Business Email & Office Suites
Runbox
UK / wider Europe Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Runbox Solutions AS · runbox.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Runbox at a glance
- Vendor
- Runbox Solutions AS
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Default not stated; pages mention Norway source, captured 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates Runbox 2.5/5, the mean of 6 judges. Runbox is email hosting from Runbox Solutions AS of Oslo, and the bench's scores are sharply two-sided. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Runbox is email hosting from Runbox Solutions AS of Oslo, and the bench's scores are sharply two-sided. Strongest is sovereignty, a uniform 7: the vendor's pages state mail is stored exclusively in Norway on its own Oslo servers, disclosure requires a Norwegian court order, and an authority-request transparency report runs from 2011 to 2026. Mail and deliverability holds at 6 on documented MX and DKIM set-up with keys rotated every three months and stated limits of 100 MB messages and 500 outbound a day; migration and portability runs 5-6 on documented IMAP import and export paths. Weaknesses are shared: administration and identity at 3, with no public information on admin roles, single sign-on or directory sync, and calendar and office at 4, the vendor's own help pages stating calendar sharing is currently not possible. Judges split on security and compliance, 4 to 6 — the audit-facing gaps (no public information on ISO 27001, BSI C5 or GoBD archiving) weighed more with judges serving audited buyers — and pricing transparency spread 5 to 7 over quote-only migration fees and unstated VAT.
Speaks for it
- Sovereignty at a uniform 7 — the bench's top score — for mail the vendor states is stored exclusively in Norway on its own Oslo servers, with disclosure gated by a Norwegian court order.
- An authority-request transparency report published for every year from 2011 to 2026, with received, complied and rejected counts.
- Custom-domain mail documented in depth, with DKIM keys rotated every three months, SPF, DMARC and DNSSEC support, and stated limits of 100 MB messages, 500 outbound and 5,000 inbound a day.
- Prices published exactly, including Max at "€5.28/month|€63.32/year Billed every 3 years" and a team of 10 at "€16.20/month|€194.50/year Billed annually", alongside a plan calculator and a 30-day free trial with no credit card required.
- A documented way in and out: IMAP import that copies all folders from another provider, and a dedicated export page covering mail, contacts, calendars and files.
Held against it
- Administration and identity scored a flat 3; we found no public information on admin roles, single sign-on, directory synchronisation, SCIM provisioning or audit logs.
- The vendor's own help pages state it is currently not possible to share calendars with other people or publish them publicly, and the calendar is labelled Beta.
- We found no public information on ISO 27001, BSI C5 or SOC 2 certification, GoBD-compliant archiving, retention policies or legal hold; the named certifications are Eco-Lighthouse and an Ethical Consumer rating.
- The migration service is quote-only, and we found no public information on VAT treatment or the price of extra sub-accounts and storage.
- Only one of the four named subprocessors (Copyleft Solutions AS, Norway) carries a stated country, and the privacy policy places web hosting and domain-registration data in the US by default.
Best for
- You need mail on your own domain hosted in Norway under Norwegian jurisdiction, with disclosure behind a Norwegian court order — the bench's strongest category at a uniform 7.
- You run a small team or solo practice over standard IMAP, POP and SMTP clients and can accept a personal calendar without sharing.
- You want to price before contact: tiers with storage, alias and domain counts are published, plus a plan calculator and a 30-day free trial with no credit card required.
- You want a documented exit path covering mail, contacts, calendars and files if you ever leave.
Avoid if
- Your day runs on shared calendars or published team schedules — the vendor's own help pages state that sharing and public publishing are currently not possible.
- You must evidence security certifications for audits — the published certifications are Eco-Lighthouse and an Ethical Consumer rating, and judges split 4 to 6 on this category over those audit gaps.
- You plan to resell or run many client mailboxes from one console — the terms require written consent for resale, and administration and identity scored 3 with no spread.
- You need an exact invoice before committing — the migration fee is available only by quote through support.
The scores
| Criterion | Panel median |
|---|---|
| Mail, domains & deliverability | 3 of 5 |
| Calendar, contacts & office apps | 2 of 5 |
| Security, encryption & compliance archiving | 3 of 5 |
| Administration, identity & partner management | 1.5 of 5 |
| Migration, open standards & exit | 3 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 3 of 5 |
Mail, domains & deliverability
Show reasoningHide reasoning
How this is scored
How well the mailbox itself works: custom domains and their DNS set-up, aliases, catch-all, shared and functional mailboxes, distribution lists, mailbox and attachment size limits, IMAP, POP3, SMTP and Exchange ActiveSync or MAPI for Outlook, web and mobile apps, spam and malware filtering, SPF, DKIM, DMARC and MTA-STS, out-of-office and server-side rules, send limits, and the delivery reputation of the sending infrastructure. A self-hosted groupware is judged on the mail server it ships; a suite whose mail app is only a client for another server scores at the level of that client.
0 — No mailbox at all; a product that only sends transactional mail or only reads another provider's mail without a server of its own or a documented one to pair it with.
3 — Mailboxes on a custom domain with IMAP and SMTP and a webmail; aliases, shared mailboxes, filtering and DKIM or DMARC are basic or not described.
5 — Several custom domains with a documented DNS set-up, aliases and distribution lists, shared or functional mailboxes, IMAP and SMTP plus mobile apps, spam and malware filtering, SPF and DKIM signing, mailbox size per plan stated, server-side rules and out-of-office replies.
8 — Exchange ActiveSync or native Outlook (MAPI) support, DMARC reporting and MTA-STS or DANE, catch-all and plus addressing, delegated access and send-as, quarantine an admin can review, send and attachment limits stated, and the deliverability of the outbound infrastructure documented.
10 — A mail platform a large organisation runs on: every protocol above with feature parity stated per client, inbound and outbound gateways configurable, journaling, DANE and MTA-STS enforced, delivery monitoring and bounce analysis for admins, and mail flow documented end to end.
The Small Firm Owner
Mail on my own domain is well documented: the MX move to mx.runbox.com, DKIM signing with automatic DNS for hosted domains and quarterly key rotation, plus SPF, DKIM, DMARC and DNSSEC support and a free DNS compliance checker, with catch-all, plus addressing, aliases on my domain and published message and daily send limits per plan. It sits above the ordinary level, but the captured pages show no Exchange ActiveSync or native Outlook protocol — Outlook calendar sync runs through a third-party CalDAV plugin — and we found no public information on shared or functional mailboxes, distribution lists, out-of-office replies or an admin-reviewable quarantine. 2 4 5 8 13 14 17
The IT Administrator
Mailboxes on our own domains are well documented: MX record set-up, automatic DKIM for domains hosted there, SPF, DKIM, DMARC and DNSSEC support, catch-all and plus addressing, spam and virus filtering, and stated limits of a 100 MB message size and 500 outgoing messages a day. What holds it down for me is that the captured pages show client access only over IMAP, POP and SMTP with app passwords — I found no public information on Exchange ActiveSync or native Outlook (MAPI), on DMARC reporting, MTA-STS, an admin quarantine, out-of-office replies or shared mailboxes. 2 4 8 13 14 17
The Public Sector IT Lead
Custom-domain mail is documented in real depth: MX set-up, DKIM signing with quarterly key rotation and automatic DNS entries, SPF, DMARC and DNSSEC support, catch-all and plus addressing, and stated limits of 100 MB message size and 500 outbound messages per day with mailbox size per plan. For an administration of our size it falls short of the top levels: I found no public information on Exchange ActiveSync or native Outlook connection, shared or functional mailboxes, distribution lists, out-of-office replies or outbound deliverability monitoring. 8 13 14 4
The IT Service Provider
Custom domains with documented MX cut-over and DKIM set-up — automatic DNS entries when Runbox hosts the domain, manual CNAME lines otherwise, with quarterly key rotation — plus catch-all, plus addressing and clearly stated send and message-size limits are exactly what I want to configure without a ticket. The pages stop short of the enterprise level: we found no public information on Exchange ActiveSync or native Outlook MAPI, DMARC reporting, MTA-STS or DANE, an admin-reviewable quarantine, out-of-office replies or distribution lists. Good mid-range mail for a two-person office; not what I would move a hotel group onto. 2 4 5 8 13 14 17
The Data Protection Officer
Custom domains with a documented MX and DKIM set-up — DKIM keys rotated every three months, SPF, DMARC and DNSSEC supported — plus catch-all, plus addressing, unlimited aliases on your own domain, and stated limits of 100 MB message size, 5,000 incoming and 500 outgoing messages a day. Storage per plan is published, so I can size the practices' mailboxes before signing. We found no public information on Exchange ActiveSync or native Outlook support, out-of-office replies, or a quarantine an administrator can review. 2 4 5 8 13 14
The Skeptic
Custom domains with documented MX and DKIM set-up — keys rotated every three months, automatic CNAME placement on its own name servers, zone-file lines to copy for external DNS — plus catch-all, plus addressing, SPF/DKIM/DMARC/DNSSEC support, and published hard limits of 100 MB messages, 500 outbound and 5,000 inbound a day. But the documented client protocols are IMAP, POP and SMTP with app passwords for Outlook, and a CalDAV plug-in for its calendar; we found no public information on Exchange ActiveSync or native MAPI, MTA-STS or DANE, an admin-reviewable quarantine, or out-of-office replies. A credible independent operator's mailbox, not an Exchange-class platform. 8 13 14 4 17 5
Calendar, contacts & office apps
Show reasoningHide reasoning
How this is scored
What the office plans and writes with: shared and team calendars, free/busy lookup, meeting invitations across providers, room and resource booking, shared address books and a company directory, CalDAV and CardDAV or ActiveSync for phones, Outlook calendar sync, tasks, online office documents with co-editing, file storage that comes with the suite, video meetings and chat inside the bundle, and the desktop and mobile apps.
0 — Mail only, with no calendar or contacts of any kind.
3 — A personal calendar and address book in the webmail; sharing, resources, sync protocols and office apps are basic or not described.
5 — Shared calendars and address books, meeting invitations with free/busy lookup, CalDAV and CardDAV or ActiveSync sync to phones and desktop clients, a company-wide address book, tasks, and either online office documents or a documented integration with an office suite.
8 — Room and resource booking with approval, delegated calendar access, Outlook calendar and contacts sync documented, co-editing of documents and spreadsheets in the browser, file storage with sharing, video meetings in the bundle, and apps for desktop, iOS and Android.
10 — A full office suite that replaces Microsoft 365 for a whole organisation: every function above with Microsoft file formats edited without loss, scheduling across organisations, resource planning, offline editing, an accessible interface stated against a standard, and feature parity across web, desktop and mobile documented.
The Small Firm Owner
There is a personal calendar, marked beta, with month, week and day views, ICS import and export, and CalDAV sync to phones via DAVx⁵ and to Outlook via a plugin, and contacts sync over CardDAV — but the help pages themselves state it is currently not possible to share calendars with other people or publish them. For a firm like mine that lives on one shared calendar, that stated limitation decides it; we also found no public information on free/busy lookup, room and resource booking, tasks, online office documents, video meetings or chat. 3 15 16
The IT Administrator
The calendar is labelled Beta, syncs via CalDAV with ICS import and export, and contacts sync over CardDAV with a CSV export and Android via DAVx5 — but the help pages state it is currently not possible to share calendars with other people or publish them publicly. I found no public information on free/busy lookup, room and resource booking, tasks, company address books, online office documents or video meetings, and Outlook calendar sync relies on a third-party plugin, which is exactly what I do not want. For us that is a personal calendar, not a company calendar. 3 15 16
The Public Sector IT Lead
There is a personal calendar in beta with month, week and day views, ICS import and export, and genuinely documented sync via CalDAV and CardDAV to Android through DAVx5 and to Outlook through a plugin. But the vendor's own help pages state that sharing calendars with other people or publishing them publicly is currently not possible, and I found no public information on free/busy lookup, room and resource booking, tasks, co-editing or any office document application — on this evidence the bundle cannot replace Microsoft 365 for a whole administration. 16 15 3 8
The IT Service Provider
CalDAV and CardDAV synchronisation, ICS import and export and a CardDAV address book are documented, but the webmail calendar is labelled Beta and the help pages state it is currently not possible to share calendars with other people or publish them publicly — a hard stop for team scheduling. We found no public information on free/busy lookup, room and resource booking, tasks, co-editing of documents, video meetings or a company-wide address book. File storage per plan exists, but this is mail with a calendar attached, not an office suite. 3 8 15 16
The Data Protection Officer
A CalDAV calendar, still marked Beta, with ICS import and export and a CardDAV address book that syncs through DAVx5 and an Outlook plugin — but the help pages themselves state it is currently not possible to share calendars with other people or publish them. For nine practices that live on shared diaries this is a personal calendar only; we found no public information on free/busy lookup, meeting invitations, room booking, tasks, or office documents with co-editing. 3 15 16
The Skeptic
The calendar is labelled Beta, syncs by CalDAV with ICS import and export, and the vendor's own help page states it is currently not possible to share calendars with other people or publish them publicly; contacts sync by CardDAV (with a documented DAVx⁵ and Outlook CalDav Synchronizer path) and export as CSV. Plans do include a file store alongside the mail quota. We found no public information on free/busy lookup, room or resource booking, tasks, co-editing, or video meetings — this is a personal calendar and address book, not office tooling. 15 16 3 8
Security, encryption & compliance archiving
Show reasoningHide reasoning
How this is scored
How mail and documents are protected and kept: TLS enforced in transit, encryption at rest, end-to-end encryption or S/MIME and PGP, who at the provider can read a mailbox, two-factor authentication and passkeys, phishing, malware and account-takeover protection, audit-proof archiving that meets GoBD, retention policies and legal hold, eDiscovery, backups and restore of deleted mail, a transparency report on authority requests, and certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No security information of any kind; no encryption, two-factor sign-in or archiving stated.
3 — Encrypted connections and a password login; encryption at rest, two-factor sign-in, archiving and certifications are basic or not described.
5 — TLS in transit and encryption at rest stated, two-factor authentication, spam, phishing and malware protection, restore of deleted mail for a stated period, archiving offered (built in or as an add-on), and a certification such as ISO 27001 stated for the data centres or the service.
8 — End-to-end encryption, S/MIME or PGP supported, GoBD-compliant archiving documented, retention policies and legal hold, enforced two-factor or passkeys for all users, a transparency report on authority requests, and certifications such as ISO 27001 or BSI C5 published with their scope and auditor.
10 — Security that holds up in an audit of a regulated organisation: zero-access or customer-held keys where the provider cannot read mail, eDiscovery, tamper-proof archive with documented verification, every certification published with its report or attestation available, independent security audits or open-source code reviewed, and incident disclosure documented.
The Small Firm Owner
TLS with perfect forward secrecy, full-disk encryption at rest, two-factor authentication with generated app passwords, virus, spam, tracker and malicious-script filtering, six-month backups on separate servers, PGP end-to-end compatibility, and a genuine year-by-year transparency report backed by a Norwegian court-order threshold — that is a strong posture. What keeps it down for a tax office: we found no public information on ISO 27001 or BSI C5 certifications, GoBD-compliant archiving, retention policies or legal hold. 2 5 6 11 17 18
The IT Administrator
Documented and real: two-factor authentication with TOTP and app passwords, TLS with perfect forward secrecy, full disk encryption, PGP end-to-end compatibility in the browser, spam and virus protection, a six-month backup window, and a transparency report running to 2026 with a disclosure policy requiring a Norwegian court order. I found no public information on GoBD-compliant archiving, retention policies, legal hold or eDiscovery, and the certifications shown (Eco-Lighthouse, Ethical Consumer Best Buy) are environmental rather than ISO 27001 or BSI C5 — thin for an audited German manufacturer. 2 6 11 17 18
The Public Sector IT Lead
The privacy posture is real and detailed: TLS on documented ports, full-disk encryption at rest, two-factor with app passwords, virus and spam filtering, backups kept six months after deletion, browser PGP end-to-end compatibility, and a transparency report with yearly authority-request figures back to 2011 under a Norwegian court-order rule. For a public body the audit-facing gaps decide it: I found no public information on ISO 27001 or BSI C5 certification, GoBD-compliant archiving, retention policies, legal hold or eDiscovery, and the certifications actually named are environmental and ethical-consumer labels. 3 6 11 18 1
The IT Service Provider
TLS with perfect forward secrecy, full-disk encryption, TOTP two-factor with app passwords, virus and spam filtering and a six-month backup retention are all stated, and the authority-request transparency report running from 2011 to 2026 is genuinely rare at this size. But we found no public information on audit-proof archiving, retention policies, legal hold or eDiscovery, and the only certifications on the pages are environmental ones — no ISO 27001 or C5 anywhere I read. For clients with GoBD duties I cannot build a file on this. 1 2 3 5 6 11
The Data Protection Officer
Two-factor authentication with app passwords, full disk encryption, forward-secret TLS, PGP-compatible end-to-end encryption, and a transparency report running from 2011 to 2026 with per-year counts of authority requests and a stated requirement for a Norwegian court order before disclosure — exactly what I read first. Backups of account content are stated for up to 6 months. But we found no public information on GoBD-compliant audit archiving, retention policies or legal hold, and the only published certifications are environmental rather than ISO 27001 or BSI C5. 1 2 6 11 12 18
The Skeptic
Two-factor with app passwords, full-disk encryption, forward-secret TLS, browser-PGP end-to-end compatibility, six-month backups with an opt-out, minimal stated log retention, and a transparency report running from 2011 through 2026 with received, complied and rejected counts are genuinely published — and disclosure is stated to require a Norwegian court order. For the tax-audit question, though, we found no public information on ISO 27001, BSI C5 or SOC 2 certification, on audit-proof or GoBD archiving, retention policies or legal hold; the named certifications are Eco-Lighthouse and an Ethical Consumer rating, which certify other things entirely. 2 5 6 11 12
Administration, identity & partner management
Show reasoningHide reasoning
How this is scored
How an IT team or an IT service provider runs it: an admin console for users, groups, mailboxes and domains, admin roles, single sign-on (SAML or OpenID Connect), sync with Active Directory, Entra ID or LDAP, SCIM provisioning, mobile device policies and remote wipe, audit logs of admin and user actions, usage reports, a documented API for provisioning, multi-tenant or reseller accounts for partners managing several customers, and the support channels and response times per plan.
0 — No administration; one login per mailbox and nothing managed centrally.
3 — A web console to add mailboxes and aliases; roles, single sign-on, directory sync and audit logs are basic or not described.
5 — An admin console for users, groups, mailboxes and domains, admin roles, two-factor sign-in enforceable by the admin, password policies, a documented API or command line for provisioning, an activity or audit log, and business support by phone or ticket stated per plan.
8 — Single sign-on (SAML or OpenID Connect), Active Directory, Entra ID or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, audit logs exportable, delegated administration, partner or reseller accounts that manage several customer organisations, and support response times stated.
10 — Administration that scales across many organisations: every setting reachable by API with parity stated, granular role scopes, policies by group, logs streamed to a SIEM, white-label partner offerings with separate billing, and an SLA with service credits published.
The Small Firm Owner
A central dashboard with main and sub-accounts, scalable at any time, covers creating accounts and aliases for my twelve people. We found no public information on admin roles, single sign-on, Active Directory or LDAP sync, a provisioning API, admin audit logs or mobile device policies, and the terms require written consent even to resell the service; the documented support channels are a help centre, a forum and email, with no stated response times. 2 7 10 20
The IT Administrator
There is a central dashboard to create accounts and sub-accounts, unlimited aliases on own domains, IP-based access control and app passwords — one console for mailboxes, but not an admin platform. I found no public information on admin roles, single sign-on, Active Directory or LDAP sync, SCIM provisioning, remote wipe of mobile devices, audit logs, a provisioning API or reseller accounts; communication runs by email addresses and contact forms with no stated response times, and the terms require written consent to resell the service. For three hundred mailboxes sourced from Active Directory this does not work. 2 7 10 20
The Public Sector IT Lead
The captured pages describe a central dashboard to create and scale accounts, a main and sub-account structure, aliases managed per domain, and human support by email and forum. I found no public information on admin roles, single sign-on, directory synchronisation, SCIM provisioning, audit logs or a provisioning API; the terms bar reselling without written consent and expressly disclaim any warranty of availability. 2 7 14 10
The IT Service Provider
There is a central dashboard to create accounts and aliases, a main-and-subaccount structure and IP-based access control, which amounts to a competent family or small-team panel rather than business administration. We found no public information on admin roles, single sign-on, directory synchronisation, a provisioning API, audit logs or reseller accounts, and the terms themselves disclaim any uptime warranty and reserve resale to written consent. As a provider with forty firms to look after, I could not run this from one console. 2 3 7 10
The Data Protection Officer
A central dashboard to create accounts and sub-accounts and manage aliases, domains and identities, with human support by email and forum from staff who are co-owners. For an IT service provider running mail for nine practices we found no public information on admin roles, single sign-on, directory synchronisation, a documented provisioning API, audit logs, or support response times. 2 7 9
The Skeptic
What passes for organisational management is a main account with purchasable sub-accounts, manageable from a central dashboard for aliases and domains — and the terms state the service may not be resold without written consent. We found no public information on admin roles, single sign-on, directory synchronisation, SCIM provisioning, a provisioning API, mobile device policies with remote wipe, or exportable audit logs. Support is human, by email and forum, with a help centre and status page, but no response times are stated for any plan. 2 14 20 7 10
Migration, open standards & exit
Show reasoningHide reasoning
How this is scored
How the organisation gets in and out: migration from Exchange, Microsoft 365, Google Workspace or another IMAP provider with a documented tool or service, mail, calendars and contacts carried over, coexistence during a move, standard protocols (IMAP, CalDAV, CardDAV, JMAP, open document formats) rather than proprietary ones, export of a mailbox and of the whole organisation in standard formats (mbox, EML, PST, ICS, vCard), open-source code or a self-hosted edition, what happens to data when the contract ends, and how domains and DNS are handed back.
0 — No way to bring mail in or take it out; a proprietary store with no IMAP access or export.
3 — IMAP access to mail; a migration path, calendar and contacts export and the end-of-contract handling are basic or not described.
5 — A documented migration from Exchange, Microsoft 365 or Google (a tool, an import or a service), mail, calendars and contacts imported, IMAP, CalDAV and CardDAV or ActiveSync access, export of mail, calendars and contacts in standard formats, and the deletion of data after the contract ends stated.
8 — A migration service or tool that moves whole organisations with calendars and permissions, coexistence with free/busy during the move, open document formats supported natively, export of the whole organisation by the admin, an open-source code base or a self-hosted edition, and a data return period after cancellation stated.
10 — An exit that costs nothing but time: every record exportable in open formats with the method documented, a self-hosted open-source edition with feature parity stated, migration in and out documented with the same tools, and a contractual data return and deletion with confirmation.
The Small Firm Owner
Getting my client threads in is documented end to end: an IMAP Import that copies all folders and mail, with named source servers for Gmail, Outlook, Yahoo, iCloud and GMX, honest caveats about Gmail label duplication, step-by-step guides and a paid migration service by quote. Export is equally documented — mail via IMAP, contacts as CSV, calendars over CalDAV, files by download or FTP — and the terms state stored data is deleted on termination, with retention periods published; we found no public information on an organisation-level Exchange or Microsoft 365 migration with permissions or free/busy coexistence. 1 10 11 19 20
The IT Administrator
IMAP Import is documented in detail, copying folders and mail from other providers including Gmail, a paid migration service exists (fee only on request), import tools cover contacts via CardDAV/CSV and calendars via CalDAV/ICS, and a dedicated exporting-your-data page covers mail, calendars, contacts, files and web hosting. But it is a per-account path: I found no public information on moving whole organisations with calendars and permissions, free/busy coexistence, an admin-level export of the organisation, or a self-hosted or open-source edition. Deletion of data on termination is stated, with backups kept up to six months after closure. 1 10 11 19 20
The Public Sector IT Lead
Getting mail in is documented properly: an IMAP import that copies folders from any provider with Gmail and Outlook server names listed, MX-record timing guidance, a paid migration service available on quote, and import tools for contacts and calendars; getting out runs over the same standard protocols, and the terms state data is deleted on termination with retention windows of up to six months published. I found no public information on an organisation-wide migration tool with permissions, coexistence during a move, or a self-hosted or open-source edition. 20 1 19 10 11
The IT Service Provider
The documented IMAP Import copies all folders from any provider — Gmail and Outlook hostnames included — with deduplication behaviour and MX timing spelled out, and I can run it myself; a paid migration service is offered on request and import tools cover contacts and calendars too. Standard protocols (IMAP, CalDAV, CardDAV, FTP) plus export of mail, contacts as CSV, calendars via CalDAV and ICS are documented, and the terms state stored data is deleted after termination. We found no public information on organisation-wide export by an administrator, coexistence during a move, or a self-hosted edition. 1 10 16 19 20
The Data Protection Officer
A documented IMAP import including a step-by-step Gmail path, import and migration tools for mail, contacts and calendars, a paid migration service available by quote, and a help page on exporting mail, calendars via CalDAV and ICS, contacts as CSV and files by FTP. Deletion of data on termination is stated with exact retention windows — up to 3 or 6 months for content and 6 months for backups. We found no public information on coexistence with free/busy during a move or whole-organisation export by an administrator. 1 10 11 19 20
The Skeptic
Getting in is documented account by account: IMAP Import copies all folders from another provider, with Gmail-specific instructions, de-duplication on re-import and a paid migration service quoted through support; getting out is a dedicated export help page covering mail by IMAP, contacts as CSV, calendars by CalDAV, files by FTP, and the terms state all stored data is deleted at termination, with three-to-six-month post-closure windows published. Everything is per-account, though: we found no public information on whole-organisation export by an administrator, coexistence with free/busy during a move, or an open-source or self-hosted edition. 1 19 20 10 11
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where mailboxes, calendars, contacts, documents and backups are stored and processed, who at the provider or its subprocessors can access them, and who the subprocessors are (data centres, spam filtering, support, payment, AI features). Independently sourced by the sovereignty pipeline. An EU data region offered by a non-EU parent is part of the chain, not the whole of it. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (spam filtering, support, backups, AI features) run through non-EU providers or a non-EU parent without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated — or a self-hosted edition documented that keeps every mailbox on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Small Firm Owner
A Norwegian contracting entity in Oslo, majority employee and board owned, servers owned and run by Runbox in a maximum-security Oslo facility, mail stored exclusively in Norway, GDPR through the EEA with a DPO authorised by the Norwegian authority, a data processing agreement referenced, a named Norwegian systems-management processor, and disclosure only under Norwegian legal process — that is a European chain end to end. It stops short of the top level because no ISO 27001 or BSI C5 certification is published and three named collaborators appear without their countries. 2 5 9 10 11 12
The IT Administrator
The strongest part for me: a Norwegian company (Runbox Solutions AS, majority employee-owned) with servers owned and operated in Oslo, mail stored exclusively in Norway, disclosure requiring a Norwegian court order with foreign requests routed through diplomatic channels, a Data Processing Agreement and an appointed Data Protection Officer, plus a named systems-management partner in Norway under a GDPR agreement. The captured pages give no locations for the other named partners (Miazine, Peregrine, Shadowcat), show no ISO 27001 or BSI C5 certification, and the privacy policy notes that web hosting servers and registrar data default to the US. A solid EEA chain for the mailbox itself, just not evidenced end to end. 2 9 10 11 12
The Public Sector IT Lead
The chain is genuinely European: Runbox Solutions AS in Oslo with a Norwegian registry number, 77.54 percent owned by employees and board in 2026, mail servers owned by the company itself in an Oslo facility, storage stated exclusively in Norway, a data processing agreement offered, Copyleft Solutions AS named as a Norwegian systems-management processor, standard contractual clauses for staff outside the EEA, and foreign authority requests routed through the Norwegian foreign ministry behind a court order. It stays below the top because three of the four named subprocessors are published without their country, domain-registration personal data is stated to default to a US registrar, and I found no public information on ISO 27001 or BSI C5 attestation. 9 11 12 2 10
The IT Service Provider
The chain is European and largely named: employee-owned Runbox Solutions AS in Oslo, mail servers owned by Runbox in a maximum-security Oslo facility, storage exclusively in Norway, GDPR via the EEA, a data processing agreement available, and disclosure only under a Norwegian court order with foreign requests routed through diplomatic channels. Subprocessors are listed — Copyleft Solutions in Norway under a GDPR-compliant agreement among them — though the captured pages give locations for only some of them. The gap to the top level is certifications: no ISO 27001 or C5 is published, only environmental endorsements. 3 6 9 10 11 12
The Data Protection Officer
Mail is stored exclusively in Norway on servers Runbox owns in an Oslo facility under Norwegian jurisdiction, the contracting entity Runbox Solutions AS is Norwegian and majority employee-owned, GDPR applies through the EEA, and a data processing agreement is referenced with foreign requests routed through Norwegian diplomatic channels and a court order. Subprocessors are named — Copyleft Solutions AS in Norway under a GDPR-compliant agreement, plus Miazine Systems, Peregrine Computer Consultants and Shadowcat Systems — but the location is stated only for Copyleft, no ISO 27001 or BSI C5 certification is published, and the pages state that web hosting and domain registration data default to the US unless Norway is chosen. 2 5 9 10 11 12
The Skeptic
The vendor's own pages state email is stored exclusively in Norway on servers Runbox owns in a maximum-security Oslo facility, run by the Norwegian entity Runbox Solutions AS (org. number 996877027) under Norwegian law, with a Norwegian court order required for disclosure and Standard Contractual Clauses governing any non-EEA staff, plus a data processing agreement referenced in the terms. Four subprocessors are named, but only Copyleft Solutions AS carries a stated country, backup server locations are unstated, and we found no public information on ISO 27001 or BSI C5 certification. We also note the privacy policy's own statement that optional web hosting data sits in the US by default and that domain registration data may be stored with US registrars and registries. 2 5 9 10 11 12
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or mailbox per tier, storage per user, what shared mailboxes, aliases and extra domains cost, which features (archiving, office apps, SSO, advanced security, more storage) cost extra, the first-year discount and the regular price after it, minimum users and term, monthly versus annual billing, and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price per user exists, but how cost scales with storage, users, add-ons or after the first year is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (archiving, extra storage, shared mailboxes, SSO, the price after the introductory period) is unpriced or "on request".
8 — Every tier priced publicly per user with storage, add-ons priced, the regular price after any introductory discount stated, minimum users and term stated, monthly and annual billing compared, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of users, storage and add-ons, with every support, migration and archive fee and the cancellation and data-return terms published.
The Small Firm Owner
The tiers are public right down to email and file storage, domain counts, alias counts and daily send limits, with team bundles for five and ten people, a plan calculator, a 30-day trial without a credit card and 3-year savings spelled out. But we found no public information on VAT treatment or the price of extra sub-accounts and storage, and the migration service is quote-only — so I cannot compute the real second-year cost for twelve people from the public pages alone. 2 8 10 20
The IT Administrator
Prices are unusually public: Mini, Medium and Max plans with euro figures per month, per year and as three-year totals, email and file storage in gigabytes, alias and domain counts, team-of-5 and team-of-10 examples, a 30-day free trial without credit card, and a plan calculator. The migration service is quoted only on request, and I found no public information on VAT treatment, minimum users, term lengths, or the unit price of additional sub-accounts. Enough to budget roughly, not enough to compute the exact annual cost for three hundred people. 2 8 10 20
The Public Sector IT Lead
Every tier is published in euros with storage, domain counts, aliases and daily send limits, monthly, annual and three-year figures shown side by side, a plan calculator, and a 30-day free trial with no credit card required. The migration service is quote-only with no stated fee, and I found no public information on VAT treatment, minimum term, or the unit price of additional sub-accounts. 8 2 20 10
The IT Service Provider
Per-plan prices with email and file storage, domain counts, alias allowances, team bundles for five and ten seats, three-year savings and a plan calculator are public, so I can roughly cost a client before quoting. But the migration service fee is available only on request, and we found no public information on VAT treatment, minimum term, a month-to-month versus annual comparison, or itemised prices for extra sub-accounts and storage. Computable at the plan level, not yet at the invoice level. 2 8 10 20
The Data Protection Officer
Tiers are public with email and file storage, domain and alias counts, monthly and annual figures, three-year totals, team bundles for five and ten users, and a plan calculator to price a custom setup. The migration service is priced only by quote from support, and we found no public information on VAT treatment or the price of extra sub-accounts; the terms also allow fees to be modified at renewal. 2 8 10 20
The Skeptic
Per-tier prices with email storage, file storage, domain and alias counts are published to the euro-cent — Max at "€5.28/month|€63.32/year Billed every 3 years", a team of 10 at "€16.20/month|€194.50/year Billed annually" — alongside a plan calculator, a 30-day trial with no credit card and a 60-day guarantee, with no introductory teaser to decode. But a buyer cannot complete the sums: the migration service is quote-only, we found no public information on sub-account, extra-storage or add-on prices, and VAT treatment is unstated. The terms also reserve the right to modify fees at any time, applying at renewal. 8 2 20 10
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Runbox
Is Runbox European?
Yes, though not from the EU. whats-best.ai classifies Runbox as UK / wider Europe.
Where does Runbox store data?
The default storage location for customer data is not stated on the vendor’s pages as of 5 Nov 2026. The vendor’s pages mention Norway as hosting location, per the vendor’s page captured 5 Nov 2026.
Does Runbox have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to Runbox?
As of 6 Nov 2026, the panel rates grommunio (3.5/5), Infomaniak kSuite (3.5/5) and Nextcloud Hub (Groupware & Office) (3.5/5) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is grommunio (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Runbox alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Hosting location, Hosting options, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 14 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (20)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage runbox.com Checked 5 Nov 2026 Details →
- 2 Features page (business) runbox.com Checked 5 Nov 2026 Details →
- 3 Features page (email) runbox.com Checked 5 Nov 2026 Details →
- 4 Features page (custom domains) runbox.com Checked 5 Nov 2026 Details →
- 5 Security / trust page runbox.com Checked 5 Nov 2026 Details →
- 6 Transparency report runbox.com Checked 5 Nov 2026 Details →
- 7 Documentation (help centre) help.runbox.com Checked 5 Nov 2026 Details →
- 8 Pricing page runbox.com Checked 5 Nov 2026 Details →
- 9 About page (operating company) runbox.com Checked 5 Nov 2026 Details →
- 10 Terms of service runbox.com Checked 5 Nov 2026 Details →
- 11 Privacy policy runbox.com Checked 5 Nov 2026 Details →
- 12 Privacy page (Norwegian jurisdiction) runbox.com Checked 5 Nov 2026 Details →
- 13 Mail, domains & deliverability — found from sitemap help.runbox.com Checked 5 Nov 2026 Details →
- 14 Mail, domains & deliverability — found from sitemap help.runbox.com Checked 5 Nov 2026 Details →
- 15 Calendar, contacts & office apps — found from sitemap help.runbox.com Checked 5 Nov 2026 Details →
- 16 Calendar, contacts & office apps — found from sitemap help.runbox.com Checked 5 Nov 2026 Details →
- 17 Security, encryption & compliance archiving — found from sitemap help.runbox.com Checked 5 Nov 2026 Details →
- 18 Security, encryption & compliance archiving — found from sitemap help.runbox.com Checked 5 Nov 2026 Details →
- 19 Migration, open standards & exit — found from sitemap help.runbox.com Checked 5 Nov 2026 Details →
- 20 Migration, open standards & exit — found from sitemap help.runbox.com Checked 5 Nov 2026 Details →