 — A mail platform a large organisation runs on: every protocol above with feature parity stated per client, inbound and outbound gateways configurable, journaling, DANE and MTA-STS enforced, delivery monitoring and bounce analysis for admins, and mail flow documented end to end.
The Small Firm Owner
Mail on the firm's own domain with full IMAP and webmail, mailbox and attachment sizes stated (50 GB per user, attachments up to 70 MB), spam and virus filtering with configurable black- and whitelists, SPF documented, and a hosted Exchange tier with free Outlook 2024 licences, the Outlook Web App and MobileSync — that suits an office that lives in Outlook. But we found no public information on DKIM or DMARC, aliases or catch-all, out-of-office replies or server-side rules, so I cannot place it higher; nothing on the captured pages describes how a shared mailbox like ours would be run. 2 3 6 7 13
The IT Administrator
Mailboxes run on our own domain with full IMAP, webmail, spam and virus protection including configurable black- and whitelists, and the Hosted Exchange tier adds native Outlook 2024 with a free licence, the Outlook Web App and 100 GB public folders. Mailbox sizes (12 GB or 50 GB per plan) and the 70 MB attachment limit are stated, and SPF is documented. I found no public information on DKIM or DMARC, aliases and distribution lists, shared or functional mailboxes, delegated access, or the deliverability of the outbound infrastructure. 2 3 6 7
The Public Sector IT Lead
Full IMAP with webmail, a custom domain with Domain Connect for DNS set-up, spam and virus filtering with configurable black and white lists, SPF, stated mailbox and attachment sizes (50 GB, up to 70 MB) and a Hosted Exchange option with Outlook 2024 included cover the working day and the Outlook question. We found no public information on DKIM or DMARC, catch-all and plus addressing, distribution lists, shared mailboxes, out-of-office replies and server-side rules, quarantine review or the delivery reputation of the outbound infrastructure — gaps that matter at eleven hundred mailboxes. 2 3 6 7 13
The IT Service Provider
Mailboxes run on a custom domain with full IMAP, webmail, spam and virus filtering with configurable black- and whitelists, SPF, a seven-day window to restore a deleted mailbox, and clearly stated sizes — 2 GB expandable, 12 GB, 50 GB with 70 MB attachments — plus Hosted Exchange with Outlook synchronisation and public folders as an option. What decides it for me: we found no public information on DKIM, DMARC, aliases, distribution lists, catch-all or send limits, so the DNS and deliverability work my clients' mail depends on is only partly covered on the public pages we read. 2 3 6 7
The Data Protection Officer
Custom-domain mailboxes with full IMAP, webmail, storage stated per plan up to 50 GB and attachments to 70 MB, spam and virus filtering with configurable black- and whitelists, SPF, and a Hosted Exchange option with Outlook synchronisation and public folders. We found no public information on aliases, distribution lists, DKIM or DMARC, out-of-office rules or send limits. 1 2 6 7 13
The Skeptic
Custom domain with Domain Connect for third-party DNS, full IMAP plus webmail, spam and virus filters with configurable black- and whitelists, SPF, mailbox sizes per plan (2 GB, 12 GB, 50 GB) and attachments up to 70 MB — and a genuine Hosted Exchange line with Outlook account setup, public folders and free Outlook 2024 licences, which is more than IMAP with a calendar plug-in. But we found no public information on DKIM, DMARC, MTA-STS, aliases, catch-all or shared mailboxes, and the deliverability of the outbound infrastructure is undocumented, so it stops short of the upper band. 2 3 6 7
Calendar, contacts & office apps
Show reasoningHide reasoning
How this is scored
What the office plans and writes with: shared and team calendars, free/busy lookup, meeting invitations across providers, room and resource booking, shared address books and a company directory, CalDAV and CardDAV or ActiveSync for phones, Outlook calendar sync, tasks, online office documents with co-editing, file storage that comes with the suite, video meetings and chat inside the bundle, and the desktop and mobile apps.
0 — Mail only, with no calendar or contacts of any kind.
3 — A personal calendar and address book in the webmail; sharing, resources, sync protocols and office apps are basic or not described.
5 — Shared calendars and address books, meeting invitations with free/busy lookup, CalDAV and CardDAV or ActiveSync sync to phones and desktop clients, a company-wide address book, tasks, and either online office documents or a documented integration with an office suite.
8 — Room and resource booking with approval, delegated calendar access, Outlook calendar and contacts sync documented, co-editing of documents and spreadsheets in the browser, file storage with sharing, video meetings in the bundle, and apps for desktop, iOS and Android.
10 — A full office suite that replaces Microsoft 365 for a whole organisation: every function above with Microsoft file formats edited without loss, scheduling across organisations, resource planning, offline editing, an accessible interface stated against a standard, and feature parity across web, desktop and mobile documented.
The Small Firm Owner
Shared calendars, contacts and tasks with MobileSync to every device, Outlook calendar and contact sync through Exchange, browser co-editing of documents and spreadsheets with Euro-Office, HiDrive storage with share links, and video meetings with chat in the bundle — a genuine office package. We found no public information on room or resource booking with approval or on delegated calendar access, though, which is exactly what I would need to stop booking the meeting room by shouting across the corridor. 3 4 7 14 15
The IT Administrator
Shared calendars, contacts and tasks with MobileSync and simple calendar sharing for teams are documented, and Outlook synchronises mail, calendar and contacts through the Exchange account on desktop, smartphone and tablet. The Nextcloud workspace adds Euro-Office co-editing of documents, spreadsheets and presentations in the browser, HiDrive file storage with share links, and browser-based video meetings with chat and screen sharing. I found no public information on room and resource booking with approval, delegated calendar access or free/busy lookup, which a three-hundred-person move would rely on. 3 4 7 14 15
The Public Sector IT Lead
Euro-Office co-editing of documents, spreadsheets and presentations in the browser, chat and video meetings in the bundle, HiDrive storage with share links, MobileSync and shared contacts, appointments and tasks, plus documented Outlook sync of mail, calendar and contacts through Hosted Exchange give us most of the working set. We found no public information on room and resource booking with approval, free/busy lookup, CalDAV or CardDAV, delegated calendar access, editing Microsoft file formats without loss or accessibility against a standard, so wholesale replacement of Microsoft 365 is not yet demonstrated. 3 4 7 14 15
The IT Service Provider
Mail Business ships shared contacts, calendars and tasks with MobileSync, Hosted Exchange adds calendar sharing and notifications across devices with Outlook 2024 included, and the Nextcloud Workspace bundle brings Euro-Office co-editing in the browser, HiDrive storage with share links, and browser-based video meetings with chat and screen sharing. We found no public information on room and resource booking, delegated calendar access, cross-provider free/busy or CalDAV and CardDAV, which keeps it a strong small-team set rather than a documented full office replacement. 3 4 7 14 15
The Data Protection Officer
Shared calendars and contacts for teams, tasks with notifications across devices, MobileSync, Exchange-to-Outlook sync of mail, calendar and contacts, browser co-editing of documents and spreadsheets with Euro-Office, HiDrive sharing and video meetings with chat and screen sharing are all documented. We found no public information on free/busy lookup, room and resource booking with approval, or delegated calendar access. 3 4 7 14 15
The Skeptic
Mail Business provides shared contacts, appointments and tasks with MobileSync, Exchange synchronises mail, calendar and contacts into Outlook, and the Nextcloud workspace adds browser co-editing of documents, spreadsheets and presentations in Euro-Office, HiDrive sharing and video meetings started straight from the calendar. We found no public information on free/busy lookup across providers, room and resource booking, delegated calendar access or feature parity of the office apps across desktop and mobile. 3 4 7 14 15
Security, encryption & compliance archiving
Show reasoningHide reasoning
How this is scored
How mail and documents are protected and kept: TLS enforced in transit, encryption at rest, end-to-end encryption or S/MIME and PGP, who at the provider can read a mailbox, two-factor authentication and passkeys, phishing, malware and account-takeover protection, audit-proof archiving that meets GoBD, retention policies and legal hold, eDiscovery, backups and restore of deleted mail, a transparency report on authority requests, and certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No security information of any kind; no encryption, two-factor sign-in or archiving stated.
3 — Encrypted connections and a password login; encryption at rest, two-factor sign-in, archiving and certifications are basic or not described.
5 — TLS in transit and encryption at rest stated, two-factor authentication, spam, phishing and malware protection, restore of deleted mail for a stated period, archiving offered (built in or as an add-on), and a certification such as ISO 27001 stated for the data centres or the service.
8 — End-to-end encryption, S/MIME or PGP supported, GoBD-compliant archiving documented, retention policies and legal hold, enforced two-factor or passkeys for all users, a transparency report on authority requests, and certifications such as ISO 27001 or BSI C5 published with their scope and auditor.
10 — Security that holds up in an audit of a regulated organisation: zero-access or customer-held keys where the provider cannot read mail, eDiscovery, tamper-proof archive with documented verification, every certification published with its report or attestation available, independent security audits or open-source code reviewed, and incident disclosure documented.
The Small Firm Owner
GoBD-compliant, revision-safe and tamper-proof archiving of all inbound and outbound mail including attachments, with logged access and activation in the Control Center, plus two-factor sign-in, virus and spam protection, a seven-day recovery window for deleted mailboxes, and ISO 27001 and BSI C5 named — the audit-proof archiving a tax firm needs is documented. The certifications' scope and auditor are not published on the captured pages, the end-to-end encryption quote covers video chats rather than mailboxes, and we found no public information on S/MIME or PGP, retention policies with legal hold, or a transparency report on authority requests. 3 4 5 7 14 15
The IT Administrator
GoBD-compliant archiving is well documented — all inbound and outbound mail including attachments archived revision-safely and tamper-proof, accesses logged, per-mailbox selection with individually controllable access rights, plus restoration of deleted mailboxes within 7 days. ISO 27001 and BSI C5 are stated for data centres and platforms, two-factor authentication is offered, and premium virus and spam protection comes with the business plans. I found no public information on S/MIME or PGP, end-to-end encryption of mail, retention policies with legal hold, a transparency report on authority requests, or the auditors and exact scope behind the certificates. 3 4 5 7 14
The Public Sector IT Lead
GoBD-compliant archiving with immutable storage, logged access, per-mailbox rights and activation in the Control Center is exactly what a German administration must show an auditor, and it sits alongside ISO 27001 and BSI C5 attestation, two-factor sign-in, virus and spam protection and a 7-day mailbox recovery service. The captured pages do not show the certificates' scope or auditor, S/MIME or PGP for mail, encryption at rest, retention policies with legal hold, enforced two-factor for all users, or a transparency report on authority requests. 3 4 5 7 14
The IT Service Provider
Two-factor sign-in, spam and virus protection, a seven-day restore window for deleted mailboxes, and a GoBD-conform, revision-proof archiving add-on with logged access and per-mailbox control, hosted in georedundant German data centres certified ISO 27001 and tested to BSI C5 — that covers what my clients' accountants actually ask about. We found no public information on encryption of mail at rest or in transit, S/MIME or PGP, a transparency report on authority requests, or the scope and auditor behind the certifications, so it stops short of what a regulated client would need on paper. 3 4 5 7 14 15
The Data Protection Officer
The GoBD-compliant archiving add-on is documented in detail — all inbound and outbound mail with attachments, unaltered storage, logged access, per-mailbox rights — alongside two-factor sign-in, virus and spam protection, a seven-day mailbox recovery, and ISO 27001 with BSI C5 for the German data centres. For referral letters under professional secrecy, end-to-end encryption is documented only for video chats, and we found no public information on S/MIME or PGP for mail, no transparency report on authority requests, and no statement of who at the provider can open a mailbox. 3 4 5 7 10 14
The Skeptic
The archiving add-on is documented as GoBD-compliant and revision-safe with attachments included and logged access — the kind of archive that should survive a tax audit — alongside two-factor sign-in, virus and spam protection, a 7-day mailbox recovery service, and ISO 27001 plus BSI C5 testiert for data centres and platforms. We found no public information on S/MIME or PGP for mail, encryption at rest, retention policies and legal hold, eDiscovery, or a transparency report on authority requests, which keeps it below the audit-grade band. 3 5 7 14
Administration, identity & partner management
Show reasoningHide reasoning
How this is scored
How an IT team or an IT service provider runs it: an admin console for users, groups, mailboxes and domains, admin roles, single sign-on (SAML or OpenID Connect), sync with Active Directory, Entra ID or LDAP, SCIM provisioning, mobile device policies and remote wipe, audit logs of admin and user actions, usage reports, a documented API for provisioning, multi-tenant or reseller accounts for partners managing several customers, and the support channels and response times per plan.
0 — No administration; one login per mailbox and nothing managed centrally.
3 — A web console to add mailboxes and aliases; roles, single sign-on, directory sync and audit logs are basic or not described.
5 — An admin console for users, groups, mailboxes and domains, admin roles, two-factor sign-in enforceable by the admin, password policies, a documented API or command line for provisioning, an activity or audit log, and business support by phone or ticket stated per plan.
8 — Single sign-on (SAML or OpenID Connect), Active Directory, Entra ID or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, audit logs exportable, delegated administration, partner or reseller accounts that manage several customer organisations, and support response times stated.
10 — Administration that scales across many organisations: every setting reachable by API with parity stated, granular role scopes, policies by group, logs streamed to a SIEM, white-label partner offerings with separate billing, and an SLA with service credits published.
The Small Firm Owner
There is a Control Center for activating archiving and managing mailboxes, IONOS administers the Exchange servers as a fully managed service, and support runs 24/7 by phone, chat and email with a personal advisor after ordering. We found no public information on admin roles, single sign-on, customer directory synchronisation, mobile device policies with remote wipe, a provisioning API, or exportable audit logs — as a firm that hands IT to a service provider, I cannot see how I would govern twelve users from these pages. 2 3 4 5 12
The IT Administrator
A Control Center is documented where archiving is activated per mailbox with free and unlimited mailbox selection, mailboxes can be added after purchase, and support runs 24/7 by phone, chat and email with a personal advisor. The only Active Directory statement on the Exchange page describes the provider's own platform configuration rather than a customer directory synchronisation. I found no public information on single sign-on, SCIM or an API for provisioning, admin roles, password policies, mobile device management with remote wipe, exportable audit logs, or reseller accounts. 2 3 4 5
The Public Sector IT Lead
A Control Center, mailboxes extendable after purchase, fully managed operation with IONOS administering the Exchange servers, and 24/7 support by phone, chat and email are stated. We found no public information on single sign-on via SAML or OpenID Connect, synchronisation of the customer's Active Directory, Entra ID or LDAP, SCIM provisioning, admin roles, password policies, mobile device policies with remote wipe, an admin API, exportable audit logs or partner and reseller accounts — the things my team would need to run eleven hundred accounts without becoming a manual helpdesk. 2 3 4 5
The IT Service Provider
There is a Control Center where archiving is activated, mailboxes and tariffs scale after purchase, IONOS runs the servers fully managed, and expert support answers around the clock by phone, chat and email with a personal advisor — decent, but that is vendor support, not my tooling. We found no public information on an admin console for users, groups and domains, admin roles, single sign-on, directory synchronisation for customers, SCIM provisioning, mobile device policies with remote wipe, exportable audit logs or a partner console to manage several customer organisations, so running forty clients from one place is not something the pages document. 3 4 5 12 14
The Data Protection Officer
A Control Center is documented for activating archiving and setting per-mailbox access rights, tariffs and mailboxes scale after purchase, and 24/7 support by phone, chat and email with a personal advisor is stated. We found no public information on admin roles, single sign-on, customer directory synchronisation, a provisioning API or reseller accounts, so an IT service provider managing several practices works from little documented tooling. 2 3 4 5
The Skeptic
There is a Control Center to select and expand mailboxes and switch archiving on per mailbox, 24/7 support by phone, chat and email with a published number, and two-factor authentication — but no described admin roles, password policies, provisioning API or activity log. The Active Directory mention describes how IONOS configures its own Exchange platform under Microsoft Privileged Access, not a sync with the customer's directory; we found no public information on single sign-on, directory synchronisation, SCIM, device policies or partner accounts. 2 3 5 14
Migration, open standards & exit
Show reasoningHide reasoning
How this is scored
How the organisation gets in and out: migration from Exchange, Microsoft 365, Google Workspace or another IMAP provider with a documented tool or service, mail, calendars and contacts carried over, coexistence during a move, standard protocols (IMAP, CalDAV, CardDAV, JMAP, open document formats) rather than proprietary ones, export of a mailbox and of the whole organisation in standard formats (mbox, EML, PST, ICS, vCard), open-source code or a self-hosted edition, what happens to data when the contract ends, and how domains and DNS are handed back.
0 — No way to bring mail in or take it out; a proprietary store with no IMAP access or export.
3 — IMAP access to mail; a migration path, calendar and contacts export and the end-of-contract handling are basic or not described.
5 — A documented migration from Exchange, Microsoft 365 or Google (a tool, an import or a service), mail, calendars and contacts imported, IMAP, CalDAV and CardDAV or ActiveSync access, export of mail, calendars and contacts in standard formats, and the deletion of data after the contract ends stated.
8 — A migration service or tool that moves whole organisations with calendars and permissions, coexistence with free/busy during the move, open document formats supported natively, export of the whole organisation by the admin, an open-source code base or a self-hosted edition, and a data return period after cancellation stated.
10 — An exit that costs nothing but time: every record exportable in open formats with the method documented, a self-hosted open-source edition with feature parity stated, migration in and out documented with the same tools, and a contractual data return and deletion with confirmation.
The Small Firm Owner
A free email migration tool described as moving mail quickly and safely onto European servers, free help relocating existing addresses, forwarding from the old address, and a simple domain transfer in — the inbound move for mail is covered, which matters when not a single client thread may be lost. We found no public information on migrating calendars and contacts, on export of mail in standard formats, or on what happens to the data when the contract ends; IMAP is the only open protocol documented. 2 6 12 15
The IT Administrator
A free migration tool and free assistance for moving existing email addresses to the European servers are documented, forwarding from the old address is available, domains can be transferred in, and IMAP is fully supported with mail, calendar and contacts synchronised through the Exchange account. The migration offer is described without naming source systems such as Exchange or Microsoft 365. I found no public information on moving calendars, folder permissions or public folders, on export of a whole organisation in standard formats, or on data handling when the contract ends. 2 6 7 12 15
The Public Sector IT Lead
Getting in is documented and free: a migration tool to European servers, help moving existing addresses, forwarding from the old address, full IMAP access and domain transfer-in for a.de domain. We found no public information on export of mail, calendars and contacts in standard formats, whole-organisation export by the admin, migration of calendars and permissions, coexistence during the move, an open-source or self-hosted edition, or the return and deletion of data when the contract ends — and a documented exit is precisely what my council demanded before anything is signed. 2 6 7 12 15
The IT Service Provider
A free migration tool moves existing mail onto IONOS's European servers, messages can be forwarded from the old address during the switch, a.de domain transfers in, access stays open through IMAP and MobileSync, and everything is monthly cancellable. We found no public information on moving calendars and contacts, exporting mail in standard formats such as EML or mbox, or the handling of data when a contract ends, so I can plan the way in but not the way out. 2 6 7 12 15
The Data Protection Officer
The way in is well documented: a free migration tool moves existing mail to European servers, free help with the move is offered, forwarding from the old address and.de domain transfer are described, and IMAP with MobileSync gives standards-based access. We found no public information on export in standard formats, on calendar and contacts migration, or on what happens to the data when the contract ends. 2 6 7 12 15
The Skeptic
A free migration tool moves existing mail onto IONOS's European servers, forwarding from the old address is offered, domains can be transferred in, and IMAP plus MobileSync give standard access. But ten years in, the way out is undocumented: we found no public information on migrating calendars and contacts, export of mail or the whole organisation in standard formats, or what happens to the data when the contract ends. 2 6 7 12 15
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where mailboxes, calendars, contacts, documents and backups are stored and processed, who at the provider or its subprocessors can access them, and who the subprocessors are (data centres, spam filtering, support, payment, AI features). Independently sourced by the sovereignty pipeline. An EU data region offered by a non-EU parent is part of the chain, not the whole of it. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (spam filtering, support, backups, AI features) run through non-EU providers or a non-EU parent without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated — or a self-hosted edition documented that keeps every mailbox on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Small Firm Owner
The contracting entity is IONOS SE in Montabaur, entered in the German commercial register (HRB 24498) and listed in Frankfurt, mail data sits in georedundant ISO-27001-certified data centres in Germany, a data processing agreement is published, and ISO 27001 and BSI C5 are stated. The chain is not evidenced end to end: no subprocessor list with locations for the mail service appears on the captured pages, and the privacy policy acknowledges transfers outside the EU under safeguards and names non-EU marketing partners — enough to keep my clients' data in Germany on paper, short of the top level of proof. 3 6 9 10 14
The IT Administrator
The contracting entity is IONOS SE in Montabaur, registered in the commercial register there and listed in Frankfurt, and mailboxes and Nextcloud workspace data are kept in the provider's own ISO-27001-certified, georedundant data centres in Germany, with a data processing agreement published. ISO 27001 and BSI C5 are stated. The privacy notice names marketing partners (Meta, LinkedIn, TikTok, Reddit, Google Customer Match) receiving hashed customer data and permits transfers outside the EU with safeguards, the resold Google Workspace option stores internationally with no region choice, and I found no public list of the mail chain's own subprocessors with their locations. 3 6 9 10 14 15
The Public Sector IT Lead
IONOS SE of Montabaur, registered in the commercial register there and listed on the Frankfurt stock exchange, hosts in ISO 27001-certified georedundant data centres in Germany, keeps the Nextcloud Workspace exclusively in Germany, publishes a data processing agreement and states ISO 27001 and BSI C5 — a European chain for the mail and workspace products. The privacy notice acknowledges transfers outside the EU under general safeguards and names marketing partners such as Meta, LinkedIn, TikTok, Reddit and Google, the Google Workspace option in the portfolio is hosted internationally with no region selectable, and a subprocessor list with locations for the mail service itself is not shown on the captured pages. 1 3 4 6 9 10 15
The IT Service Provider
IONOS SE is the contracting entity in Montabaur with a Vienna contact address for Austria, mail sits in the company's own georedundant, ISO 27001-certified data centres in Germany, Nextcloud Workspace data stays exclusively in Germany, a data processing agreement is published, and BSI C5 is tested. The privacy policy discloses transfers outside the EU with safeguards and hashed marketing data going to Meta, LinkedIn, TikTok, Reddit and Google, and the resold Google Workspace variant stores internationally with no region selectable, so the core mail chain is solidly European while parts of the wider offering are not. 3 6 9 10 11 14 15
The Data Protection Officer
The core chain is European: IONOS SE registered at Amtsgericht Montabaur, mail data in georedundant ISO 27001 certified German data centres, an Auftragsverarbeitungsvereinbarung available, and BSI C5 alongside ISO 27001 stated. I still miss a subprocessor list with locations for the mail service — the privacy notice discloses only hashed marketing-partner transfers and permits transfers outside the EU with safeguards — and the Google Workspace resale is documented with international storage and no selectable region. 4 6 9 10 15
The Skeptic
IONOS SE is registered at the Montabaur commercial register with a German VAT ID, the mail and workspace products sit in geo-redundant ISO-27001-certified German data centres, a data processing agreement is published, and ISO 27001 and BSI C5 are stated — Nextcloud storage even exclusively in Germany. The privacy policy acknowledges transfers outside the EU under safeguards and names Meta, LinkedIn, TikTok, Reddit and Google as recipients of hashed customer data for marketing; we found no public information on the locations of the mail chain's own subprocessors such as spam filtering, support or backups, and the resold Google Workspace option is stated as international with no selection possible. 3 4 6 9 10 15
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or mailbox per tier, storage per user, what shared mailboxes, aliases and extra domains cost, which features (archiving, office apps, SSO, advanced security, more storage) cost extra, the first-year discount and the regular price after it, minimum users and term, monthly versus annual billing, and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price per user exists, but how cost scales with storage, users, add-ons or after the first year is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (archiving, extra storage, shared mailboxes, SSO, the price after the introductory period) is unpriced or "on request".
8 — Every tier priced publicly per user with storage, add-ons priced, the regular price after any introductory discount stated, minimum users and term stated, monthly and annual billing compared, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of users, storage and add-ons, with every support, migration and archive fee and the cancellation and data-return terms published.
The Small Firm Owner
The mail tiers carry permanent prices — Mail Basic 1+ with 12 GB at "Dauerhaft nur 5 € /Monat" and Mail Business with 50 GB at "Dauerhaft nur 6 € /Monat" — the team tiers state the regular price after the introductory period ("190 €", "40 €"), domains show both the introductory and the regular price, and everything is quoted with VAT included and monthly cancellable, so the second-year cost is visible rather than a surprise. What holds it back: the GoBD archiving add-on and mailbox storage expansion carry no price on the captured pages, and monthly versus annual billing is not compared. 2 4 5 12 14
The IT Administrator
Permanent prices are public — Mail Basic 1+ at 5 € /Monat for 12 GB and Mail Business at 6 € /Monat for 50 GB, both monthly cancellable — and VAT inclusion plus the regular price after introductory discounts are stated, for example 190 € regular against 25 € introductory for 25 users. I found no public price for the archiving add-on beyond the included 5 GB or for Hosted Exchange and Microsoft 365 seats, no comparison of monthly and annual billing, and teams above ten people are directed to a phone call for a custom package. The real annual cost for three hundred mailboxes is therefore not derivable from these pages alone. 1 2 4 5 12 14
The Public Sector IT Lead
Mail Basic at 5 € per month and Mail Business at 6 € per month are stated as permanent prices with monthly cancellation, the workspace tiers publish both the introductory and the regular price (10 € then 40 € for five users, 25 € then 190 € for twenty-five), domains show their regular price after the first year, and prices are stated inclusive of VAT. The GoBD archive, extra storage, shared mailboxes and aliases, a monthly-versus-annual billing comparison and concrete minimum terms are not priced on the captured pages, and offers are limited in time and partly tied to minimum contract periods. 2 4 12 14
The IT Service Provider
The mail tariffs are public with permanent prices and storage — 5 €/Monat for Mail Basic 1+ with 12 GB and 6 €/Monat for Mail Business with 50 GB, both monthly cancellable, VAT included — and the team bundles show the regular price behind each introductory discount (9 € to 5 €, 40 € to 10 €, 190 € to 25 €). We found no public price for the GoBD archiving add-on, Hosted Exchange or the Microsoft 365 and Google suites, minimum terms are described only as sometimes applying, and monthly versus annual billing is not compared, so a complete annual quote for a client still needs a sales conversation. 2 4 5 12 14
The Data Protection Officer
Mail Basic 1+ at a permanent 5 € per month for 12 GB and Mail Business at 6 € for 50 GB with domain included are stated as durable, monthly-cancellable prices including VAT, and the workspace tiers show both introductory and regular prices (25 € then 190 € per month for 25 users). We found no public information on the price of the GoBD archiving add-on, extra storage or shared mailboxes, and no comparison of monthly versus annual billing. 2 4 12 14
The Skeptic
Mail Basic 1+ at 12 GB and Mail Business at 50 GB carry permanent prices of 5 € and 6 € per month, monthly cancellable, VAT included — the one-euro-becomes-seven trap is at least disclosed elsewhere, with the workspace tiers showing both sides (9 € then 5 €, 190 € then 25 €) and domains likewise (0,08 € then 1,30 € or 2 €). We found no prices on the captured pages for the GoBD archiving add-on, the Hosted Exchange tiers or mailbox expansions, and offers are only valid for a limited time and partly tied to minimum terms without those terms being spelled out. 2 4 12 14
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about IONOS E-Mail & Office
Is IONOS E-Mail & Office European?
Yes. whats-best.ai classifies IONOS E-Mail & Office as EU-Made.
Where does IONOS E-Mail & Office store data?
The default storage location for customer data is not stated on the vendor’s pages as of 5 Nov 2026. The vendor’s pages mention Germany as hosting location, per the vendor’s page captured 5 Nov 2026.
Does IONOS E-Mail & Office have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to IONOS E-Mail & Office?
As of 6 Nov 2026, the panel rates grommunio (3.5/5), Infomaniak kSuite (3.5/5) and Nextcloud Hub (Groupware & Office) (3.5/5) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is grommunio (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: IONOS E-Mail & Office alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 46 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 19 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 10 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (15)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (business email, with pricing) www.ionos.de Checked 5 Nov 2026 Details →
- 2 Features page (email hosting) www.ionos.de Checked 5 Nov 2026 Details →
- 3 Features page (Hosted Exchange) www.ionos.de Checked 5 Nov 2026 Details →
- 4 Features page (Nextcloud workspace) www.ionos.de Checked 5 Nov 2026 Details →
- 5 Features page (email archiving) www.ionos.de Checked 5 Nov 2026 Details →
- 6 Features page (migration) www.ionos.de Checked 5 Nov 2026 Details →
- 7 Documentation (help centre) www.ionos.de Checked 5 Nov 2026 Details →
- 8 Security / trust page www.ionos.de Checked 5 Nov 2026 Details →
- 9 Legal notice www.ionos.de Checked 5 Nov 2026 Details →
- 10 Privacy policy www.ionos.de Checked 5 Nov 2026 Details →
- 11 Documentation (data protection and AVV) www.ionos.de Checked 5 Nov 2026 Details →
- 12 Mail, domains & deliverability — found from sitemap www.ionos.de Checked 5 Nov 2026 Details →
- 13 Mail, domains & deliverability — found from sitemap www.ionos.de Checked 5 Nov 2026 Details →
- 14 Calendar, contacts & office apps — found from sitemap www.ionos.de Checked 5 Nov 2026 Details →
- 15 Calendar, contacts & office apps — found from sitemap www.ionos.de Checked 5 Nov 2026 Details →