Posteo

Posteo is a Berlin email provider run since 2009 by a married couple, Patrik and Sabrina Löhr, as a sole proprietorship with no investors and no debt — the €1/month subscriptions of its 500,000-plus customers are the entire revenue base. That structure shapes the product: no free tier, no tracking, no ad partners, no custom domains, and no native apps, just one flat plan on servers in two redundant Frankfurt datacenters. Encryption is opt-in rather than automatic, and the account itself asks for no name, address, or IP address at any point. Posteo also runs its servers and offices on renewable energy and has published an annual transparency report since 2013 — both unusually early positions for the sector.

Security

Posteo does not encrypt mail end-to-end between two of its own users by default. If you want content encryption, you set it up yourself with PGP or S/MIME, and your correspondent has to do the same. What Posteo does add is a layer of automation around that manual process: it maintains a public key directory with automatic lookup, so in many cases you do not have to ask a contact for their public key, and it integrates encryption into webmail through a Posteo-built S/MIME browser add-on and the open-source Mailvelope plugin for OpenPGP. That is more than bare key import, but it remains plugin-based rather than invisible.

The more distinctive piece is Crypto Mail Storage, an optional user-activated feature that encrypts the entire mailbox at rest — message content, attachments, and metadata — using RSA for the asymmetric layer, AES with HMAC for symmetric encryption and authentication, and bcrypt for hashing. The key is protected by your password, and Posteo states it cannot read data stored this way and cannot switch the feature off once you have enabled it. Calendar and address book data has a separate opt-in encryption layer using AES, likewise password-protected and likewise inaccessible to Posteo once turned on. Independently of any of this, the hard drives in Posteo’s servers are AES-encrypted at the infrastructure level.

Transport security is where Posteo has historically moved early. IMAP, POP3, webmail, CalDAV, and CardDAV connections run TLS 1.2–1.3 with Perfect Forward Secrecy, and the servers support post-quantum key exchange. Posteo implemented DANE/TLSA in May 2014, which authenticates the TLS used for mail transport between servers, and says it was the first provider to do so. There is also an opt-in TLS-sending guarantee you can switch on in settings: once active, if the receiving server does not support encrypted transport, Posteo refuses to send the message rather than falling back to plaintext. The BSI, Germany’s federal cybersecurity agency, has certified the service under TR-03108 v2 for secure email transport.

Account access is protected by TOTP apps or hardware keys such as a YubiKey, passkey login using the PRF extension, and app-specific passwords for third-party clients. Posteo has no history of a data breach. It absorbed DDoS attacks in 2021 and again in May 2022 that slowed or interrupted service, with inbound mail queued and delivered once servers stabilized, but no data was compromised, stolen, or leaked and no ransom was demanded — an availability problem, not a security one.

Privacy & Trust

Signup requires no personal information: no name, no address. Posteo logs no IP addresses, neither for the account nor for the website, and strips local and public IP data from outgoing mail headers, so sent messages carry no trace of where you were. Payment is deliberately decoupled from the mailbox — you can pay by bank transfer, PayPal, credit card, or cash sent by mail, and none of the payment data is linked to the email account, with payment codes deleted once allocated. Backups are kept for seven days so you can recover something you deleted by accident, not as an archive. There is no tracking, no profiling, no advertising relationship, and no sale or trade of customer data; Posteo also keeps no social media presence at all, by choice.

The transparency report has been published annually since 2013, and Posteo was the first German email provider to issue one, in May 2014. The most recent reporting cycle covers 85 government and legal requests — 79 from German authorities and 6 foreign — consisting of 72 requests for user information, 4 mailbox seizures, 2 surveillance orders, and 7 that Posteo could not cleanly categorize. Because there is no personal data and no IP log to hand over, the outcome was zero personal or account data released and zero IP or traffic data disclosed. Two mailboxes were affected under what Posteo describes as a formally correct judicial ruling, which is content-level compliance rather than a bulk handover. Posteo is openly critical of data-retention law and reports that roughly half of the authority requests it receives contain formal or procedural defects.

Code openness is the weak spot. Posteo markets itself as “100% open source,” but the claim describes its internal use of open-source software and free protocols and the licensing of the JavaScript served on its site, not the publication of its own application. No public repository exists for Posteo’s webmail or backend, so the core product is not something outside parties can read or rebuild — it relies on open standards and open-source components without being open source itself.

Third-party scrutiny is real but dated and piecemeal. Posteo maintains a public Security Transparency page listing individually dated vulnerability findings going back to 2014, each credited to a named researcher or to Cure53, and all marked fixed. Two clusters stand out. In April 2015 Cure53 tested Crypto Mail Storage specifically and found roughly 14 issues spanning Critical severity — IV reuse leading to keystream reuse, a heap overflow — down to informational notes. Through 2017, from February to August, Cure53 examined the webmail application more broadly, including Calendar and Notes, surfacing several Critical and High XSS vulnerabilities such as persistent XSS via ICS calendar import and stored XSS in Notes, plus an access-control gap in calendar sharing. Everything is listed as fixed. But these live as rows in a disclosure table on Posteo’s own site rather than as a formal, downloadable report from the auditor, and nothing comprehensive has covered the current codebase since 2017. Separately, Posteo co-funded a 2017 Cure53 audit of Thunderbird and Enigmail alongside Mozilla’s SOS Fund, which turned up 22 vulnerabilities including 3 critical and 5 high — not an audit of Posteo’s product, but evidence of it paying for security work on email software the whole ecosystem depends on. Posteo also won the German Fairness Award 2025.

Features

The base subscription bundles email, calendar, address book, and a notes app at no extra charge. Three calendars are included and more can be added; calendar syncs over CalDAV and the address book over CardDAV, and both can be shared or subscribed to externally — though sharing is disabled for whichever of the two you have encrypted, since Posteo can no longer read that data. A cleanup tool finds large attachments so you can bulk-delete them and reclaim storage.

Moving in is handled by a free migration service that transfers up to three existing mailboxes, folder structure included, over an encrypted connection with no third party involved. An email collector keeps pulling new mail from the old account during the transition, which makes the switch less abrupt than it usually is.

Two omissions matter. Custom domains are not supported at all — the only choice is between posteo.de, posteo.net, and posteo.com, selectable at signup or later. Aliases are limited: three come with the base account and you can buy up to 25 total at €0.10 per month each. Unlimited plus-addressing style filter addresses (name+shopping@posteo.net) are free, but those sort incoming mail rather than serve as separate identities. Spam handling is described only as a “highly efficient spam and virus filter,” with no published technical detail behind it.

Usability

There are no native desktop or mobile apps. Everything runs through a web app that works in phone, tablet, and desktop browsers, with dark mode and 12 color themes, or through standard protocols — IMAP and POP3 for mail, CalDAV for calendar, CardDAV for contacts — with Thunderbird, Outlook, Apple Mail, and the built-in iOS and Android mail apps. Many of those auto-configure the connection, so setup is usually a matter of entering the address and password. If you want an app experience, you bring your own client.

Account recovery carries the trade-off that always comes with genuine zero-access encryption. A standard self-service password reset exists and sends a reset through a backup method you configured in advance, but only for accounts without Crypto Mail Storage. Turn that on and the automated recovery is disabled entirely: a lost password means contacting support with no guarantee of getting back in. Encrypted calendar and address book data behaves the same way, permanently inaccessible if the password is gone — though remembering an old password can restore it. The encryption that keeps Posteo out keeps you out too.

Price & Value

The base account is €1.00 per month and includes 4 GB of storage, recently doubled from 2 GB, plus 3 aliases, 3 calendars, the address book, notes, TOTP two-factor authentication, and every encryption feature. There is no premium tier; the single plan scales through small add-ons: €0.25 per GB per month for storage up to a 75 GB ceiling, €0.10 per month per additional alias, €0.10 per month per additional calendar, and an optional S/MIME certificate signed by the public CA Certum for €3.65 a year.

There is no free tier of any kind, and no introductory rate either — the price on day one is the price in year five, with none of the renewal jump that usually follows a discounted first term. Billing runs on a prepaid credit balance from which the monthly fee is deducted. Cancelling takes 14 days’ notice, and whatever credit remains is refunded or, if you prefer, donated to an NGO.

Pros and Cons

Our Rating

Posteo suits someone who wants a cheap, structurally independent mailbox that collects as little about them as technically possible, and who is comfortable living in a browser or a third-party client. The privacy engineering is substantive rather than advertised — no IP logs, unlinked cash payment, a transparency report with nothing to disclose because nothing is retained — and €1 a month buys calendar, contacts, and notes alongside it. The trade-offs are concrete: no custom domain, no apps, encryption that only works if you and your correspondent both configure it, closed application code, and an audit trail that has not been refreshed since 2017. If you need branded addresses or encryption that works without thinking about it, this is not the account for you.