mailbox.org Business

The Small Firm Owner

Mail on our own domain is documented down to the last DNS record — MX hosts, TXT validation, four DKIM keys as CNAME records, a single SPF record and DMARC with monitoring guidance — plus a catch-all mailbox and aliases on the firm's domain, with IMAP, POP3 and webmail in every tariff and DANE as well as MTA-STS named on the BSI-recommended protocol list. We found no public information on Exchange ActiveSync or native Outlook (MAPI); the help pages describe Outlook via app passwords and a CalDAV plug-in. We also found no public information on shared or functional mailboxes for our kanzlei@ address, on out-of-office rules or on send and attachment limits. 2 8 10 14 15 18

Report an error

The IT Administrator

Custom domains are covered with a step-by-step DNS set-up — MX records, SPF, four DKIM keys as CNAME, DMARC with report guidance, TXT validation and a catch-all mailbox — and the transport security is exactly what the BSI asks of us: DNSSEC, DANE/TLSA and MTA-STS, with virus and spam filtering at receipt. But for three hundred Outlook users the protocol list stops at webmail, IMAP and POP3; we found no public information on Exchange ActiveSync or native MAPI, so Outlook mail would run over IMAP and the calendar only through a third-party CalDAV plug-in. We also found no public information on shared or functional mailboxes, server-side rules, out-of-office replies, send limits or a quarantine an admin can review. 7 8 10 14 15 17

Report an error

The Public Sector IT Lead

Mailboxes on custom domains with webmail, IMAP and POP3, per-plan storage of 2, 20 and 50 GB, spam and virus filtering, and a thoroughly documented DNS set-up covering MX records, SPF, four DKIM keys and DMARC with reporting guidance; DANE, MTA-STS and DNSSEC are in use, the plans carry the BSI IT security label under TR 03108, and catch-all mailboxes are documented. For an administration of our size, though, we found no public information on Exchange ActiveSync or native Outlook connectivity, out-of-office replies and server-side rules, send or attachment limits, or a quarantine an administrator can review. 2 7 8 10 14 15

Report an error

The IT Service Provider

Custom domains are documented down to the last DNS record — four DKIM CNAME keys, the SPF single-record rule, DMARC with report evaluation, DANE and MTA-STS, plus catch-all, IMAP/POP3/webmail and storage stated per plan — which is DKIM and DMARC I can set up without opening a ticket. We found no public information on Exchange ActiveSync or native Outlook MAPI, send and attachment limits, a quarantine I can review, shared mailboxes, or out-of-office and server-side rules, and that is what my Outlook shops ask about first. 14 15 10 8 7 2

Report an error

The Data Protection Officer

Own domains are documented end to end — MX records, four DKIM keys as CNAME entries, SPF and DMARC guidance — plus catch-all, mailbox sizes stated per plan (2 GB, 20 GB, 50 GB), aliases including 250 on own domains in Premium, IMAP/POP3/webmail, and MTA-STS and DANE stated on the certifications page. We found no public information on Exchange ActiveSync or native Outlook (MAPI) access, a quarantine an administrator can review, out-of-office replies, server-side rules or stated send limits. 2 4 8 10 14 15

Report an error

The Skeptic

Mail runs on Webmail, IMAP and POP3, and the domain set-up is documented to a level I rarely see: four DKIM keys as CNAME records, SPF and DMARC policy guidance, MX targets, TXT validation and a catch-all mailbox, with DANE, DNSSEC and MTA-STS recognised by the BSI secure-mail-transport mark. But Outlook reaches the service only as an IMAP account with app passwords or via the third-party CalDAV Synchronizer — we found no public information on Exchange ActiveSync or native MAPI, on send or attachment limits, or on a quarantine an administrator can review. 2 7 8 10 14 15 17

Report an error

The Small Firm Owner

Shared calendars and address books, tasks, browser editing of documents that support common Office formats, a Drive with password-protected sharing and video meetings are all documented, and CalDAV and CardDAV set-up is written out for DAVx⁵, iOS, Thunderbird and Outlook via CalDAV Synchronizer — so the shared calendar would reach every phone in the office. We found no public information on free/busy lookup across providers, room and resource booking for our meeting room, a company-wide address book, or native desktop applications. 3 4 10 16 17

Report an error

The IT Administrator

The suite is genuine: browser editing of documents, spreadsheets and presentations in common Office formats, live co-editing, drive storage with guest sharing and mobile apps, video meetings and tasks in the paid plans, and CalDAV/CardDAV documented down to concrete URLs with DAVx5, Thunderbird and Outlook via CalDAV Synchronizer. What an Exchange shop like ours misses is the groupware layer on top: we found no public information on free/busy lookup, room and resource booking with approval, delegated calendar access or a company-wide directory, and no native desktop applications are documented. 3 4 10 16 17

Report an error

The Public Sector IT Lead

The bundle includes shared calendars and address books, tasks, browser editing of documents and spreadsheets with real-time co-editing, drive storage with guest sharing and expiry-dated links, video meetings in every plan, and CalDAV and CardDAV synchronisation documented down to URLs and clients including DAVx⁵, Thunderbird and Outlook via CalDAV Synchronizer. For a Microsoft 365 replacement we found no public information on free/busy lookup across providers, room and resource booking, delegated calendar access, or lossless editing of Microsoft file formats — and the web client itself cannot subscribe to external calendars. 3 4 10 17 22

Report an error

The IT Service Provider

Calendar, address book and tasks, browser editing of documents, spreadsheets and presentations in common Office formats, drive with real-time co-editing and password-protected shares, and video meetings all sit in one bundle, with CalDAV and CardDAV documented including Outlook via CalDAV Synchronizer and DAVx5 on Android. We found no public information on free/busy lookup, room and resource booking, delegated calendar access or a company-wide address book. 10 3 4 17

Report an error

The Data Protection Officer

Shared calendars and address books, CalDAV and CardDAV with documented URLs and a client list, tasks, in-browser editing of common office formats, a Drive with password-protected expiring shares and real-time guest co-editing, and video meetings in every plan cover what a practice team uses daily. We found no public information on free/busy lookup, meeting invitations across providers, room and resource booking, delegated calendar access or a company-wide directory. 3 4 10 16 17

Report an error

The Skeptic

Shared calendars and address books, tasks, browser office editing with live co-editing, a Drive with iOS and Android apps, and video meetings sit in one bundle, and CalDAV/CardDAV set-up is documented client by client. What a company would actually schedule with is thinner: we found no public information on free/busy lookup, room or resource booking, or delegated calendar access; the webclient cannot subscribe to external calendars; and Outlook synchronises only through the third-party CalDAV Synchronizer. 3 4 10 16 17 22

Report an error

The Small Firm Owner

PGP and S/MIME sit in the webmailer with Mailvelope support and an own key server, two-factor is available in every tariff (though optional), mail is scanned multiple times for malware, a seven-day self-service backup snapshot is stated, and a transparency report is published that even names the share of authority requests rejected, alongside ISO 27001 and BSI C5. But for a tax office the archiving question decides the purchase, and we found no public information on GoBD-compliant archiving, retention policies or legal hold for mail, nor on enforced two-factor for all users. 7 8 9 10 13 18

Report an error

The IT Administrator

Encryption is unusually strong: TLS with perfect forward secrecy, PGP and S/MIME end-to-end inside the webmailer in every plan, optional re-encryption of stored mail with the customer's own key with no provider-held recovery key, plus a published transparency report naming the share of authority requests rejected and ISO 27001 and BSI C5 stated alongside the BSI IT security label for secure mail transport. Two-factor sign-in is optional rather than enforced, and we found no public information on GoBD-compliant archiving, retention policies, legal hold or eDiscovery — for a German machine builder that gap matters, as does a backup snapshot held for only seven days on a non-contractual basis. 2 7 8 9 10 13 18

Report an error

The Public Sector IT Lead

PGP and S/MIME end-to-end encryption in the webmailer, optional encryption of stored mail and files with the customer's own key and no provider-held recovery key, two-factor sign-in in all plans, seven-day backups, and published ISO 27001 and BSI C5 alongside a transparency report on authority requests complete with rejection rates. Two-factor is optional rather than enforceable for all users, and we found no public information on GoBD-compliant archiving, retention policies or legal hold — for a district administration with statutory retention duties that gap would have to be closed by a separate archive. 7 8 9 10 13 18

Report an error

The IT Service Provider

PGP and S/MIME end-to-end in the webmailer, optional re-encryption of stored mail with the customer's own key with no provider-held second key, two-factor everywhere, a transparency report with real rejection figures for 2023 to 2025, and ISO 27001 plus BSI C5 stated. We found no public information on GoBD-compliant archiving, retention policies and legal hold, eDiscovery or admin-enforced two-factor, and the certification scope and auditor are not published — the archive gap alone rules it out for my hotel group. 10 7 2 13 9 8

Report an error

The Data Protection Officer

PGP and S/MIME in the webmailer with no provider-held recovery key, optional after-the-fact encryption of stored mail with the customer's own key, multi-stage malware scanning, a seven-day backup snapshot, a TÜV-certified data protection officer and a transparency report naming rejection rates for authority requests over three years give me a chain I can largely defend. But two-factor sign-in is stated as optional rather than enforced, and we found no public information on GoBD-compliant archiving, retention policies or legal hold — for patient correspondence and tax retention that gap must be closed before signature. 2 7 8 9 10 13

Report an error

The Skeptic

PGP and S/MIME in the webmailer with an explicit refusal of any provider-side key recovery, multiple virus scans, and a transparency report with published rejection rates for three years are more than most providers show, and ISO 27001 and BSI C5 are stated as held. For a regulated buyer the archive question stays open: we found no public information on GoBD-compliant archiving, retention policies, legal hold or eDiscovery, two-factor sign-in is optional rather than enforced, and the seven-day backup snapshot is expressly not a contractual entitlement. 2 7 8 9 13 18

Report an error

The Small Firm Owner

A web console manages contract, domains, mailboxes, forwards, passwords and storage, business customers create staff accounts in bulk by CSV, and a documented API is offered for larger environments; support response windows are stated (usually 48 hours Standard, 24 hours Premium) with a 24/7 emergency hotline in the top package. The reseller platform is genuinely partner-grade — create and delete customer accounts, set tariff and mailing-list limits, export invoices as PDF or CSV, keep billing and support in your own name. We found no public information on Active Directory or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, admin roles or exportable audit logs, and single sign-on is offered only as an individual integration without protocol details. 5 6 10 20

Report an error

The IT Administrator

The admin console manages contract, domains, mailboxes, forwards, passwords and storage centrally, business accounts can be created in bulk by CSV, there is a documented API aimed at larger environments and resellers, and the reseller tier is real: creating and deleting customer accounts, tariff limits, white-label billing, invoice export in PDF and CSV, and support packages with stated response times and 24/7 in the top package. The identity story stops short of what we run, though — we found no public information on Active Directory, Entra ID or LDAP sync, SCIM provisioning, admin role models, mobile device policies with remote wipe, or exportable audit logs, and single sign-on is offered only as individual integrations without a named protocol. 5 6 10 13 20

Report an error

The Public Sector IT Lead

A central web console manages contract, domains, mailboxes, forwards, passwords and storage, accounts can be created by CSV or through an API, catch-all addresses are configured in the console, and there is a genuinely mature reseller programme with white-label billing, PDF and CSV invoice export and tiered support packages; support response times are stated per plan next to a 99.9% availability commitment. We found no public information on Active Directory, Entra ID or LDAP synchronisation, SCIM provisioning, admin roles, mobile device policies with remote wipe, or exportable audit logs — with eleven hundred accounts I would be provisioning and auditing by hand. 5 6 10 13 20

Report an error

The IT Service Provider

There is a genuine partner story: a reseller web console where I create, modify and delete customer accounts, cap mailboxes and mailing lists per tariff, search my customer base, export invoices in PDF and CSV, keep billing with myself, and hand support to paid Silber, Gold or Platin tiers — backed by a business admin console with API, CSV account creation and SSO. We found no public information on directory sync, SCIM provisioning, mobile device policies with remote wipe, audit logs or granular admin roles, and typical response times of 24 to 48 hours reach around-the-clock only in the platinum package. 20 5 6 10 1

Report an error

The Data Protection Officer

A central console manages contract, domains, mailboxes, forwards, passwords and storage plus security settings (virus, spam, password protection, IP whitelisting, blacklists, backups), employee accounts can be created from CSV, an API is published, and reseller accounts administer several customer organisations with white-label billing and PDF/CSV invoice export, with support response times stated per plan (48 and 24 hours, Mo–Fr). Single sign-on is offered; we found no public information on the protocol used. We also found no public information on Active Directory or LDAP sync, SCIM provisioning, admin roles, mobile device policies with remote wipe, or exportable audit logs. 5 6 7 10 20

Report an error

The Skeptic

The admin console covers mailboxes, domains, forwards, passwords and storage, with an API, CSV account creation, central spam, virus and IP-list controls, and a reseller tier that manages several customer organisations with white-label billing and invoice export; support response times are stated per plan. Identity is the weak flank: single sign-on is offered but no SAML or OpenID Connect is named, and we found no public information on Active Directory, Entra ID or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, or exportable audit logs. 1 5 6 10 20

Report an error

The Small Firm Owner

The Audriga move service transfers mail, calendars, contacts and files from a named list of providers including Gmail, Outlook.com and T-Online, a migration assistant sits in the settings, and there is a second-account drag-and-drop path described as running without interruption, plus iCal and vCard import and calendar export to file; thirty days after the contract ends data is irreversibly deleted and users are told to download beforehand. We found no public information on a whole-organisation export by the administrator or a documented migration from Exchange or Microsoft 365, and the migration service is priced as free only for private customers. 6 13 22 23

Report an error

The IT Administrator

The Audriga partner service imports mail, calendars, contacts and files automatically, a migration assistant sits in the settings menu, iCal and vCard import and calendar export to file are documented with concrete provider walkthroughs, and the terms state irretrievable deletion thirty days after the contract ends with a thirty-day holding period beforehand. What we found no public information on is the move we actually face: Exchange and Microsoft 365 are absent from the supported provider lists, and permissions, free/busy coexistence during the move, an admin-side export of the whole organisation and any self-hosted edition are not documented; mail export is described only as downloading or copying from a client. 5 6 13 22 23

Report an error

The Public Sector IT Lead

A documented migration service through the partner Audriga moves mail, calendars, contacts and files from IMAP and POP3 mailboxes with a named provider list and an in-product migration assistant, manual drag-and-drop is described as an alternative, calendar import and export are documented, the switch is described as occurring without operational interruption, and end-of-contract handling is clear: a 30-day retention after contract end with deletion thereafter, while domains remain at the customer's own registrar. The named source providers include Gmail, Outlook.com and GMX but not Exchange or Microsoft 365, and we found no public information on organisation-wide export by an administrator or a self-hosted edition — our exit from Exchange would rest on a generic IMAP path. 6 13 22 23

Report an error

The IT Service Provider

The Audriga migration assistant in the settings menu pulls mail, calendars, contacts and files from a named list of IMAP and POP3 providers, calendar export and iCal import are documented, and the terms state 30-day deletion after contract end with download the user's responsibility — so I can run a move myself. We found no public information on a documented Exchange or Microsoft 365 path, organisation-wide export by an administrator, or free/busy coexistence during the move. 22 6 5 23 13

Report an error

The Data Protection Officer

A named partner (Audriga) moves mail, calendars, contacts and files automatically from a published provider list including Gmail, Outlook.com and T-Online, available in Standard and Premium, with a migration assistant in the settings plus manual second-account and iCal import/export paths documented; after contract end all account data is irreversibly deleted following a 30-day holding period, statutory retention excepted, and the user is obliged to download beforehand. We found no public information on organisation-wide export by an administrator, export formats such as mbox, EML or PST, or a self-hosted or open-source edition. 6 13 22 23

Report an error

The Skeptic

Getting in is genuinely documented — the Audriga service moves mail, calendars, contacts and files from a published provider list, a migration assistant sits in the suite alongside manual drag-and-drop, and calendar and contact export via iCal and vCard files is described step by step. Getting out is thinner: the terms make the user responsible for downloading their data before the contract ends, with a weekly backup duty, and we found no public information on an administrator exporting the whole organisation, on a named Exchange or Microsoft 365 source, or on an open-source or self-hosted edition. 5 6 13 22 23

Report an error

The Small Firm Owner

The imprint names Heinlein Hosting GmbH of Berlin as operator, while the terms name Heinlein Support GmbH for the prepaid service — both Berlin companies — and the business and security pages state that all servers sit exclusively in Berlin on the provider's own infrastructure under German data protection law, with ISO 27001 and BSI C5 stated and a GDPR data processing agreement listed in the Standard and Premium tariffs. The privacy policy names self-hosted Matomo and Conviva via the video player as third-party elements, but we found no public information on a full subprocessor list with their locations, and data centre operators are not named. 1 7 8 10 11 12

Report an error

The IT Administrator

Heinlein Hosting GmbH of Berlin is the named operator and data controller with a commercial register number, servers stand exclusively in Berlin on the provider's own hardware with green power, German law governs the contract, a GDPR data processing agreement is offered in the paid plans (and one under section 43e BRAO on request), and ISO 27001 and BSI C5 are stated. The chain is not fully evidenced: the captured pages name no data centres and list no subprocessors with their locations, so hosting in Germany and a German entity are proven while the rest of the chain remains open. 1 7 8 10 11 12 13

Report an error

The Public Sector IT Lead

The operator and data controller is Heinlein Hosting GmbH of Berlin, registered at the Amtsgericht Berlin-Charlottenburg under HRB 220010 B and part of a German group, with servers exclusively in Germany on the provider's own hardware in Berlin data centres, German governing law, a GDPR data processing agreement offered in the Standard and Premium plans, a § 43e BRAO agreement on request, and ISO 27001 and BSI C5 stated alongside the Software Hosted in Germany seal. What holds this below the top mark: the captured pages name individual third parties such as video analytics via Conviva and the migration partner Audriga, but we found no public list of subprocessors with their locations, and no self-hosted edition is documented. 7 8 10 11 12 13

Report an error

The IT Service Provider

Heinlein Hosting GmbH of Berlin runs it on its own Berlin servers under German law, with green power, a GDPR data processing agreement in the Standard and Premium tariffs, and a published authority-request report — exactly the chain my Austrian clients want to see. The edges are thin: there is no subprocessor list with locations (Audriga appears only in the migration help), no certification scope published, and the captured pages name Heinlein Support GmbH as provider of the prepaid terms alongside the Berlin operator. 11 7 1 8 10 13 9 22

Report an error

The Data Protection Officer

Operator and controller are Heinlein Hosting GmbH of Berlin under German register and governing law, mail and office run on the provider's own servers in Berlin data centres, and a GDPR data processing agreement is offered in Standard and Premium — one under § 43e BRAO even on request — alongside ISO 27001, BSI C5 and the BSI TR 03108 IT security label. Spam filtering, backups and support are described as in-house, and authority requests are reviewed by the data protection officer with lawyers, a quarter to a third rejected in recent reports. We found no public information on a subprocessor list with locations; the migration partner Audriga is named but not located. 1 7 8 10 11 12 13

Report an error

The Skeptic

Heinlein Hosting GmbH of Berlin appears as operator and controller with register court and number, the servers are stated to stand exclusively in Berlin on the provider's own hardware, and a GDPR data processing agreement comes with Standard and Premium alongside ISO 27001 and BSI C5 — with spam filtering and support evidently in-house rather than farmed out. The captured pages give different names for the contracting entity, however (Heinlein Hosting in the imprint and privacy policy, Heinlein Support in the terms), we found no public information on a subprocessor list with locations, and one certification text describes hosting across Germany, the EU, EFTA and the EEA rather than Berlin alone. 1 7 8 9 10 11 12 13

Report an error

The Small Firm Owner

Three tiers are public at Light 1 €, Standard 4 € and Premium 12 € per month with mail storage of 2, 20 and 50 GB and Drive storage of 0, 10 and 100 GB, extra mail storage quoted at 0,20 € or 0,10 € per GB and extra Drive at 0,40 € or 0,20 € per 5 GB, monthly terms for Standard and Premium, a 30-day trial, and business prices expressly excluding VAT on 14-day invoice terms. We found no introductory discount on the captured pages, so the monthly figures read as the ongoing price — exactly what I need for the second year. We found no public information on minimum user counts, a monthly-versus-annual billing comparison, or the cost of single sign-on and the business migration service. 4 10 13 22

Report an error

The IT Administrator

Prices are public and exact — Light at 1 €, Standard at 4 € and Premium at 12 € per month with mail and drive storage per tier, extra storage priced per gigabyte, alias and disposable-address counts, terms (Light yearly, Standard and Premium monthly), a 30-day trial, one-month cancellation, and VAT treatment stated for consumer prices included by country and business prices exclusive under reverse charge. What we could not compute from the pages: minimum users for a business deployment, the cost of the Silver, Gold and Platinum support packages, catch-all or shared mailbox fees, and what a business migration via the partner costs — we found no public information on those, nor any priced archiving item. 4 6 10 13 20

Report an error

The Public Sector IT Lead

All three tiers are public — Light at 1 € per month, Standard at 4 €, Premium at 12 € — with mail storage of 2, 20 and 50 GB, drive storage of 10 and 100 GB in the paid tiers, priced add-on storage (mail per 1 GB at 0,20 € or 0,10 € depending on tier, drive per 5 GB at 0,40 € or 0,20 €) and per-plan feature tables; the business terms state monthly invoicing in advance, a 14-day payment term and a one-month termination right. However, the consumer price page shows prices including VAT while the business terms state all fees exclusive of VAT — a buyer must reconcile that — and we found no public information on minimum seats, shared or functional mailbox pricing, or the cost of the Silber, Gold and Platin support packages. 4 10 13 20

Report an error

The IT Service Provider

All three tiers are public — Light 1 €, Standard 4 € and Premium 12 € pro Monat — with mail and drive storage per plan, aliases counted, and add-ons priced at 0,20 €/0,10 € je 1 GB mail storage and 0,40 €/0,20 € je 5 GB drive storage, so I can cost a client before quoting; terms are yearly on Light, monthly on Standard and Premium, with a 30-day trial and one-month cancellation. The Silber, Gold and Platin support packages carry no public prices, we found no public information on a monthly-versus-annual comparison or minimum user counts, and the captured pages give different figures for VAT — the pricing page includes it depending on the user's country while the business terms state prices exclude it. 10 4 6 13 20

Report an error

The Data Protection Officer

Light 1 € pro Monat, Standard 4 € pro Monat and Premium 12 € pro Monat are published with mail storage (2/20/50 GB) and drive storage (0/10/100 GB) per tier, extra storage is priced (0,20 €/0,10 € per 1 GB mail, 0,40 €/0,20 € per 5 GB drive), terms per plan are stated (Light yearly, Standard and Premium monthly), and VAT is documented as included on the pricing page and excluded with reverse charge under the business terms. We found no public information on prices for the reseller support packages Silber, Gold and Platin, single sign-on, a business price for the Audriga migration, a minimum user count, or a monthly-versus-annual billing comparison. 4 6 10 13 20

Report an error

The Skeptic

All three plans carry public monthly prices — Light 1 €, Standard 4 €, Premium 12 € — with included mail and drive storage per plan, alias counts, per-gigabyte prices for extra mail and drive storage, the minimum term per plan, VAT rules for consumers and businesses, and a thirty-day trial. The unpriced corners remain: the reseller support packages Silber, Gold and Platin and the user support plans are named without prices, and we found no public information on minimum seats or a monthly-versus-annual comparison. 2 4 5 6 10 13 20

Report an error