Business Email & Office Suites
STRATO Mail
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by STRATO GmbH · www.strato.de
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
STRATO Mail at a glance
- Vendor
- STRATO GmbH
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 5 Nov 2026
- Panel verdict
- The AI panel rates STRATO Mail 2/5, the mean of 6 judges. STRATO Mail is a hosted German business e-mail product — webmail on Open-Xchange, mailboxes on your own.de domain, up to 250 aliases, server-side spam and virus filtering — and the judges' persona-weighted totals cluster at 4.2–4.6. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
STRATO Mail is a hosted German business e-mail product — webmail on Open-Xchange, mailboxes on your own.de domain, up to 250 aliases, server-side spam and virus filtering — and the judges' persona-weighted totals cluster at 4.2–4.6. It is strongest on pricing transparency, the only criterion scored a single value of 6, and on security and compliance, where yearly TÜV-certified ISO 27001, two-factor sign-in and a GoBD- and EU-DSGVO-conform archiving add-on with an IDW PS 880 attestation are documented. Sovereignty drew the bench's highest single mark, 7: STRATO GmbH in Berlin is the contracting entity, hosting is stated as "Hosted in Germany" and a data processing agreement is published — yet the privacy policy permits transfers outside the EU/EEA, shares SHA-256-hashed marketing data with Meta, LinkedIn, TikTok, Reddit and Google, and we found no public information on data centres or subprocessor locations. Administration and identity is weakest at 2–3, with only self-service webmail administration documented. Mail, calendar and migration sit at 3–4 with no published access protocols, shared calendars or export path, and no material disagreement was computed between the judges.
Speaks for it
- Optional archiving add-on stated GoBD- and EU-DSGVO-conform with an IDW PS 880 software attestation, priced at "2,50 € monatlich" plus "0,50 €/Monat" per further GB.
- Security architecture certified yearly to ISO 27001 by TÜV, with SSL-encrypted mail traffic and two-factor sign-in documented.
- Starter, Basic and Plus prices are published with setup at 0 € and VAT included (Plus: "1 €/Mon. für 12 Monate danach 5 €/Mon.").
- The move to STRATO is documented as free of charge and carries e-mails, contacts and appointments.
- The contracting entity is STRATO GmbH in Berlin (HRB 270570 B) with a published data processing agreement and hosting stated as "Hosted in Germany".
Held against it
- Administration and identity scored 2–3, with only self-service webmail administration documented and we found no public information on an admin console, admin roles, single sign-on, directory sync or a provisioning API.
- Mail and deliverability scored 3–4, and we found no public information on IMAP, POP3 or ActiveSync, or on SPF, DKIM or DMARC.
- Migration and portability scored 3–4, with we found no public information on export of mail, calendars or contacts in standard formats or on data handling when the contract ends.
- The privacy policy permits transfers of personal data outside the EU/EEA and names Meta, LinkedIn, TikTok, Reddit and Google as marketing partners receiving SHA-256-hashed data, while we found no public information on data centres or subprocessor locations for the mail service.
- The Business tier is shown with a first-year saving of 48 € rather than a monthly price, and the optional premium mailboxes, Webmail AI and paid 24/7 hotline carry no price on the captured pages.
Best for
- You need a small fleet of up to 25 mailboxes on your own.de domain with 250 aliases and publicly priced tiers.
- Your firm must archive business e-mail in a GoBD- and EU-DSGVO-conform way with an IDW PS 880 attestation for the stated four-year retention.
- You want a German contracting entity with a published data processing agreement and a security architecture certified yearly to ISO 27001 by TÜV.
Avoid if
- Your team administers hundreds of mailboxes centrally: administration and identity scored 2–3, only self-service webmail management is documented, and we found no public information on single sign-on, directory sync, admin roles or a provisioning API.
- You are leaving Microsoft 365 or Exchange — ask the vendor: the public pages we read do not show it
- You must know your full processor chain — ask the vendor: the public pages we read do not show it
- You need a documented exit — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Mail, domains & deliverability | 2 of 5 |
| Calendar, contacts & office apps | 1.5 of 5 |
| Security, encryption & compliance archiving | 3 of 5 |
| Administration, identity & partner management | 1.5 of 5 |
| Migration, open standards & exit | 2 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 3 of 5 |
Mail, domains & deliverability
Show reasoningHide reasoning
How this is scored
How well the mailbox itself works: custom domains and their DNS set-up, aliases, catch-all, shared and functional mailboxes, distribution lists, mailbox and attachment size limits, IMAP, POP3, SMTP and Exchange ActiveSync or MAPI for Outlook, web and mobile apps, spam and malware filtering, SPF, DKIM, DMARC and MTA-STS, out-of-office and server-side rules, send limits, and the delivery reputation of the sending infrastructure. A self-hosted groupware is judged on the mail server it ships; a suite whose mail app is only a client for another server scores at the level of that client.
0 — No mailbox at all; a product that only sends transactional mail or only reads another provider's mail without a server of its own or a documented one to pair it with.
3 — Mailboxes on a custom domain with IMAP and SMTP and a webmail; aliases, shared mailboxes, filtering and DKIM or DMARC are basic or not described.
5 — Several custom domains with a documented DNS set-up, aliases and distribution lists, shared or functional mailboxes, IMAP and SMTP plus mobile apps, spam and malware filtering, SPF and DKIM signing, mailbox size per plan stated, server-side rules and out-of-office replies.
8 — Exchange ActiveSync or native Outlook (MAPI) support, DMARC reporting and MTA-STS or DANE, catch-all and plus addressing, delegated access and send-as, quarantine an admin can review, send and attachment limits stated, and the deliverability of the outbound infrastructure documented.
10 — A mail platform a large organisation runs on: every protocol above with feature parity stated per client, inbound and outbound gateways configurable, journaling, DANE and MTA-STS enforced, delivery monitoring and bounce analysis for admins, and mail flow documented end to end.
The Small Firm Owner
Mailboxes sit on our own domain with a.de domain permanently included, up to 25 mailboxes, 250 aliases, DNS settings and multi-stage server-side spam and virus filtering, on a webmail built on Open-Xchange. But we found no public information on IMAP, SMTP, POP3 or ActiveSync for Outlook, on SPF, DKIM and DMARC, distribution lists, shared mailboxes or send limits — for a Kanzlei mailbox that is thin. 1 2 3
The IT Administrator
Mailboxes on a registered own domain with a permanent.de domain included, up to 250 aliases, webmail on an Open-Xchange base and server-side spam and virus protection on every plan, with per-mailbox storage stated per tier. I found no public information on access protocols such as IMAP, POP3 or Exchange ActiveSync for Outlook, nor on SPF, DKIM, DMARC, shared or functional mailboxes, distribution lists, out-of-office replies or send limits — the things I would check first before touching our Exchange estate. 1 2 3
The Public Sector IT Lead
STRATO sells a hosted mailbox on your own domain — a.de domain included permanently — with webmail built on Open-Xchange, up to 250 aliases, and server-side spam and virus filtering on every plan. We found no public information on IMAP, POP3 or ActiveSync, on DKIM, DMARC or MTA-STS, on shared or functional mailboxes, or on send limits and the deliverability of the outbound infrastructure. The mailbox itself looks sound; the protocol and authentication story is not documented. 1 2 3
The IT Service Provider
Mailboxes on the client's own domain are documented: up to 250 aliases, 2 GB to 50 GB per mailbox by plan, webmail on Open-Xchange, and server-side spam and virus filtering included in every plan. We found no public information on IMAP, POP3 or SMTP specifics, SPF, DKIM or DMARC set-up, MTA-STS, shared or functional mailboxes, or send and attachment limits — so the deliverability questions my clients ask on Mondays stay open. 1 2 3
The Data Protection Officer
Mailboxes run on the customer's own domain with a.de domain included, up to 250 aliases (10 per mailbox), an Open-Xchange webmail in every plan, server-side spam and virus filtering before delivery, and synchronisation between smartphone, tablet and PC; storage per mailbox is stated per tier at 2, 5 and 50 GB. We found no public information on named access protocols such as IMAP, POP3, SMTP or ActiveSync, shared or functional mailboxes, distribution lists, SPF, DKIM or DMARC, send limits, or the reputation of the outbound infrastructure. 1 2 3
The Skeptic
Aliases up to 250, registrable domains with DNS settings, server-side antivirus and antispam before delivery, and per-plan mailbox storage of 2, 5 or 50 GB are documented, alongside a webmail built on Open-Xchange and sync to phone, tablet and PC. But the pages never name the protocol behind that sync — we found no public information on IMAP, POP3, Outlook via ActiveSync or MAPI, SPF, DKIM or DMARC, shared mailboxes, distribution lists, server-side rules or out-of-office replies. 1 2 3
Calendar, contacts & office apps
Show reasoningHide reasoning
How this is scored
What the office plans and writes with: shared and team calendars, free/busy lookup, meeting invitations across providers, room and resource booking, shared address books and a company directory, CalDAV and CardDAV or ActiveSync for phones, Outlook calendar sync, tasks, online office documents with co-editing, file storage that comes with the suite, video meetings and chat inside the bundle, and the desktop and mobile apps.
0 — Mail only, with no calendar or contacts of any kind.
3 — A personal calendar and address book in the webmail; sharing, resources, sync protocols and office apps are basic or not described.
5 — Shared calendars and address books, meeting invitations with free/busy lookup, CalDAV and CardDAV or ActiveSync sync to phones and desktop clients, a company-wide address book, tasks, and either online office documents or a documented integration with an office suite.
8 — Room and resource booking with approval, delegated calendar access, Outlook calendar and contacts sync documented, co-editing of documents and spreadsheets in the browser, file storage with sharing, video meetings in the bundle, and apps for desktop, iOS and Android.
10 — A full office suite that replaces Microsoft 365 for a whole organisation: every function above with Microsoft file formats edited without loss, scheduling across organisations, resource planning, offline editing, an accessible interface stated against a standard, and feature parity across web, desktop and mobile documented.
The Small Firm Owner
The webmail is described as collaboration software, premium mailboxes add an external calendar import and a secretary function, and the move to STRATO carries contacts and appointments along. We found no public information on shared team calendars, free/busy lookup, room booking, CalDAV or CardDAV sync, or office documents, file storage and video meetings — our meeting room would still be booked by shouting across the corridor. 1 3
The IT Administrator
The move-over wording confirms appointments and contacts travel with the mail, and premium mailboxes add external calendar import, a secretary function and real-time synchronisation across smartphone, tablet and PC, with task management in the webmail and a small online storage in the business plan. I found no public information on shared or team calendars, free/busy lookup, room and resource booking, CalDAV or CardDAV, or document co-editing — nothing here replaces the Outlook calendar side for three hundred people. 1 2 3
The Public Sector IT Lead
Calendars and contacts exist — the free move to STRATO carries e-mails, contacts and appointments, premium mailboxes import external calendars with a secretary function and real-time sync, and the webmail is a collaboration suite based on Open-Xchange. We found no public information on shared or team calendars, free/busy lookup, room booking, CalDAV or CardDAV, co-editing or video meetings; the Business plan lists one gigabyte of online storage. For a district administration leaving Microsoft this reads as a private mailbox with a calendar, not a suite eleven hundred staff can work in. 1 2 3
The IT Service Provider
The webmail is presented as collaboration software based on Open-Xchange, the optional premium mailboxes add external calendar import, a secretary function and real-time sync, and the free move to STRATO carries contacts and appointments. We found no public information on shared calendars, free/busy lookup, CalDAV or CardDAV, room and resource booking, or online office documents and video meetings; the 1 GB online storage in the Business plan is the only file storage shown. 1 2 3
The Data Protection Officer
Webmail is collaboration software built on Open-Xchange, and the optional premium mailbox adds external calendar import, a secretary function and real-time synchronisation; the free move to STRATO carries e-mails, contacts and appointments, so calendar and address book clearly exist. We found no public information on shared team calendars with free/busy lookup, room and resource booking, CalDAV or CardDAV, tasks, online documents with co-editing, or video meetings. 1 3
The Skeptic
The webmail is described as collaboration software on an Open-Xchange basis, optional premium mailboxes add external calendar import, a secretary function and real-time sync, and the free move to STRATO carries contacts and appointments. We found no public information on shared calendars, free/busy lookup, CalDAV or CardDAV, room booking, co-editing of documents or video meetings, and the storage bundled with the Business plan is 1 GB. 1 3
Security, encryption & compliance archiving
Show reasoningHide reasoning
How this is scored
How mail and documents are protected and kept: TLS enforced in transit, encryption at rest, end-to-end encryption or S/MIME and PGP, who at the provider can read a mailbox, two-factor authentication and passkeys, phishing, malware and account-takeover protection, audit-proof archiving that meets GoBD, retention policies and legal hold, eDiscovery, backups and restore of deleted mail, a transparency report on authority requests, and certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No security information of any kind; no encryption, two-factor sign-in or archiving stated.
3 — Encrypted connections and a password login; encryption at rest, two-factor sign-in, archiving and certifications are basic or not described.
5 — TLS in transit and encryption at rest stated, two-factor authentication, spam, phishing and malware protection, restore of deleted mail for a stated period, archiving offered (built in or as an add-on), and a certification such as ISO 27001 stated for the data centres or the service.
8 — End-to-end encryption, S/MIME or PGP supported, GoBD-compliant archiving documented, retention policies and legal hold, enforced two-factor or passkeys for all users, a transparency report on authority requests, and certifications such as ISO 27001 or BSI C5 published with their scope and auditor.
10 — Security that holds up in an audit of a regulated organisation: zero-access or customer-held keys where the provider cannot read mail, eDiscovery, tamper-proof archive with documented verification, every certification published with its report or attestation available, independent security audits or open-source code reviewed, and incident disclosure documented.
The Small Firm Owner
The strongest part for a tax firm: archiving is stated GoBD- and EU-DSGVO-conform with an IDW PS 880 software attestation, the security architecture is certified yearly to ISO 27001 by TÜV, and there is SSL-encrypted mail traffic, two-factor authentication and server-side spam, phishing and malware protection. We found no public information on encryption at rest, S/MIME or PGP, legal hold and retention policies, or a transparency report on authority requests. 1 3 4 6
The IT Administrator
This is the strongest area: SSL-encrypted mail traffic, two-factor authentication, a yearly ISO 27001 certification by TÜV, and an optional archive documented as GoBD and EU-DSGVO conform with an IDW PS 880 software certificate and revision-safe storage orderable in the customer login. I found no public information on encryption at rest, S/MIME or PGP, retention policies and legal hold, eDiscovery, restore of deleted mail, or a transparency report, and the certification's scope is not detailed. 3 4 6 8
The Public Sector IT Lead
The documented base is real: SSL-encrypted mail traffic, two-factor sign-in, spam and virus filtering before delivery, and a security architecture certified yearly to ISO 27001 by TÜV. Archiving is the strongest part — revision-safe, GoBD- and EU-DSGVO-conform, with an IDW PS 880 software attestation, though the archive does not preserve folder structure. We found no public information on encryption at rest, S/MIME or PGP, restore periods for deleted mail, retention policies and legal hold, or a transparency report on authority requests. 3 4 6
The IT Service Provider
Documented are SSL-encrypted mail traffic, two-factor sign-in, spam and virus protection in every plan, and a security architecture certified yearly to ISO 27001 by TÜV, plus an archiving add-on described as GoBD-conform with an IDW PS 880 software attestation. We found no public information on encryption at rest, S/MIME or PGP, a stated restore period for deleted mail, retention policies with legal hold, or a transparency report on authority requests. 3 4 6 8
The Data Protection Officer
Transport to the mail server is SSL-encrypted, two-factor authentication exists, the security architecture is certified yearly to ISO 27001 by TÜV, and the optional archiving is stated conform to GoBD and EU-DSGVO with an IDW PS 880 software attestation — genuinely usable for the four-year retention a practice owes the tax office, though the captured pages note the folder structure is not carried into the archive. We found no public information on encryption at rest, S/MIME or PGP for correspondence with outside doctors, who at the provider can open a mailbox, restore of deleted mail, retention policies with legal hold, or a transparency report on authority requests. 1 3 4 6 8
The Skeptic
ISO 27001 recertified yearly by TÜV, SSL-encrypted mail traffic, two-factor sign-in and multistage spam and virus filtering are stated, and the archiving add-on is sold as GoBD-conform with an IDW PS 880 software certificate. We found no public information on encryption at rest, S/MIME or PGP, a restore period for deleted mail or a transparency report — and the vendor's own archiving page states the folder structure is not carried over into the archive, which a tax auditor will notice. 3 4 6 8
Administration, identity & partner management
Show reasoningHide reasoning
How this is scored
How an IT team or an IT service provider runs it: an admin console for users, groups, mailboxes and domains, admin roles, single sign-on (SAML or OpenID Connect), sync with Active Directory, Entra ID or LDAP, SCIM provisioning, mobile device policies and remote wipe, audit logs of admin and user actions, usage reports, a documented API for provisioning, multi-tenant or reseller accounts for partners managing several customers, and the support channels and response times per plan.
0 — No administration; one login per mailbox and nothing managed centrally.
3 — A web console to add mailboxes and aliases; roles, single sign-on, directory sync and audit logs are basic or not described.
5 — An admin console for users, groups, mailboxes and domains, admin roles, two-factor sign-in enforceable by the admin, password policies, a documented API or command line for provisioning, an activity or audit log, and business support by phone or ticket stated per plan.
8 — Single sign-on (SAML or OpenID Connect), Active Directory, Entra ID or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, audit logs exportable, delegated administration, partner or reseller accounts that manage several customer organisations, and support response times stated.
10 — Administration that scales across many organisations: every setting reachable by API with parity stated, granular role scopes, policies by group, logs streamed to a SIEM, white-label partner offerings with separate billing, and an SLA with service credits published.
The Small Firm Owner
There is flexible online administration of the mail account through webmail, a customer login where archiving is orderable with one click, and a service hotline at local rate plus an optional paid 24/7 line. We found no public information on an admin console for the whole firm, admin roles, single sign-on, directory sync, audit logs, mobile device policies or a provisioning API. 2 4 6
The IT Administrator
Documented administration amounts to online management of the account in webmail with mailboxes expandable at any time, two-factor authentication and password protection, and telephone support with an optional paid 24/7 hotline at a published number. I found no public information on single sign-on, Active Directory or LDAP synchronisation, SCIM provisioning, mobile device policies with remote wipe, admin audit logs or a provisioning API — with Active Directory as our source of truth, none of my daily tooling is addressed. 2 6 7
The Public Sector IT Lead
Everything documented is self-service: a customer login where the archiving add-on is ordered with one click, online management of the account through webmail, mailboxes expandable at any time, and a service hotline at local rates with an optional paid 24/7 line. We found no public information on an admin console with roles, single sign-on, directory sync with Active Directory or LDAP, SCIM provisioning, mobile device policies with remote wipe, audit logs or a provisioning API. My team cannot administer eleven hundred mailboxes through a consumer-style login. 2 4 6
The IT Service Provider
What is documented is online administration of the account, archiving orderable in the customer login, and a service hotline at local rate with an optional paid 24/7 line. We found no public information on admin roles, single sign-on, directory synchronisation, a provisioning API, audit logs, delegated or partner administration for several customers, or stated response times — nothing here supports running forty client firms from one console. 2 4
The Data Protection Officer
What is documented is online self-management of the e-mail account in webmail, password protection, two-factor sign-in, and a service hotline at local rates with an optional paid 24/7 line. We found no public information on a central admin console for users, groups, mailboxes and domains, admin roles, single sign-on, directory synchronisation, a provisioning API, audit logs, or partner accounts for an IT service provider looking after several practices. 2 6
The Skeptic
What the pages document is online management of the email account, DNS settings and DynDNS, and a service hotline at local rate with an optional paid 24/7 hotline. We found no public information on an admin console for users, groups and domains, admin roles, single sign-on, directory sync, audit logs, a provisioning API or partner and reseller accounts. 2 6
Migration, open standards & exit
Show reasoningHide reasoning
How this is scored
How the organisation gets in and out: migration from Exchange, Microsoft 365, Google Workspace or another IMAP provider with a documented tool or service, mail, calendars and contacts carried over, coexistence during a move, standard protocols (IMAP, CalDAV, CardDAV, JMAP, open document formats) rather than proprietary ones, export of a mailbox and of the whole organisation in standard formats (mbox, EML, PST, ICS, vCard), open-source code or a self-hosted edition, what happens to data when the contract ends, and how domains and DNS are handed back.
0 — No way to bring mail in or take it out; a proprietary store with no IMAP access or export.
3 — IMAP access to mail; a migration path, calendar and contacts export and the end-of-contract handling are basic or not described.
5 — A documented migration from Exchange, Microsoft 365 or Google (a tool, an import or a service), mail, calendars and contacts imported, IMAP, CalDAV and CardDAV or ActiveSync access, export of mail, calendars and contacts in standard formats, and the deletion of data after the contract ends stated.
8 — A migration service or tool that moves whole organisations with calendars and permissions, coexistence with free/busy during the move, open document formats supported natively, export of the whole organisation by the admin, an open-source code base or a self-hosted edition, and a data return period after cancellation stated.
10 — An exit that costs nothing but time: every record exportable in open formats with the method documented, a self-hosted open-source edition with feature parity stated, migration in and out documented with the same tools, and a contractual data return and deletion with confirmation.
The Small Firm Owner
The move to STRATO with emails, contacts and appointments is explicitly free of charge, which is exactly the client-thread continuity I need on paper. We found no public information on which source providers the migration serves, export of mail, calendars and contacts in standard formats, standard protocols for taking data out, or what happens to the data when the contract ends. 1
The IT Administrator
A free move that carries e-mails, contacts and appointments is documented, which is a start. I found no public information on a documented migration from Exchange or Microsoft 365, on permissions or coexistence during a move, on export in standard formats such as mbox or PST, or on data return and deletion after the contract ends; the archiving pages also state that the folder structure is not taken over into the e-mail archive. 1 4
The Public Sector IT Lead
Migration in is free and carries e-mails, contacts and appointments, which is more than nothing. We found no public information on the tool used, the source systems supported, coexistence during a move, export of mail, calendars or contacts in standard formats, or open protocols such as CalDAV and CardDAV. The only exit-relevant fact is a twelve-month minimum term with automatic renewal and a notice period — no data return or deletion after the contract is documented, and I need an exit plan before signing anything. 1 2
The IT Service Provider
The move in is documented and free, carrying e-mail, contacts and appointments, which is more than a bare protocol pointer. We found no public information on which source systems are covered, coexistence during a move, export of a mailbox or a whole organisation in standard formats, or what happens to the data when the contract ends; the terms shown are a 12-month minimum with automatic renewal and a notice period. 1 2
The Data Protection Officer
The way in is documented and free: mail, contacts and appointments are moved to STRATO at no cost, with device synchronisation mentioned alongside. We found no public information on standard protocols and export formats for taking data out again, tools for migrating whole organisations with permissions, or the handling of mail data and domains when the contract ends. 1 2
The Skeptic
The move in is documented as free and covers emails, contacts and appointments. We found no public information on the tool used or the source systems it migrates from, on export of mail, calendars and contacts in standard formats, on an open-source or self-hosted edition, or on what happens to the data when the contract ends. 1 2
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where mailboxes, calendars, contacts, documents and backups are stored and processed, who at the provider or its subprocessors can access them, and who the subprocessors are (data centres, spam filtering, support, payment, AI features). Independently sourced by the sovereignty pipeline. An EU data region offered by a non-EU parent is part of the chain, not the whole of it. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (spam filtering, support, backups, AI features) run through non-EU providers or a non-EU parent without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated — or a self-hosted edition documented that keeps every mailbox on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Small Firm Owner
The captured pages state 'Hosted in Germany' and 'E-Mail made in Germany TÜV geprüft', the contracting entity is STRATO GmbH in Berlin with commercial register and VAT ID, a data processing agreement is available, and ISO 27001 certification by TÜV is published. The privacy policy however permits transfers of personal data outside the EU with safeguards and names marketing partners such as Meta, Google and TikTok for hashed audience data, and we found no public information on named data centres or the locations of subprocessors in the mail chain. 2 6 7 8
The IT Administrator
STRATO GmbH in Berlin is the named entity, hosting is stated as "Hosted in Germany" with a security architecture certified yearly to ISO 27001 by TÜV, a data processing agreement is available, and the processor role under GDPR plus a data protection officer are published. The chain is not fully documented: I found no public information on the named data-centre infrastructure or a subprocessor list with locations, the privacy policy states personal data may be transferred outside the EU and EEA with appropriate safeguards, and hashed data is shared with advertising partners including Meta, LinkedIn, TikTok, Reddit and Google. 3 6 7 8
The Public Sector IT Lead
The contracting entity is STRATO GmbH in Berlin with register number HRB 270570 B, the group is German under IONOS and United Internet, hosting is stated as in Germany ("E-Mail made in Germany, TÜV geprüft"), a data processing agreement is available, and the security architecture is certified to ISO 27001 yearly. Two things hold me back from higher: the privacy notice reserves transfers of personal data outside the EU with safeguards, and hashed marketing data goes to Meta, LinkedIn, TikTok, Reddit and Google Custom Audiences, while subprocessor locations are not listed. We found no public information on BSI C5. 2 3 6 7 8
The IT Service Provider
The pages show a German contracting entity, STRATO GmbH in Berlin, with a data protection officer in Berlin, mail 'Hosted in Germany' and 'E-Mail made in Germany TÜV geprüft', a data processing agreement available, and ISO 27001 certification, within a German group (IONOS SE, United Internet). The chain beyond that is undocumented: no named data-centre operator or locations for the mail service and no subprocessor register; the privacy notice states personal data may be transferred outside the EU, and that hashed data goes to marketing services including Meta, LinkedIn, TikTok, Reddit and Google Customer Match. 2 6 7 8
The Data Protection Officer
Hosting is stated as in Germany, the contracting entity is STRATO GmbH in Berlin with a German commercial register entry, a data processing agreement is available, the privacy notice names a data protection officer, and ISO 27001 is certified — the head of the chain is European and documented. The same notice discloses transfers of personal data outside the EU/EEA with safeguards and sharing of SHA-256-hashed data with Meta, Google, TikTok, LinkedIn and Reddit for marketing; we found no public information on the named data centres, a subprocessor list with locations for the mail chain itself, or who at the provider can access a mailbox. 3 6 7 8
The Skeptic
'Hosted in Germany' and 'E-Mail made in Germany' apply to the mail product, and the contracting entity is STRATO GmbH in Berlin with a published data processing agreement and yearly TÜV-certified ISO 27001. But the data centres behind the mail service are not named, no subprocessors for the mail chain are listed with their locations, and the privacy policy both reserves transfers of personal data outside the EU/EEA and names Meta, LinkedIn, TikTok, Reddit and Google as marketing partners receiving hashed data. 2 6 7 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or mailbox per tier, storage per user, what shared mailboxes, aliases and extra domains cost, which features (archiving, office apps, SSO, advanced security, more storage) cost extra, the first-year discount and the regular price after it, minimum users and term, monthly versus annual billing, and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price per user exists, but how cost scales with storage, users, add-ons or after the first year is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (archiving, extra storage, shared mailboxes, SSO, the price after the introductory period) is unpriced or "on request".
8 — Every tier priced publicly per user with storage, add-ons priced, the regular price after any introductory discount stated, minimum users and term stated, monthly and annual billing compared, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of users, storage and add-ons, with every support, migration and archive fee and the cancellation and data-return terms published.
The Small Firm Owner
Starter, Basic and Plus are publicly priced with mailbox counts and storage — Plus with 25 mailboxes at 5 GB each is '1 €/Mon. für 12 Monate danach 5 €/Mon.' — setup is 0 €, prices include VAT, the 12-month minimum term with automatic one-year renewal is explained, and archiving costs '2,50 € monatlich' plus '0,50 €/Monat' per further GB. We found no public information on the Business plan's regular price or the cost of the optional premium mailboxes, so the second-year bill for twelve staff is not fully computable. 1 2 3
The IT Administrator
Starter at 1 €/Mon. after a free first month, Basic with five mailboxes at 2 €/Mon. and Plus with twenty-five mailboxes at 1 €/Mon. for twelve months then 5 €/Mon. are public, with 0 € setup, storage per mailbox per tier, VAT included, a minimum term of usually twelve months with automatic yearly renewal, and archiving at 2,50 € monatlich including 5 GB plus 0,50 €/Monat for each further GB. I found no public information on the price of the business tier itself or of the optional premium mailboxes, the premium virus scanner and the paid 24/7 hotline, and monthly versus annual billing is not compared — so I cannot compute a full annual cost for my seat count. 1 2 3
The Public Sector IT Lead
Starter, Basic and Plus are priced openly — Plus at 1 €/Mon. for 12 months then 5 €/Mon., zero setup, VAT included — with the twelve-month term and auto-renewal documented, and the archiving add-on at 2,50 € monthly with 5 GB included and 0,50 € per further GB. The Business tier shows only a 48 € saving in the first year without a regular monthly price, premium mailboxes are marked optional with no price, and we found no public information on the cost of additional mailboxes or on monthly versus annual billing. I can cost a pilot, not a full administration. 1 2 3
The IT Service Provider
Tiers, storage and follow-on prices are public: Basic free for the first month then 2 €/Mon., Mail Plus at 1 €/Mon. for 12 months then 5 €/Mon., set-up 0 €, prices including VAT, on a 12-month minimum term with automatic renewal; the archiving add-on is priced at 2,50 € monthly with 5 GB included and 0,50 € per further GB monthly. The optional premium mailboxes, premium virus scanner and Webmail AI are shown as optional without prices, and the Business plan appears with a first-year saving of 48 € rather than a monthly figure in what we read. Monthly versus annual billing is not compared, so my margin calculation before quoting still has open items. 1 2 3
The Data Protection Officer
Starter, Basic and Plus are published with mailbox counts, storage, introductory and regular prices (Starter afterwards 1 €/Mon., Basic afterwards 2 €/Mon., Plus 1 €/Mon. for 12 Monate danach 5 €/Mon.), archiving is priced at 2,50 € monthly with 5 GB included and 0,50 € for each further GB per month, prices include VAT, and the twelve-month minimum term with automatic renewal is stated. Premium mailboxes, the premium virus scanner, the webmail AI and the 24/7 hotline are marked optional or paid without a price on the captured pages, and we found no public information on the price of the Business tier. 1 2 3
The Skeptic
Starter, Basic and Plus are priced with mailbox count, storage, the introductory price and the price after it ('1 €/Mon. für 12 Monate danach 5 €/Mon.' on Plus), with VAT included and a twelve-month minimum term stated, and archiving is priced at '2,50 € monatlich' plus '0,50 €/Monat' per further GB. The Business tier's regular price never appears as a figure on the pages we read, and the optional premium mailboxes, the optional Webmail AI and the paid 24/7 hotline carry no price at all. 1 2 3
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about STRATO Mail
Is STRATO Mail European?
Yes. whats-best.ai classifies STRATO Mail as EU-Made.
Where does STRATO Mail store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does STRATO Mail have a free plan?
Yes. STRATO Mail has a free plan, per the vendor’s page captured 5 Nov 2026.
What are the best alternatives to STRATO Mail?
As of 6 Nov 2026, the panel rates grommunio (3.5/5), Infomaniak kSuite (3.5/5) and Nextcloud Hub (Groupware & Office) (3.5/5) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is grommunio (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: STRATO Mail alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location, Hosting options, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 44 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (8)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (mail, with pricing) www.strato.de Checked 5 Nov 2026 Details →
- 2 Features page (own domain address) www.strato.de Checked 5 Nov 2026 Details →
- 3 Features page (mail server) www.strato.de Checked 5 Nov 2026 Details →
- 4 Features page (email archiving) www.strato.de Checked 5 Nov 2026 Details →
- 5 Documentation (help centre) www.strato.de Checked 5 Nov 2026 Details →
- 6 Security / trust page www.strato.de Checked 5 Nov 2026 Details →
- 7 Legal notice www.strato.de Checked 5 Nov 2026 Details →
- 8 Privacy policy www.strato.de Checked 5 Nov 2026 Details →