mailbox.org (rebranded "mailbox" in 2025) is a paid, ad-free email, calendar, Drive and office service launched in 2014 by Heinlein Hosting GmbH, a Berlin company led by founder and CEO Peer Heinlein and part of the Heinlein Group; servers are stated to be located exclusively in Berlin data centres. Its GDPR data-protection notice publishes a per-system table of what is logged and for how long (login IPs 4 days, SMTP sender/recipient/message-ID metadata 7 days, no message content logged, customer records erased four weeks after contract end), states that sharing personal data with third parties is excluded, and describes a self-hosted, cookieless Matomo instance with anonymised IPs instead of Google Analytics. Registration accepts an unverified pseudonym and cash-by-post payment, though card and PayPal payments go through Adyen and PayPal. Mail is not end-to-end encrypted by default: the optional mailbox Guard performs PGP server-side with a user-password-protected key, the opt-in "encrypted mailbox" encrypts incoming mail at rest but not the Sent folder, and stored plaintext mail is subject to German court orders. Heinlein publishes annual transparency reports with request counts back to 2014 (74 authority requests in 2025, 56 answered, two mailbox seizures, zero interceptions), holds a BSI C5 Type 1 attestation and ISO/IEC 27001 certification (announced January 2026) plus the BSI IT security label, and no customer-data breach was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
15 ON FILE
COLLECTION
mailbox's knowledge base states that although a first and last name is required to open an account, the information is not verified at any point, so any pseudonym may be used, and that combined with Tor and the Tor access operated by mailbox a user can remain completely anonymous.
The knowledge-base article on the encrypted mailbox states that PGP encryption of incoming mail is an opt-in setting the user must activate (a server-side Sieve rule then encrypts new incoming messages with the user's public key), that existing mails are unaffected, and that mails in the Sent folder are currently not stored in encrypted form — so mailbox is not end-to-end or at-rest encrypted by default.
Heinlein Hosting's data-protection notice (as of 27 January 2026) publishes a per-system retention table: web-portal and IMAP/webmail login IP addresses are erased after 4 days, SMTP logs of sender, recipient, message ID and size after 7 days with no message content or subject stored, customer records (first/last name, email address, optional address and phone, bank data if direct debit) are erased four weeks after the end of the contract, and mobile numbers for password reset are stored only as a hash.
mailbox's about page states it stands on the Heinlein Group — Heinlein Support, with more than 150 permanent employees, a German Linux/email specialist — traces its history from the JPBerlin youth project (1989) through Heinlein Professional Linux Support GmbH (2004) to the 2014 launch of mailbox.org after the Snowden revelations under CEO Peer Heinlein, and says it supports Digitalcourage e.V., the Tor network and FSFE.
mailbox.org's legal notice identifies the operator as Heinlein Hosting GmbH, Schwedter Straße 8/9A, 10119 Berlin, Chief Executive Officer Peer Heinlein, registered at the District Court of Berlin-Charlottenburg under HRB 220010 B, with tax number and EU VAT ID DE335125423, and publishes PGP key fingerprints for data-protection and authority enquiries.
mailbox's knowledge base explains that the optional mailbox Guard stores the user's PGP private key on mailbox's servers encrypted with a password known only to the user; on login the key is decrypted server-side and re-encrypted with a per-session temporary key, and mailbox states neither the password nor the key is ever stored permanently in plaintext — a server-side design in which decryption happens on the provider's infrastructure rather than only on the client.
mailbox's payment article states that credit-card payments are processed via the payment service provider Adyen and that PayPal is accepted, alongside bank transfer, SEPA direct debit, cash sent by post and cash deposit to a bank account; it notes users who prefer to remain anonymous can skip login-recovery setup, at the cost of no password-recovery assistance.
The data-protection notice's section on marketing, market research and third parties states that stored data is used exclusively for the stated purposes, will not be used for other purposes, evaluated or shared, and that sharing personal data with third parties is excluded; separately it discloses that bank data or transfer IDs are stored when direct debit or external payment services are used.
mailbox's Transparency Report 2025 (published 10 February 2026) states it received 74 authority requests in 2025 (70 German, 3 other-EU, 1 non-EU; 72 from criminal investigators, 2 from intelligence services), of which 56 were ultimately answered after 18 were rejected for defects; by type there were 72 contact-data requests, 2 inbox confiscations, 0 traffic-data requests and 0 telecommunications interceptions.
mailbox's certifications page states that its Premium, Standard and Light plans bear the BSI IT security label under technical guideline TR-03108 'Secure email transport', that it achieved BSI gold status for email security by fully implementing DNSSEC alongside DMARC, DKIM, DANE, SPF, TLS and MTA-STS, and that it holds the 'Software Hosted/Made in Germany' seals and the ECSO 'Cybersecurity made in Europe' label.
mailbox publishes an annual transparency report series with entries dated from 2015 (report for 2014) through February 2026 (report for 2025), stating that its data protection officer critically assesses every authority request, consults specialised lawyers when legality is in doubt, and rejects requests that are not formally and legally correct; the page defines the four request types (inventory data, mailbox seizure, traffic data, telecommunications monitoring).
In a 7 January 2026 news post, mailbox announced that Heinlein Hosting GmbH had been awarded C5 Type 1 attestation under the German Federal Office for Information Security's (BSI) Cloud Computing Compliance Criteria Catalogue, complementing an existing ISO/IEC 27001 certification, and stated the certificates were confirmed through independent testing agencies; the post does not name the auditing firm.
mailbox's security page lists 'No advertising and no exploitation of user data', anonymous registration, anonymous payment by cash, and anonymised mail headers that do not contain user IP addresses or client software as its data-protection practices, and states servers are located exclusively in Berlin, Germany.
Privacy Guides lists Mailbox Mail (formerly Mailbox.org) among its recommended OpenPGP-compatible email providers, describing it as an ad-free service based in Berlin, Germany, in operation since 2014.
The data-protection notice states that the mailbox.org website uses a self-operated Matomo instance, expressly to avoid Google Analytics, that Matomo runs without cookies with all data including IP addresses stored anonymously, and that after customer login only technically necessary cookies are used; it also discloses that embedded Vimeo/YouTube videos set third-party cookies when played and that blog comments can load Gravatar avatars.