# Runbox — Business Email & Office Suites

Runbox by Runbox Solutions AS holds a panel rating of 2.5/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: UK / wider Europe; sovereignty: not determined.

- Vendor: Runbox Solutions AS (https://runbox.com)
- Category: [Business Email & Office Suites](https://whats-best.ai/software/business-email.md)
- Provenance (editorial classification): UK / wider Europe
- Canonical page: https://whats-best.ai/software/business-email/runbox
- Alternatives: https://whats-best.ai/software/business-email/runbox/alternatives ([markdown](https://whats-best.ai/software/business-email/runbox/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Runbox Solutions AS
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Default not stated; pages mention Norway [S1]
- Free plan: Not stated on the vendor’s pages as of 5 Nov 2026

## The panel's verdict

Runbox is email hosting from Runbox Solutions AS of Oslo, and the bench's scores are sharply two-sided. Strongest is sovereignty, a uniform 7: the vendor's pages state mail is stored exclusively in Norway on its own Oslo servers, disclosure requires a Norwegian court order, and an authority-request transparency report runs from 2011 to 2026. Mail and deliverability holds at 6 on documented MX and DKIM set-up with keys rotated every three months and stated limits of 100 MB messages and 500 outbound a day; migration and portability runs 5-6 on documented IMAP import and export paths. Weaknesses are shared: administration and identity at 3, with no public information on admin roles, single sign-on or directory sync, and calendar and office at 4, the vendor's own help pages stating calendar sharing is currently not possible. Judges split on security and compliance, 4 to 6 — the audit-facing gaps (no public information on ISO 27001, BSI C5 or GoBD archiving) weighed more with judges serving audited buyers — and pricing transparency spread 5 to 7 over quote-only migration fees and unstated VAT.

**Speaks for it:**
- Sovereignty at a uniform 7 — the bench's top score — for mail the vendor states is stored exclusively in Norway on its own Oslo servers, with disclosure gated by a Norwegian court order.
- An authority-request transparency report published for every year from 2011 to 2026, with received, complied and rejected counts.
- Custom-domain mail documented in depth, with DKIM keys rotated every three months, SPF, DMARC and DNSSEC support, and stated limits of 100 MB messages, 500 outbound and 5,000 inbound a day.
- Prices published exactly, including Max at "€5.28/month|€63.32/year Billed every 3 years" and a team of 10 at "€16.20/month|€194.50/year Billed annually", alongside a plan calculator and a 30-day free trial with no credit card required.
- A documented way in and out: IMAP import that copies all folders from another provider, and a dedicated export page covering mail, contacts, calendars and files.

**Held against it:**
- Administration and identity scored a flat 3; we found no public information on admin roles, single sign-on, directory synchronisation, SCIM provisioning or audit logs.
- The vendor's own help pages state it is currently not possible to share calendars with other people or publish them publicly, and the calendar is labelled Beta.
- We found no public information on ISO 27001, BSI C5 or SOC 2 certification, GoBD-compliant archiving, retention policies or legal hold; the named certifications are Eco-Lighthouse and an Ethical Consumer rating.
- The migration service is quote-only, and we found no public information on VAT treatment or the price of extra sub-accounts and storage.
- Only one of the four named subprocessors (Copyleft Solutions AS, Norway) carries a stated country, and the privacy policy places web hosting and domain-registration data in the US by default.

**Best for:**
- You need mail on your own domain hosted in Norway under Norwegian jurisdiction, with disclosure behind a Norwegian court order — the bench's strongest category at a uniform 7.
- You run a small team or solo practice over standard IMAP, POP and SMTP clients and can accept a personal calendar without sharing.
- You want to price before contact: tiers with storage, alias and domain counts are published, plus a plan calculator and a 30-day free trial with no credit card required.
- You want a documented exit path covering mail, contacts, calendars and files if you ever leave.

**Avoid if:**
- Your day runs on shared calendars or published team schedules — the vendor's own help pages state that sharing and public publishing are currently not possible.
- You must evidence security certifications for audits — the published certifications are Eco-Lighthouse and an Ethical Consumer rating, and judges split 4 to 6 on this category over those audit gaps.
- You plan to resell or run many client mailboxes from one console — the terms require written consent for resale, and administration and identity scored 3 with no spread.
- You need an exact invoice before committing — the migration fee is available only by quote through support.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Small Firm Owner | The IT Administrator | The Public Sector IT Lead | The IT Service Provider | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Mail, domains & deliverability | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Calendar, contacts & office apps | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Security, encryption & compliance archiving | 3/5 | 3/5 | 2.5/5 | 2/5 | 3/5 | 3/5 |
| Administration, identity & partner management | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 |
| Migration, open standards & exit | 3/5 | 3/5 | 3/5 | 3/5 | 2.5/5 | 3/5 |
| European sovereignty | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Pricing transparency | 2.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3.5/5 |
| **Weighted verdict** | **2.5/5** | **2.5/5** | **2.5/5** | **2.5/5** | **3/5** | **3/5** |

### The judges

- **The Small Firm Owner** (v1.0): Runs a tax and accounting firm of twelve in Lower Saxony. Every member of staff lives in Outlook, the shared "kanzlei@" mailbox is the busiest address in the office, and the meeting room is booked by shouting across the corridor. Wants mail on the firm's own domain that arrives, a shared calendar and address book on every phone, a move from the old provider that does not lose a single client thread, and a per-user price that is still the price in the second year.
- **The IT Administrator** (v1.0): IT administrator at a machine builder in Baden-Württemberg with three hundred mailboxes, an on-premises Exchange that reaches end of support, and Active Directory as the source of every account. Wants Outlook to keep working without a plug-in nobody maintains, shared mailboxes and room booking, single sign-on and directory sync, mobile devices that can be wiped, an API for provisioning, and a migration that moves calendars and permissions, not only mail.
- **The Public Sector IT Lead** (v1.0): Head of IT at a district administration in Bavaria with eleven hundred staff, told by the council to leave Microsoft within three years. Has read what Schleswig-Holstein did and what it cost. Needs mail, calendars and documents that a whole administration can work in, open formats and open source where possible, BSI C5 or ISO 27001 on paper, a provider whose owners answer to European law only, and an exit plan before the contract is signed.
- **The IT Service Provider** (v1.0): Runs a six-person IT service company in Austria that looks after mail for forty client firms, from a two-person architect's office to a hotel group. Spends Mondays on mails that landed in spam and phones that stopped syncing. Wants one partner console for every client, DKIM and DMARC set up without a ticket, migrations it can run itself, support that answers within the hour, and margins it can calculate before it quotes.
- **The Data Protection Officer** (v1.0): Data protection officer for a group of nine medical practices in North Rhine-Westphalia, where a referral letter sent by mail is patient data under professional secrecy. Reads the subprocessor list and the transparency report before the feature page, asks who at the provider can open a mailbox and under which law, and wants encryption the practices can actually use with outside doctors, archiving that satisfies the tax office, and a data processing agreement that names every server.
- **The Skeptic** (v1.0): Has seen "hosted in Germany" from a provider whose spam filter and support desk sit in the United States, "Exchange-compatible" that meant IMAP with a calendar plug-in, and a first-year price of one euro that became seven. Asks which protocols Outlook really uses, whether the archive would survive a tax audit, what the certification actually covers — and how ten years of mail, calendars and contacts would leave.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Access control: yes [S2]
- Data residency: Norway [S2]
- Disclosure policy: yes [S12]
- Disclosure policy: Disclosure only via Norwegian court order or breach of ToS/Norwegian law [S5]
- Eco community: yes [S11]
- Eco community: .eco community [S6]
- Eco community: the .eco community [S10]
- Eco community: .eco community [S5]
- Ecolighthouse: Eco-Lighthouse [S1]
- Ekomloven exempt: no [S12]
- Encryption: yes · yes · yes [S2]
- Encryption layers: multiple layers of encryption and secure storage [S9]
- Ethical consumer best buy: Ethical Consumer Best Buy [S10]
- Ethical consumer bestbuy: Ethical Consumer Best Buy [S6]
- Ethical consumer bestbuy: Ethical Consumer Best Buy [S5]
- Foreign requests: diplomatic via Norwegian Ministry of Foreign Affairs [S12]
- GDPR: Norwegian Personal Data Act incorporating GDPR · yes [S11]
- GDPR: yes · yes [S3]
- GDPR: yes [S2]
- GDPR and norwegian law: Protected by Norwegian privacy regulations and EU GDPR [S5]
- GDPR dpo: GDPR compliance oversight · yes [S5]
- GDPR framework: yes · Norwegian Personal Data Act [S12]
- Memberships: .eco community · Ethical Consumer Best Buy [S9]
- Minimal logging: yes · yes [S2]
- Norway GDPR: Datatilsynet · yes [S2]
- Privacy jurisdiction: Servers in Norway under Norwegian jurisdiction and privacy laws [S1]
- Privacy policy transparency: Privacy policy describes collection, use, storage, protection of personal data [S5]
- Renewable energy: yes · 1 [S9]
- Surveillance: yes [S12]
- Transparency 2011: 2011 · 0 · 0 · 0 [S6]
- Transparency 2012: 2012 · 0 · 1 · 1 · 0 · 1 · 1 · 0 [S6]
- Transparency 2013: 2013 · 0 · 1 · 1 · 0 · 0 [S6]

**Data**
- Access request right: yes [S5]
- Account info backup: separate secure servers · 6 [S11]
- Account info location: Norwegian Bookkeeping Legislation · Norway · 1 · 5 [S11]
- Collection: yes [S12]
- Cookies required: yes [S11]
- Deletion on termination: yes [S10]
- Logs: yes · no [S12]
- Minimal logging: Server logs kept only for issue resolution and legal compliance [S5]
- No advertisements: no · no [S11]
- No commercial use of data: no [S10]
- No isp logging: no [S11]
- No scanning for ads: yes · no [S5]
- No third party access: No unauthorized third-party access including advertisers and analytics companies [S5]
- No third party tracking: no [S11]
- No web beacons: no [S11]
- Privacy policy reference: yes [S10]
- Registration fields: first name · last name · company name (where applicable) · mobile phone number (where applicable) · country · alternative email address [S11]
- Server logs retention: 10 · 1 [S11]
- Tracking: no · no [S12]

**Hosting**
- Datacenter location: Oslo, Norway · Norwegian [S9]
- Facility monitoring: 24/7 by own sysadmins · IP-based · continuous [S5]
- Jurisdiction: yes · Norway [S12]
- Location: Oslo · Norway [S1]
- Location: Oslo · Norway · maximum security data center [S3]
- Management partner: systems management and infrastructure · Copyleft Solutions AS [S9]
- Ownership: Norway [S12]
- Region: Norway [S2]
- Renewable energy: 100 [S3]
- Residency: Norway [S4]
- Servers owned oslo: Oslo, Norway · owned and operated by Runbox · no [S5]

**Integrations**
- Mobile app: yes [S7]

**Legal**
- Address: Oslo · Oscars gate 27 · Norway · 0352 [S12]
- Address: Oslo · Oscars gate 27 · Norway · 0352 [S11]
- Address: Oscars gate 27, 0352 Oslo, Norway [S2]
- Address: Oscars gate 27, 0352 Oslo, Norway [S6]
- Address: Oslo · Oscars gate 27 · Norway · 0352 [S10]
- Address: Oslo · Oscars gate 27 · Norway · 0352 [S4]
- Board chairman: Dag Asheim [S9]
- Disclosure conditions: written permission or legal process under Norwegian law [S11]
- Entity: Runbox Solutions AS [S12]
- Entity: Runbox Solutions AS · Norway · email · web · domain hosting [S11]
- Entity: Runbox Solutions AS · Oscars gate 27, 0352 Oslo, Norway · 996877027 [S1]
- Entity: Oscars gate 27, 0352 Oslo, Norway · Runbox Solutions AS · Norwegian Business Registry · 996877027 [S3]
- Entity: Runbox Solutions AS [S2]
- Entity: Runbox Solutions AS [S6]
- Entity: Runbox Solutions AS · Oscars gate 27, 0352 Oslo, Norway · Norwegian Business Registry · 996877027 [S8]
- Entity: Runbox Solutions AS · Norway [S10]
- Entity: Runbox Solutions AS [S4]
- Entity: Oscars gate 27, 0352 Oslo, Norway · Norway · Norwegian Business Registry · 996877027 [S5]
- Founded: 2000 [S9]
- Founding current form: 2011-03 [S9]
- GDPR tos change notice days: 30 [S10]
- Jurisdiction: Oslo city court · Norway [S10]
- Jurisdiction protection: Norwegian criminal law [S5]
- Key people: Co-Founder, Managing Director, Project Manager · Geir Thomas Andersen [S9]
- Memberships: .eco community · Ethical Consumer Best Buy [S12]
- Minimum age: 13 · 16 [S10]
- No sale of data: no [S11]
- No SLA warranty: no · no [S10]
- Non transferable: no · yes [S10]
- Operating company: Oslo, Norway · Runbox Solutions AS · limited liability [S9]
- Org number: Norwegian Business Registry · 996877027 [S11]
- Ownership: 2026 · 77.54 [S9]

**Pricing**
- Family example: 88.75 · 7.39 · 44.5 · 221.75 [S8]
- Fees modifiable: renewal · yes [S10]
- Free trial: yes [S4]
- Free trial: yes [S5]
- Liability cap: 1-year subscription fee [S10]
- Max 3year: Max · 49.9 · 63.32 · 25 · 5.28 · 189.95 · 5 · 50 · 3 [S8]
- Medium 3year: Medium · 29.9 · 39.98 · 10 · 3.33 · 119.95 · 2 · 25 · 3 [S8]
- Migration service: quote via Runbox Support, fee not stated · yes [S20]
- Mini 3year: Mini · 19.9 · 28.32 · 5 · 2.36 · 84.95 · 1 · 10 · 3 [S8]
- No refund on expiry: no [S10]
- Subscription model: subscription [S10]
- Team10 3year discount: 89 · 494.5 [S2]
- Team10 includes: 1 Medium Main Account 25GB, 1 Medium Subaccount 25GB, 8 Mini Subaccounts 10GB [S2]
- Team10 monthly: annually · 10 · 194.5 · 16.2 [S2]
- Team5 3year discount: 50.5 · 257.75 [S2]
- Team5 includes: 1 Medium Main Account 25GB, 3 Mini Subaccounts 10GB, 1 Micro Subaccount 2GB · unlimited · 100 [S2]
- Team5 monthly: annually · 5 · 102.75 · 8.56 [S2]
- Team example: 227.5 · 18.95 · 112 · 570.5 [S8]
- Trial: yes · 30 [S1]
- Trial: 30 · no [S8]
- Trial period days: 30 [S10]

**Product**
- 2FA app passwords: https://runbox.com/app/account/app_passwords · yes [S20]
- 2FA import option: application-specific password or temporarily disabling 2FA may be needed [S20]
- 2FA service password restriction: With 2FA activated, main password no longer works for IMAP, POP, SMTP, Cal/CardDAV or FTP; App Passwords required [S18]
- 2FA toggle without new key: 2FA can be toggled on/off without generating a new TOTP key or OTP set [S18]
- 2FA totp otp requirement: 2FA requires a TOTP key or a set of OTPs before activation [S18]
- Access control: IP-based access control and username/alias protection [S1]
- Account consolidation: yes [S5]
- Account information export: PDF via Print to PDF · HTML archive [S19]
- Account information view: Account page · yes [S19]
- Ad free: yes [S2]
- Ad free: no · no [S5]
- Ad free env: no [S5]
- Address book carddav: yes · yes [S3]
- Ads: yes · no [S12]
- Aliases: yes [S7]
- Android davx5: DAVx⁵ · Android [S15]
- App password not reshown: App Passwords are not shown once saved [S18]
- App passwords: yes [S5]
- App passwords generated by runbox: App Passwords are generated by Runbox to ensure they are long and complex [S18]
- App passwords location: Security > App Passwords [S15]
- App passwords management: yes · yes · yes [S18]
- App passwords service restriction: With App Passwords activated, usual password will not work for IMAP, POP, SMTP, Cal/CardDAV or FTP [S18]
- App passwords webmail login denied: no [S18]
- App passwords without 2FA: App Passwords can be used with or without 2FA activated [S18]
- Caldav 2FA: yes [S15]
- Caldav sharing: no · no [S15]
- Caldav support: dav.runbox.com · yes [S15]
- Calendar autoload: Calendars loaded and synchronized automatically [S16]
- Calendar beta: yes [S16]
- Calendar caldav: yes · yes [S3]
- Calendar caldav: yes · yes [S16]

**Subprocessors**
- Copyleft: Copyleft Solutions AS · Norway · systems management [S11]
- Miazine: Miazine Systems · security and systems management [S9]
- Peregrine: Peregrine Computer Consultants Corporation · anti-spam and email security expertise [S9]
- Shadowcat: Shadowcat Systems Limited · open source software quality [S9]
- Staff scc: EU Model Contract · Standard Contractual Clauses (SCC) · Contractual Clauses authorized by the Data Protection Agency [S11]

**Support**
- Assistant: Support Assistant for instant answers [S7]
- Assistant: Boxy help assistant for plan/pricing questions [S8]
- Channels: always available [S2]
- Channels: Support Center · Forum · mail@support.runbox.com [S7]
- Common hostnames: imap.gmx.com · imap.gmail.com · imap.mail.yahoo.com · imap.mail.me.com · imap-mail.outlook.com [S20]
- Communication channels: email addresses · contact forms [S10]
- Community forum: yes [S2]
- Dkim contact: Support contact available for DKIM setup help [S13]
- Faq topics: FAQ includes migration, payment methods, custom domain setup, cancellation, upgrades [S8]
- Help center: yes [S2]
- Human support: Personal human support, no AI chatbots, community forum [S1]
- Migration assistance: yes · yes [S3]
- Migration help: Runbox Support [S20]
- Model: personalized support; employee-owned company; support staff are co-owners [S9]
- Self service docs: help & support · service status [S5]
- Status page: Status page for service updates [S7]
- System location: authorized Runbox staff and ticket submitter · Norway [S11]
- Trial terms: yes · 60 [S7]

135 more facts on the canonical page: https://whats-best.ai/software/business-email/runbox

## Questions

### Is Runbox European?

Yes, though not from the EU. whats-best.ai classifies Runbox as UK / wider Europe.

### Where does Runbox store data?

The default storage location for customer data is not stated on the vendor’s pages as of 5 Nov 2026. The vendor’s pages mention Norway as hosting location, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/18658).

### Does Runbox have a free plan?

Not stated on the vendor’s pages as of 5 Nov 2026.

### What are the best alternatives to Runbox?

As of 6 Nov 2026, the panel rates [grommunio (3.5/5)](https://whats-best.ai/software/business-email/grommunio), [Infomaniak kSuite (3.5/5)](https://whats-best.ai/software/business-email/infomaniak-ksuite) and [Nextcloud Hub (Groupware & Office) (3.5/5)](https://whats-best.ai/software/business-email/nextcloud-hub) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [grommunio](https://whats-best.ai/software/business-email/grommunio) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Runbox alternatives](https://whats-best.ai/software/business-email/runbox/alternatives).

## What this page leaves out

- 14 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage: https://runbox.com/ (checked 2026-11-05)
- [S2] Features page (business): https://runbox.com/business/ (checked 2026-11-05)
- [S3] Features page (email): https://runbox.com/features/email-features/ (checked 2026-11-05)
- [S4] Features page (custom domains): https://runbox.com/features/domain-hosting/ (checked 2026-11-05)
- [S5] Security / trust page: https://runbox.com/features/privacy-security/ (checked 2026-11-05)
- [S6] Transparency report: https://runbox.com/features/privacy-security/transparency-report/ (checked 2026-11-05)
- [S7] Documentation (help centre): https://help.runbox.com/ (checked 2026-11-05)
- [S8] Pricing page: https://runbox.com/pricing/ (checked 2026-11-05)
- [S9] About page (operating company): https://runbox.com/about/ (checked 2026-11-05)
- [S10] Terms of service: https://runbox.com/about/terms-service/ (checked 2026-11-05)
- [S11] Privacy policy: https://runbox.com/about/privacy-policy/ (checked 2026-11-05)
- [S12] Privacy page (Norwegian jurisdiction): https://runbox.com/about/norwegian-privacy/ (checked 2026-11-05)
- [S13] Mail, domains & deliverability — found from sitemap: https://help.runbox.com/dkim-signing/ (checked 2026-11-05)
- [S14] Mail, domains & deliverability — found from sitemap: https://help.runbox.com/can-i-use-the-domain-of-my-choice-with-runbox/ (checked 2026-11-05)
- [S15] Calendar, contacts & office apps — found from sitemap: https://help.runbox.com/using-a-calendar-client-with-caldav/ (checked 2026-11-05)
- [S16] Calendar, contacts & office apps — found from sitemap: https://help.runbox.com/runbox-7-calendar/ (checked 2026-11-05)
- [S17] Security, encryption & compliance archiving — found from sitemap: https://help.runbox.com/connection-encryption-ssl-tls-starttls/ (checked 2026-11-05)
- [S18] Security, encryption & compliance archiving — found from sitemap: https://help.runbox.com/more-about-two-factor-authentication-and-app-passwords/ (checked 2026-11-05)
- [S19] Migration, open standards & exit — found from sitemap: https://help.runbox.com/exporting-your-data/ (checked 2026-11-05)
- [S20] Migration, open standards & exit — found from sitemap: https://help.runbox.com/imap-import/ (checked 2026-11-05)

---

Cite as: whats-best.ai, "Runbox — Business Email & Office Suites", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-email/runbox

Corrections: https://whats-best.ai/correct/1555?target=page