The firm's base in Norway is generally considered to be good in terms of privacy (the nation does not have mandatory data retention laws that apply to email providers). However, it is worth noting that the nation is part of the greater Nine Eyes agreement, which means that government intelligence agencies are likely to be performing some surveillance and communicating with the likes of the NSA and GCHQ. In 2011 the firm was completely bought out by employees and the rest of the board.
How much does Runbox cost?
A subscription to Runbox can be purchased in Micro, Mini, Medium, or Max. The four subscription plans vary in cost but are all yearly subscription plans.
The Micro plan gives users access to 2 GB of email storage with an extra 200 Mb of file storage space. Micro users also now get access to custom domain names. And you can have as many aliases as you like as long as you use your own domain. A Micro plan costs $19.95 per year and will allow you to use one previously registered custom domain.
The Mini plan gives subscribers 10 GB of email storage and 1 Gb of file storage. It can be used with 5 previously registered custom domains. The mini-plan costs $34.95 per year.
The Medium plan gives users access to 25 GB of email storage and 2 Gb of file storage. Users can use the account with up to 10 previously registered custom domains. The medium plan costs $49.95 per year.
The Max plan gives users access to 50 GB of email storage and 5 GB of file storage. Users can use the account with up to 25 previously registered custom domains. The Max plan costs $79.95 per year.
Anybody wanting to purchase a new domain using Runbox Domain Hosting, or extra storage space can do so at various bolt-on prices. However, it is worth noting that Runbox has now introduced unlimited aliases (as long as you use your own domain) which is an improvement since we last checked.
Admittedly, this pricing structure is a little complicated compared to some other email services. However, it does give users a lot of customizability – as long as they are willing to pay.
Users can elect to pay for Runbox via credit or debit card, PayPal, or Bitcoin for added privacy.
Runbox Features
- Based in Norway. Which is generally thought to be a good location in terms of privacy compared to many EU locations, the UK, and the US
- 100 aliases included with every account (for a single Runbox inbox on their domain)
- Unlimited aliases if you use a custom domain
- Spam detection
- POP, IMAP and SMTP with enforced TLS 1.2 or better for sending and receiving emails across various clients.
- Data storage included
- Synchronize with Apple Mail, Mozilla Thunderbird, and Microsoft Outlook.
- Drag and drop attachments
- Custom domain support
- A+ score for security with Qualys SSL Labs
Privacy
The Runbox Terms of Service requires users to register using their real name. Thus, this email provider should be considered private but not anonymous.
Despite this, users can theoretically use a burner email address to subscribe. From that moment on, it is possible to make support requests from within the Runbox account -meaning that you don't necessarily have to hold on to that burner address, either.
We checked the Runbox privacy policy to see what kind of data the firm collects about its users. The good news is that the policy is GDPR compliant. In addition, Runbox does not state that it collects user IP addresses, and claims that none of the data collected while using the service is defined as sensitive.
The information provided by subscribers at the time of signing up to the service is retained for the period that it is necessary to provide the service. However, anybody that pays for a subscription should be aware that their data is also held for five years after the end of a subscription to comply with Norwegian bookkeeping laws.
Email service content (data associated with the webmail, Contacts, and Files in the Service) is stored for the duration of an account being held, and for up to 3 months after the closure of a trial account or up to 6 months after the closure of a paid subscription.
Looking good!
The privacy policy seems strong, and there is no reason we could see to question their dedication to consumer privacy.
Security
All communications with Runbox servers are handled with TLS/SSL encryption. This ensures that data is always secure in transit between the sender and Runbox's servers and between Runbox's servers and the recipient. The service gets a score of A+ with Qualys SSL Labs, meaning that connections to its servers are indeed secure. (SHA256 with RSA 4096 bits.)
Unfortunately, there is no built-in end-to-end encryption within the Runbox webmail interface. For this reason, you will need to install a third-party extension such as Mailvelope to encrypt emails with PGP. This is slightly trickier than with some other providers but will get the job done.
Users also have the option to encrypt emails using S/MIME as long as they use their Runbox account with a third party standalone email client such as Mozilla Thunderbird, Apple Mail, or Microsoft Outlook.
The good news is that Runbox is planning to introduce native PGP encryption to its Runbox 7 client (currently in Beta). So watch this space.
Anybody who does use the webmail interface rather than a stand-alone client must be aware that because encryption occurs within their browser (using Mailvelope) there are some security issues to bear in mind (which apply to all JavaScript mail clients and not just Mailfence).
Javascript has vulnerabilities that can permit a man-in-the-middle attack to force compromised encryption keys onto both the sender and recipient's browsers. Anybody who wants to avoid these JavaScript vulnerabilities will need to use an email provider with a dedicated email client.
One thing worth remembering is that Runbox does not currently implement encryption for emails that are at rest on its servers, this may concern any user that does not implement strong E2EE using S/MIME or PGP.
Finally, Runbox implements IP stripping from all sent messages. This means that your IP address is never attached to an outgoing email.
Ease of Use
Signing up for a free trial of Runbox is easy, but does require you to provide an alternate email address that you already own. This is slightly frustrating for those people who value privacy and don't want to link their new account to a previous one. While the firm does prefer customers to hand over a phone number, thankfully this is optional – which is one saving grace.
Having subscribed, you will receive a validation email in the inbox that you provided. Click on the link in that email to get started. The link takes you, fully logged in, to the web client where you are ready to start taking advantage of the secure email service.
Setting up folders is nice and easy thanks to the form that appears just underneath the directory of inboxes. I went ahead and set a folder up just to see how it works. You can see the results below.
To import contacts from Google or any other email provider, you simply click on Contacts in the top left of the web mail client and then click on import. The feature allows you to import contacts via CSV, which means you can import them from Google Mail or just about any other email provider. We found the feature to work without a hitch.
With imports contacted, you are ready to start sending emails. Clicking on compose opens a separate window, and we were shocked to find that there were no options for OpenPGP encryption. In fact, at first glance, we could see no options for encrypting emails at all; this confused us because we were under the impression that this was a secure email provider.
We contacted support to get clear confirmation about this point and were informed that Runbox stores all emails on secure servers but does not provide any PGP functionality or password encrypted email options.
What's more, feature-wise Runbox is very thin on the ground: it provides email storage and file storage (for uploading documents onto its equivalent of Google Drive) – but no extras such as spreadsheets, webchat – and all those other goodies you find with so many other encrypted email providers. However, it is worth noting that the firm does appear to be expanding its feature set (it has already added a calendar to the Runbox 7 beta, for example).
All in all, we were a little disappointed with what is on offer considering the cost of even a micro account (other email providers exist that are just 1 Euro a month – and provide more features baked in).
However, to be fair, Runbox is extremely easy to use. And, if you don't actually want to send encrypted emails – and are just looking for secure email storage (that is not being scanned by Google for advertising purposes, and that is stored safely to protect it from hacking) – this email provider might be an option for you.
Customer Support
Where customer support is concerned Runbox is a bit of a slog. Users must begin the process by sending an email from their account. With that done, an automated response will arrive. However, in order to open a support ticket, it is necessary to reply to that initial auto-response to assert that you have not been able to find the solution in the help section of its website. With that done, another automated response arrives, and following that the actual help.
Overall, the system does work – and we did get a response within an hour – which isn't terrible. However, for people that are forking out for a Max account, I suspect a live chat feature would be welcomed, and considering what they are charging; probably ought to be an available resource.
With that said, both the help and blog sections of the website are useful and will provide users with answers to many commonly asked questions. We found the help center easy to use, and we particularly enjoyed the way that the top nav bar is split into tabs: Search, How-tos, FAQs, Documentation, and Support.
This lets you quickly hone in on what you are looking for – whether it be information about the service, or specific setup guides for IMAP, POP, or setting up aliases, for example.
Runbox email conclusion
Runbox is an email provider that is extremely easy to get used to. However, if you want something that comes with PGP encryption right out of the box – you might be better off looking elsewhere.
For those people who prefer using their email account with Outlook, Thunderbird, Apple Mail, or another third-party client; the availability of both PGP encryption and S/MIME means that you will be able to use this email provider to send secure E2EE on your emails.
One thing worth bearing in mind is that, as it stands, the webmail client is not open source. This may put diehard privacy and security advocates off the service. However, Runbox 7 which is currently in Beta, is going to have PGP baked in, and it is claimed that it will be open source.
An easy-to-use provider with useful browser-based webmail – as long as you don't mind following guides to get PGP encryption up and running with Mailvelope or a separate standalone client.
With all that said, Runbox is pricier than some of its competitors, and many of those providers come with more features baked in. So, depending on your needs, you may be better off looking around for something else.
Michael C