# STRATO Mail — Business Email & Office Suites

STRATO Mail by STRATO GmbH holds a panel rating of 2/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: EU-Made; sovereignty: not determined.

- Vendor: STRATO GmbH (https://www.strato.de/mail/)
- Category: [Business Email & Office Suites](https://whats-best.ai/software/business-email.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/business-email/strato-mail
- Alternatives: https://whats-best.ai/software/business-email/strato-mail/alternatives ([markdown](https://whats-best.ai/software/business-email/strato-mail/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: STRATO GmbH
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Yes, per the vendor’s own page [S1]

## The panel's verdict

STRATO Mail is a hosted German business e-mail product — webmail on Open-Xchange, mailboxes on your own.de domain, up to 250 aliases, server-side spam and virus filtering — and the judges' persona-weighted totals cluster at 4.2–4.6. It is strongest on pricing transparency, the only criterion scored a single value of 6, and on security and compliance, where yearly TÜV-certified ISO 27001, two-factor sign-in and a GoBD- and EU-DSGVO-conform archiving add-on with an IDW PS 880 attestation are documented. Sovereignty drew the bench's highest single mark, 7: STRATO GmbH in Berlin is the contracting entity, hosting is stated as "Hosted in Germany" and a data processing agreement is published — yet the privacy policy permits transfers outside the EU/EEA, shares SHA-256-hashed marketing data with Meta, LinkedIn, TikTok, Reddit and Google, and we found no public information on data centres or subprocessor locations. Administration and identity is weakest at 2–3, with only self-service webmail administration documented. Mail, calendar and migration sit at 3–4 with no published access protocols, shared calendars or export path, and no material disagreement was computed between the judges.

**Speaks for it:**
- Optional archiving add-on stated GoBD- and EU-DSGVO-conform with an IDW PS 880 software attestation, priced at "2,50 € monatlich" plus "0,50 €/Monat" per further GB.
- Security architecture certified yearly to ISO 27001 by TÜV, with SSL-encrypted mail traffic and two-factor sign-in documented.
- Starter, Basic and Plus prices are published with setup at 0 € and VAT included (Plus: "1 €/Mon. für 12 Monate danach 5 €/Mon.").
- The move to STRATO is documented as free of charge and carries e-mails, contacts and appointments.
- The contracting entity is STRATO GmbH in Berlin (HRB 270570 B) with a published data processing agreement and hosting stated as "Hosted in Germany".

**Held against it:**
- Administration and identity scored 2–3, with only self-service webmail administration documented and we found no public information on an admin console, admin roles, single sign-on, directory sync or a provisioning API.
- Mail and deliverability scored 3–4, and we found no public information on IMAP, POP3 or ActiveSync, or on SPF, DKIM or DMARC.
- Migration and portability scored 3–4, with we found no public information on export of mail, calendars or contacts in standard formats or on data handling when the contract ends.
- The privacy policy permits transfers of personal data outside the EU/EEA and names Meta, LinkedIn, TikTok, Reddit and Google as marketing partners receiving SHA-256-hashed data, while we found no public information on data centres or subprocessor locations for the mail service.
- The Business tier is shown with a first-year saving of 48 € rather than a monthly price, and the optional premium mailboxes, Webmail AI and paid 24/7 hotline carry no price on the captured pages.

**Best for:**
- You need a small fleet of up to 25 mailboxes on your own.de domain with 250 aliases and publicly priced tiers.
- Your firm must archive business e-mail in a GoBD- and EU-DSGVO-conform way with an IDW PS 880 attestation for the stated four-year retention.
- You want a German contracting entity with a published data processing agreement and a security architecture certified yearly to ISO 27001 by TÜV.

**Avoid if:**
- Your team administers hundreds of mailboxes centrally: administration and identity scored 2–3, only self-service webmail management is documented, and we found no public information on single sign-on, directory sync, admin roles or a provisioning API.
- You are leaving Microsoft 365 or Exchange — ask the vendor: the public pages we read do not show it
- You must know your full processor chain — ask the vendor: the public pages we read do not show it
- You need a documented exit — ask the vendor: the public pages we read do not show it

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Small Firm Owner | The IT Administrator | The Public Sector IT Lead | The IT Service Provider | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Mail, domains & deliverability | 2/5 | 2/5 | 1.5/5 | 2/5 | 2/5 | 2/5 |
| Calendar, contacts & office apps | 1.5/5 | 2/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 |
| Security, encryption & compliance archiving | 3/5 | 3/5 | 2.5/5 | 3/5 | 2.5/5 | 2.5/5 |
| Administration, identity & partner management | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1/5 |
| Migration, open standards & exit | 2/5 | 2/5 | 1.5/5 | 2/5 | 2/5 | 1.5/5 |
| European sovereignty | 3/5 | 3/5 | 3.5/5 | 2.5/5 | 3/5 | 3/5 |
| Pricing transparency | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| **Weighted verdict** | **2.5/5** | **2/5** | **2/5** | **2/5** | **2.5/5** | **2/5** |

### The judges

- **The Small Firm Owner** (v1.0): Runs a tax and accounting firm of twelve in Lower Saxony. Every member of staff lives in Outlook, the shared "kanzlei@" mailbox is the busiest address in the office, and the meeting room is booked by shouting across the corridor. Wants mail on the firm's own domain that arrives, a shared calendar and address book on every phone, a move from the old provider that does not lose a single client thread, and a per-user price that is still the price in the second year.
- **The IT Administrator** (v1.0): IT administrator at a machine builder in Baden-Württemberg with three hundred mailboxes, an on-premises Exchange that reaches end of support, and Active Directory as the source of every account. Wants Outlook to keep working without a plug-in nobody maintains, shared mailboxes and room booking, single sign-on and directory sync, mobile devices that can be wiped, an API for provisioning, and a migration that moves calendars and permissions, not only mail.
- **The Public Sector IT Lead** (v1.0): Head of IT at a district administration in Bavaria with eleven hundred staff, told by the council to leave Microsoft within three years. Has read what Schleswig-Holstein did and what it cost. Needs mail, calendars and documents that a whole administration can work in, open formats and open source where possible, BSI C5 or ISO 27001 on paper, a provider whose owners answer to European law only, and an exit plan before the contract is signed.
- **The IT Service Provider** (v1.0): Runs a six-person IT service company in Austria that looks after mail for forty client firms, from a two-person architect's office to a hotel group. Spends Mondays on mails that landed in spam and phones that stopped syncing. Wants one partner console for every client, DKIM and DMARC set up without a ticket, migrations it can run itself, support that answers within the hour, and margins it can calculate before it quotes.
- **The Data Protection Officer** (v1.0): Data protection officer for a group of nine medical practices in North Rhine-Westphalia, where a referral letter sent by mail is patient data under professional secrecy. Reads the subprocessor list and the transparency report before the feature page, asks who at the provider can open a mailbox and under which law, and wants encryption the practices can actually use with outside doctors, archiving that satisfies the tax office, and a data processing agreement that names every server.
- **The Skeptic** (v1.0): Has seen "hosted in Germany" from a provider whose spam filter and support desk sit in the United States, "Exchange-compatible" that meant IMAP with a calendar plug-in, and a first-year price of one euro that became seven. Asks which protocols Outlook really uses, whether the archive would survive a tax audit, what the certification actually covers — and how ten years of mail, calendars and contacts would leave.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Automated decision making: no [S8]
- Cookie policy: Cookie policy referenced separately [S8]
- DPA: Auftragsverarbeitungsvereinbarung verfügbar [S8]
- GDPR: yes [S6]
- Gobd: yes · yes [S4]
- Idw ps880: Softwarebescheinigung · IDW PS 880 [S4]
- Idw ps880: yes [S1]
- ISO 27001: yes · ISO 27001 · yes · TÜV [S3]
- Made in germany: yes · yes [S2]
- Privacy policy version: 30.09.2025 [S8]
- Processor role: STRATO acts as processor under Art. 4 No. 8 GDPR when providing products and services [S8]
- Security measures: Appropriate security measures against loss, misuse, unauthorized access, disclosure, alteration or destruction [S8]
- Ssl encryption: yes [S3]

**Data**
- Marketing hashing: Data shared with marketing partners is hashed with SHA 256 before transmission [S8]
- Retention logs: 90 [S8]

**Hosting**
- Germany: yes [S6]
- International transfer: Personal data may be transferred outside EU/EEA with appropriate safeguards [S8]
- Vserver locations: V-Server · Deutschland · Spanien · Frankreich · yes [S6]

**Legal**
- Accessibility statement: https://www.strato.de/accessibilityact/ [S7]
- Address: Berlin · Otto-Ostrowski-Straße 7 · Germany · 10249 [S7]
- Company name: STRATO GmbH [S7]
- Controller: datenschutz@strato.de · Otto-Ostrowski-Straße 7, 10249 Berlin, Deutschland · STRATO GmbH [S8]
- Dispute resolution: Entscheidung über Teilnahme von Fall zu Fall [S7]
- Dsa notice action: https://www.strato.de/faq/help/mail.php?thema=1181 [S7]
- Entity: STRATO GmbH [S6]
- Entity: STRATO GmbH [S1]
- Entity: 2026 · STRATO GmbH [S2]
- Group affiliation: Data exchange may occur with affiliated companies of IONOS Group SE or United Internet AG [S8]
- International sites: strato.nl · strato.es · strato-hosting.co.uk · strato.fr · strato.se [S7]
- It recht kanzlei: IT-Recht Kanzlei · AGB · Widerrufsbelehrung · Datenschutzerklärung · Impressum [S6]
- It recht kanzlei updates: yes [S6]
- Management: Dr. Jens Reich · Hüseyin Dogan · Dr. Markus Leander Noga · Patrik Heider [S7]
- Nis2 authority requests: Dedicated contact address for authority information requests under NIS-2 § 50 [S7]
- Register: Berlin-Charlottenburg HRB 270570 B [S7]
- VAT id: DE 211 045 709 [S7]
- Whistleblowing: United Internet AG · United Internet Integrity Line [S7]

**Pricing**
- Basic: 5 · 0 · 2 · 2 · yes [S1]
- Basic: 0 · 2 · 1 [S3]
- Basic intro price2: 0 · 0 · 5 · 8 · 1 · 2 [S2]
- Business savings first year: 48 [S2]
- Contract term: yes · meist ein weiteres Jahr · 12 · yes [S2]
- Plus: 25 · 0 · 5 · 5 · 1 [S1]
- Plus: 0 · 5 · 12 · 1 [S3]
- Plus intro price: 0 · 25 · 80 · 1 · 12 · 5 · 5 [S2]
- Starter: 1 · 0 · 2 · 1 · yes [S1]
- VAT included: yes [S1]
- VAT included: yes [S3]
- VAT included: yes [S2]

**Product**
- Ad free: 100 [S2]
- Advantages: werbefrei; Wunsch-Domains registrierbar; .de-Domain dauerhaft inklusive; großzügiger Mail-Speicherplatz; Synchronisation Smartphone/Tablet/PC; Webmail; DynDNS und DNS-Einstellungen [S2]
- AI phone assistant: AI phone assistant collects voice data during calls, used with customer consent [S8]
- Antispam: yes [S1]
- Antivirus antispam: yes · yes [S3]
- Backupcontrol: STRATO BackupControl · yes [S6]
- Business mailboxes: 50 · 10 [S2]
- Cyber protect: Cyber Protect · Anti-Malware · Backup · yes [S6]
- Domain included: .de [S3]
- Erechnung: ZUGFeRD · X-Rechnung [S1]
- Feature antispam: yes · yes · yes [S2]
- Feature basic mailboxes: 25 (jederzeit erweiterbar) · 5 (jederzeit erweiterbar) · Nicht vorhanden [S2]
- Feature premium mailboxes: optional · optional · optional [S2]
- Feature premium virenscanner: optional · optional · yes [S2]
- Feature storage: 5 · 2 · 50 [S2]
- Feature virenscanner: yes · yes · yes [S2]
- Folder structure: yes · yes · no [S4]
- Included de domain: yes · yes [S2]
- Mail archiving: optional · EU-DSGVO · GoBD [S3]
- Mail archiving price2: 5 · 2.5 · 0.5 [S2]
- Mailbox count: 25 [S3]
- Marketing ml: Machine learning used to compute individual product recommendations [S8]
- Migration free: yes [S1]
- Online storage 1gb business: Business · 1 [S1]
- Password protection: yes [S6]
- Plus first year price: Mail Plus · 25 · 1 · 5 [S2]
- Premium mailboxes: external calendar import · secretary function · real-time sync · optional [S3]
- Premium mailboxes optional: yes [S1]
- Premium virus scanner: yes · yes [S1]
- Retention requirement: 4 [S4]
- Revisionssicherheit: yes · yes [S4]
- Serverside security: ServerSide Security gegen Spam und Viren, serverseitig vor Zustellung [S2]
- Sitelock: SiteLock Scan + Repair · yes [S6]
- Spamfilter: yes · yes [S6]
- Ssl certificates: Sectigo · yes [S6]
- Two factor auth: yes [S6]
- Virus scanner: yes [S1]
- Webmail: Open-Xchange · yes [S3]
- Webmail ki: yes [S1]

**Subprocessors**
- Marketing audiences: Meta Custom Audiences · LinkedIn Matched Audiences · TikTok Custom Audiences · Reddit Custom Audiences · Google Customer Match [S8]

**Support**
- Hotline options: Ortstarif · yes · yes [S2]

## Questions

### Is STRATO Mail European?

Yes. whats-best.ai classifies STRATO Mail as EU-Made.

### Where does STRATO Mail store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does STRATO Mail have a free plan?

Yes. STRATO Mail has a free plan, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/18309).

### What are the best alternatives to STRATO Mail?

As of 6 Nov 2026, the panel rates [grommunio (3.5/5)](https://whats-best.ai/software/business-email/grommunio), [Infomaniak kSuite (3.5/5)](https://whats-best.ai/software/business-email/infomaniak-ksuite) and [Nextcloud Hub (Groupware & Office) (3.5/5)](https://whats-best.ai/software/business-email/nextcloud-hub) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [grommunio](https://whats-best.ai/software/business-email/grommunio) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [STRATO Mail alternatives](https://whats-best.ai/software/business-email/strato-mail/alternatives).

## What this page leaves out

- 44 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage (mail, with pricing): https://www.strato.de/mail/ (checked 2026-11-05)
- [S2] Features page (own domain address): https://www.strato.de/mail/e-mail-adresse-erstellen/ (checked 2026-11-05)
- [S3] Features page (mail server): https://www.strato.de/mail/mail-server/ (checked 2026-11-05)
- [S4] Features page (email archiving): https://www.strato.de/mail-archivierung/ (checked 2026-11-05)
- [S5] Documentation (help centre): https://www.strato.de/faq/path/163/E-Mail.html/ (checked 2026-11-05)
- [S6] Security / trust page: https://www.strato.de/sicherheit/ (checked 2026-11-05)
- [S7] Legal notice: https://www.strato.de/impressum/ (checked 2026-11-05)
- [S8] Privacy policy: https://www.strato.de/datenschutz/ (checked 2026-11-05)

---

Cite as: whats-best.ai, "STRATO Mail — Business Email & Office Suites", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-email/strato-mail

Corrections: https://whats-best.ai/correct/1548?target=page