StartMail comes out of the same team that built the Startpage search engine, and it has run as a dedicated encrypted-mail service since its 2013 public beta, going into general release in early 2014 — a long track record by encrypted-email standards. The service is built around unlimited aliases, native PGP, and hardware the company owns outright in Dutch data centers. It also makes a set of engineering choices that cut against current privacy-email orthodoxy: the code is closed, and PGP runs on the server rather than in your browser.

Security

Each account gets its own “User Vault” — a LUKS-encrypted volume that is unlocked only for the duration of a session, using the account password. StartMail says it does not store that password anywhere; logging in is literally an attempt to open the vault, and success means the password was right. Mail that arrives while you are logged out is held under a separate queue key pair until your next login, then moved into the vault.

The consequential decision is where OpenPGP operations run. StartMail performs encryption and decryption server-side, not in browser JavaScript. Its technical white paper defends this directly: browser crypto is harder to secure and audit than server code the team reviews itself, and the only genuinely client-side option is a native desktop OpenPGP app — which StartMail supports over IMAP for anyone who wants that guarantee. The trade-off is unavoidable and StartMail does not hide it: while you are actively using webmail, your private key and passphrase pass through StartMail’s servers. That is not zero-access encryption in the strict sense, and it is not end-to-end encryption in the “the provider physically cannot read this” sense. The vault being sealed while you are logged out is a different and weaker property.

PGP itself is native and automatic between StartMail users who enable it, with an internal key directory that looks up recipient keys for you; you can also publish your public key to the MIT keyserver so outsiders can verify it. Messages to recipients without PGP go out as password-protected links rather than as email, and the link locks permanently after five failed password attempts.

The source code is closed, deliberately. StartMail’s argument is that a project too small to attract a sizable outside security community gains little from publishing code while handing attackers a map. Only infrastructure pieces are open — Linux, the OpenPGP suite, supporting libraries — while the webmail service, vault management, and redundancy code are not. Reasonable people disagree with that reasoning, but StartMail at least states it rather than dodging the question.

Account recovery is the most carefully engineered part of the system. You pick one of two paths at signup. With a verified recovery email, a reset request triggers a process where two separate senior staff members on different continents — one in the EU, one in the US, for jurisdictional separation — each decrypt one layer of an encrypted recovery file before any reset link is released. It can take up to six hours. With a one-time recovery code instead, StartMail never stores the code at all if no recovery email was confirmed: lose it and the account is gone for good, which StartMail says it is technically unable to reverse.

No confirmed security incidents or breaches turned up in StartMail’s history.

Privacy & Trust

StartMail B.V. is registered in Zeist, Netherlands, and the company picked the jurisdiction for Dutch privacy-law protections. The servers are StartMail’s own hardware in locked cabinets it manages inside Dutch data centers, rather than rented capacity from a cloud provider — which removes a whole category of third party with physical access.

The ownership question deserves a direct answer because it comes up constantly. StartMail shares founders with Startpage, and Startpage’s majority stake was sold to System1’s Privacy One Group in 2019. StartMail’s position is unambiguous: it is a fully independent service with its own team, infrastructure, and privacy policies, and Privacy One Group neither invested in nor owns it. Founder and CEO Robert E.G. Beens still runs the company.

The transparency report, dated February 4, 2026, is specific rather than decorative. StartMail states it will not participate in voluntary government surveillance programs and can only be compelled by verified requests routed through Dutch judicial authorities, not by foreign law enforcement directly. For 2025 it processed three legal requests total: one produced no information at all, and two produced only secondary data — account start and end dates, aliases created, limited payment information. No message content was handed over in any of the three. Numbers this small and this itemized are more useful than a vague pledge.

Analytics run on Matomo, self-hosted on StartMail’s own infrastructure, so usage statistics do not flow to an outside analytics company. StartMail describes the collection as strictly anonymous and minimal.

The gap is auditing. StartMail’s white paper says the company hires independent third-party auditors to verify its privacy and security measures — but no audit report, auditor name, or date appears anywhere on the site. For a closed-source service, an unverifiable audit claim is the weakest possible answer to “why should I believe the encryption works as described.” This is the single thing StartMail could fix that would most change how the service scores.

Features

Aliases are the standout. Every plan includes unlimited aliases, and alongside the permanent ones there are one-click burner addresses that delete themselves automatically after an hour — built for the signup form you will never want to hear from again. Custom domains are supported: one on the Personal plan, unlimited on Business, and a group subscription can share domain aliases across its members.

Spam filtering is per-user rather than pooled. Each account trains its own SpamAssassin/Bayesian filter by marking messages, and that training data lives inside that user’s encrypted vault instead of being aggregated across the user base. It is slower to become accurate than a shared filter, and it does not leak your mail patterns into a global model.

The rest of the webmail feature set is conventional and complete enough for daily use: filters and rules, group sending to a list of contacts, a block list, an auto-responder, and inbox search. A built-in migration tool imports contacts and mail when you switch over.

What is absent is everything outside the inbox. There is no calendar, no cloud storage, no document or productivity apps. StartMail does email and stops there. Whether that reads as focus or as a missing half depends entirely on what you were planning to replace.

Usability

There is no native app on any platform — not desktop, not iOS, not Android. StartMail’s pricing page still lists an iOS and Android app as “coming soon.” In practice you use the webmail interface, or you point a third-party client at IMAP/SMTP: Apple Mail on iOS and macOS, K-9 Mail or FairEmail on Android, Outlook, Thunderbird, Windows 10 Mail. Setup documentation covers these, including a PGP-specific Thunderbird walkthrough.

For people who already live in a desktop mail client this is barely a limitation, and the IMAP route is the one that gives you genuinely client-side PGP. For anyone who expects to install an app, sign in, and get push notifications and an integrated key setup on their phone, it is a real friction point in 2026 — configuring IMAP by hand on a phone is a step most mainstream users will not take.

The password-protected message flow for non-PGP recipients is straightforward on the receiving end, though the five-attempt lockout means the recipient needs the password communicated reliably out of band; a typo budget that small catches people out.

Price & Value

The Personal plan runs $4.99/month billed annually, or $59.88/year, with 20GB of storage, unlimited aliases, and one custom domain (or a StartMail-domain address). Business is $6.99/month, $83.88/year, with 30GB, unlimited custom domains, and unlimited aliases. Additional accounts under a group subscription get 25% off. Bitcoin is accepted on annual plans alongside card, PayPal, and SEPA.

There is no free tier — only a 7-day trial, and the trial asks for payment details before it starts, which StartMail attributes to abuse prevention. That combination means there is no way to try the interface before handing over card details, and no permanent free address to keep as a spare.

At roughly $60 a year for a 20GB mailbox with no calendar, no storage, and no apps, the price is defensible only if the alias system is what you are buying. Unlimited permanent aliases plus self-deleting burners plus a custom domain is a genuinely useful compartmentalization toolkit, and that is the part worth paying for here.

Pros and Cons

Unlimited aliases on every plan, including self-deleting one-hour burner addresses
Native PGP between users with automatic key lookup, plus MIT keyserver publishing
Dutch jurisdiction on hardware StartMail owns in cabinets it manages itself
Transparency report with itemized 2025 numbers — 3 requests, zero message content disclosed
Recovery requires two senior staff on different continents to decrypt separate layers
Per-user spam filter trained locally, with training data kept inside the user's vault
Bitcoin accepted on annual plans; self-hosted Matomo instead of third-party analytics

Closed source — webmail, vault management and redundancy code are not published
Audit claimed in the white paper but no report, auditor name or date published anywhere
PGP runs server-side, so the private key and passphrase pass through StartMail's servers in use
No native app on desktop, iOS or Android — webmail or manual IMAP setup only
No free tier, and the 7-day trial requires payment details up front
Email only — no calendar, storage or other bundled services at $59.88/year
Recovery code with no recovery email set means permanent, irreversible account loss

Our Rating

Security6.5/10
Server-side OpenPGP with a LUKS-encrypted per-user vault and a careful two-person recovery process, but no publicly named independent audit despite a stated policy of hiring one
Privacy & Trust7.0/10
Dutch jurisdiction, company-owned servers, a real transparency report, and documented independence from the Startpage/System1 ownership chain — offset by closed-source code and an opaque audit claim
Features6.5/10
Unlimited aliases including one-click self-deleting burner addresses and native PGP are strong; no calendar or bundled products, no free tier
Usability5.0/10
No native desktop or mobile app yet ('coming soon'); webmail plus third-party IMAP clients only
Price & Value6.5/10
$4.99/month renewal for 20GB and unlimited aliases is mid-pack; no free tier to try before paying

Overall6.4/10

Security 30% · Privacy & Trust 30% · Features 15% · Usability 15% · Price & Value 10%

See our rating methodology →

StartMail suits someone who wants a long-running independent Dutch mailbox and will actually use the alias system — one permanent address per service, burners for everything disposable, a custom domain over the top — and who is comfortable in a web client or a configured desktop one. It is the wrong choice if you want a phone app, need a calendar and files alongside your mail, or treat published source code and a verifiable audit report as non-negotiable, because on that last point StartMail asks for trust it has not shown its work for.