Disroot

Disroot is not an email company. It’s a volunteer-run non-profit platform out of Amsterdam, and email is one service on a shelf that also holds cloud storage, chat, collaborative pads, a password vault and a dozen smaller tools — all reachable with one account, all funded by donations rather than subscriptions. That origin explains both halves of the mailbox. It is free in the way very little is free: 1 GB, no time limit, nothing withheld to nudge you toward a paid plan. It also was never built around the zero-access encryption that this category is normally judged on. Mail sits readable on the server unless you layer PGP on top of it yourself, by hand.

Security

Everything in transit is handled the conventional way. Webmail and IMAP/POP/SMTP connections alike run over SSL/TLS, and outbound mail to other providers is encrypted in transit whenever the receiving server supports it. Disroot also encrypts its server disks, which matters if the hardware is stolen or seized — but disk encryption protects mail from someone who walks off with a machine, not from the operator running it.

What happens after a message lands is the real story, and Disroot’s privacy statement doesn’t hedge about it: mail is stored unencrypted on the server unless the user has encrypted it themselves with GnuPG or PGP. Two Disroot accounts writing to each other get no automatic encryption either. And the webmail has no key management of its own — encrypting anything means installing Mailvelope, a third-party browser add-on, and handling your own keypair through it. Nothing about that is broken, but it inverts the usual default: here an inbox is plaintext until you do the work, rather than encrypted until you choose to share.

Account access has a matching gap. Two-factor authentication does exist on the platform — for the Nextcloud-based Cloud service. Nothing in the documentation extends it to the Disroot account or the email login, which means a leaked password is the whole distance between an attacker and the mailbox.

Privacy & Trust

The entity behind the platform is a real non-profit rather than a positioning statement: Stichting Disroot.org, a Dutch foundation with a Chamber of Commerce registration, run by volunteers since 2015, with no investors and nothing to upsell. It has also published annual financial and operational reports since 2018 — every year but 2021 — which is more than most paid providers in this category volunteer, and it lets anyone read how the money and the machines are actually handled instead of taking a claim on faith.

The stack is open source end to end: a Roundcube webmail front end, standard mail-server software underneath, Nextcloud behind the bundled cloud service. These are all projects anyone can read, not a closed client with an openness claim attached. The missing step is the one after that — no security firm has been commissioned to test Disroot’s own deployment and publish what it found. The project’s stance is that the back end can be inspected “at any moment,” which is an open door, not a report by someone who walked through it.

Data handling is documented in specifics. IP addresses of logged-in IMAP/POP3 sessions are held for as long as the device stays connected; server logs, sender and recipient addresses included, are deleted after 48 hours, and the stated purpose is blocking brute-force attempts and debugging, not analytics. The policy states outright that Disroot doesn’t sell data, doesn’t build behavioral profiles, and doesn’t read stored mail except to run the service, troubleshoot it, or investigate a suspected Terms of Service violation. No breach or security incident has surfaced in the project’s history. All of it rests on stated practice rather than on math — credible given the paper trail, and still a promise rather than a proof.

Features

The mailbox is sparse. Plus-addressing (username+anything@disroot.org) works out of the box as a filtering handle, with every tag routed back to the same inbox automatically, but it isn’t an alias system: there’s nothing to manage, disable, or burn when one tag starts attracting spam. A custom domain is available, and it isn’t sold — it’s a “lifetime reward” for a donation pitched at roughly the price of a dozen coffees, with no tier and no renewal attached. Spam filtering runs server-side, though Disroot publishes no technical account of how it works beyond the log-retention rules in its privacy statement.

The account is where Disroot outgrows a plain mailbox. One login also opens Nextcloud cloud storage with calendar and contacts, collaborative Pads, an end-to-end encrypted Paste Bin and XMPP chat, among others — and several of those tools (Paste Bin, Upload, CryptPad) are end-to-end encrypted by design, even though the email beside them isn’t.

Usability

There is no Disroot mail app on any platform — no desktop client, no Android or iOS build. You reach the mailbox through Roundcube in a browser, or you point a third-party client at it over IMAP, POP and SMTP, exactly as you would with any generic mail account in Thunderbird or a phone’s built-in app. Disroot does ship a companion Android app on F-Droid, open source and reproducibly built, but it’s a launcher for the login-free tools — Etherpad, PrivateBin, Upload and similar — and email isn’t among them.

The free mailbox stops at 1 GB, with a 64 MB attachment ceiling. That’s tight against what an ordinary inbox of photos and PDFs accrues in a couple of years, though it isn’t a wall: paid storage extends it, and the allowance is pooled across mail, cloud and CryptPad instead of being sold as a mail-only add-on.

Price & Value

The free tier isn’t a trial with an expiry attached. It’s a working 1 GB mailbox with no features held back from it — money buys space and nothing else. Extra space is cheap and shared: 5 GB for EUR 11 a year, up to 60 GB for EUR 110 (plus 21% VAT inside the EU), split between mail, cloud storage and CryptPad however the account holder wants.

What’s absent is a subscription. There’s no monthly plan, no locked-in rate, no recurring invoice — storage is bought once or by the year, and the custom-domain perk is an open-ended donation rather than a price. That’s consistent with a “pay as you wish” non-profit, and it’s what keeps the baseline genuinely free; it also means there’s no fixed line item to budget for, and no contract on either side.

Pros and Cons

Our Rating

Disroot suits someone who cares more about who runs their mail than about how it’s encrypted at rest: a volunteer foundation with no investors, no advertising, a published set of books, and a whole shelf of federation-minded tools behind the same free login. Judged as an encrypted mailbox, it scores at the bottom of this section, and the reasons are structural rather than sloppy — plaintext storage by default, PGP only through a browser add-on, no 2FA on the mail login, no audit, no mail app. The trade is explicit, and for the audience that wants a donation-funded platform rather than a privacy product, it’s a trade worth making with both eyes open.