mailbox.org
Verified“German to the metal. Own servers, own jurisdiction, founder-owned.”
- Founded
- 2014
- Ownership
- Founder-owned
- Infrastructure
- Own servers
- Certifications
- BSI C5 + ISO 27001
92 = midpoint of Control 93 & Data 91
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 13 sourced facts across 10 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 88% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
95
Operated by Heinlein Hosting GmbH, incorporated and registered in Berlin (District Court Berlin-Charlottenburg, HRB 220010 B), CEO Peer Heinlein. No foreign parent in the control chain. The full operating, contracting, and data-processing entity sits inside the EU under German and EU law, so GDPR and EU enforcement reach it directly with nothing to pierce. Textbook EU-incorporated and EU-operating.
Why 95? 3 sourced facts · click to expand
Operating entity, registry and address
mailbox.org Legal Notice / Impressum · as of 2026-06-12
mailbox.org was spun off into its own GmbH on 1 Jan 2021
mailbox.org news: spin-off into separate GmbH · as of 2026-06-12
Service runs under German jurisdiction; no data transmitted abroad
Wikipedia: Mailbox (company) · as of 2026-06-12
Control & Ownership
90
Heinlein Hosting GmbH is a 100% subsidiary of Heinlein Support GmbH (Berlin, HRB 93818 B), the parent of the privately held, founder-led Heinlein Group. Founder Peer Heinlein controls the group (Jutta Horstmann joined as Co-CEO in 2024). No public listing, no identified foreign capital — voting control and economic ownership both sit in Germany. Slight deduction only because the exact private shareholder split is paywalled in the commercial register, so 100% domestic ownership is strongly indicated but not line-itemized publicly.
Why 90? 3 sourced facts · click to expand
Heinlein Hosting GmbH is wholly owned by Heinlein Support GmbH
mailbox.org news: spin-off into separate GmbH · as of 2026-06-12
Parent is a founder-led, privately held German group
Heinlein Group (about / press) · as of 2026-06-12
Parent company registry entry (Berlin)
NorthData: Heinlein Support GmbH · as of 2026-06-12
Data →
Where your data lives and who can reach it
Data & Infrastructure
92
This is the maximal infrastructure case for the index. mailbox.org explicitly does NOT rent root servers from commercial providers — it operates its own dedicated hardware across two geographically separate Berlin data centers (IPB / Internet Provider Berlin and Lumen), with its own data lines, under German jurisdiction, on green energy, and states no data is transmitted abroad. No US hyperscaler in the path means no CLOUD Act / FISA 702 exposure on user data. Deduction is minimal and reflects reliance on third-party colocation facilities (Lumen is US-parented at the building/transit layer) rather than fully self-owned buildings, and the absence of an independent audit of physical data flows.
Why 92? 4 sourced facts · click to expand
Operates own dedicated hardware, does not rent root servers
mailbox.org news: why we operate two data centres · as of 2026-06-12
Servers located in Berlin, Germany under German jurisdiction
mailbox.org Knowledge Base: where are the servers · as of 2026-06-12
Servers run exclusively in German data centers on green energy, no data abroad
Wikipedia: Mailbox (company) · as of 2026-06-12
Certified BSI C5 (Type 1) and ISO/IEC 27001:2022
mailbox.org news: BSI C5 + ISO 27001 certification · as of 2026-06-12
Operations & People
90
Berlin-headquartered, German-led, German-staffed operation reporting in euros. Founder Peer Heinlein and Co-CEO Jutta Horstmann lead from Berlin; the parent Heinlein Support employs 150+ permanent staff. Workforce, management, support and operations are all EU-centered. Deduction reflects only that detailed headcount specific to the mailbox.org entity (vs. the broader group) isn't separately published.
Why 90? 3 sourced facts · click to expand
Headquarters and operations in Berlin, Germany
mailbox.org about us · as of 2026-06-12
Parent Heinlein Support has 150+ permanent employees
mailbox.org about us · as of 2026-06-12
German leadership: founder/CEO Peer Heinlein, Co-CEO Jutta Horstmann
Heinlein Group press: Co-CEO appointment · as of 2026-06-12
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
Exact private shareholder split of Heinlein Support GmbH (the parent)
Public German register lists 2 active shareholders but the precise percentages are behind a paywall; 100% domestic founder ownership is strongly indicated but not line-itemized publicly.
- ?
Headcount and revenue specific to the mailbox.org / Heinlein Hosting entity
Only group-level figures (150+ staff) are published, so the standalone scale of the mailbox.org business is not precisely known.
- ?
Whether any transit/colocation layer touches non-EU-controlled infrastructure
One data-center partner (Lumen) is US-parented at the facility/transit level; mailbox.org owns the servers but the building operator's jurisdiction adds a thin layer of theoretical exposure.
EU Cloud Sovereignty Framework lens
SEAL was designed to score cloud/hosting providers; this is an analogous mapping for an email provider, not a formal SEAL certification.
Strategic
Independent, founder-owned German group explicitly built around European digital sovereignty; no foreign strategic control.
Legal & jurisdictional
German GmbH, Berlin register, fully under German/EU law; GDPR enforcement reaches the operating entity directly.
Data & AI
User data stored only in German data centers; PGP/S-MIME encryption; provider states no data transmitted abroad.
Operational
Berlin HQ, German leadership and workforce, euro reporting; operations entirely EU-centered.
Supply chain
Owns its servers and data lines but relies on third-party colocation (IPB, Lumen); Lumen is US-parented at the facility/transit layer.
Technological
Self-operated dedicated hardware, open-source stack, sibling products OpenTalk/OpenCloud; no hyperscaler dependency.
Security & compliance
BSI C5 Type 1, ISO/IEC 27001:2022, BSI email-security gold status (2025).
Environmental sustainability
Provider states servers run on green energy, but no independent emissions/PUE disclosure verified.
EU alternatives
German end-to-end-encrypted email, own servers in Germany; a strong domestic peer with deeper E2EE.
Swiss-based, strong privacy and self-run infra, but Switzerland is not in the EU (adequacy-recognized).
Berlin-based, green, privacy-focused German email on its own infrastructure; a close sovereign peer.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology