Runbox Review

Runbox

Runbox is an email provider from Norway, which was first launched in the year 2000. The Runbox service is owned by Runbox Solutions AS, which is known for also providing web hosting services. Runbox Solutions AS is currently owned by employees and other key personnel.

ProPrivacy.com Score 8 out of 10
Visit Site

Summary

Runbox v.7 (currently in beta), has an open-sourced front end (the app that is downloaded and runs in your browser). The app codebase is available on GitHub. However, the backend is not yet open-source, and older versions of Runbox are also still entirely closed source.

The firm’s base in Norway is generally considered to be good in terms of privacy (the nation does not have mandatory data retention laws that apply to email providers). However, it is worth noting that the nation is part of the greater Nine Eyes agreement, which means that government intelligence agencies are likely to be performing some surveillance and communicating with the likes of the NSA and GCHQ. In 2011 the firm was completely bought out by employees and the rest of the board.

How much does Runbox cost?

A subscription to Runbox can be purchased in Micro, Mini, Medium, or Max. The four subscription plans vary in cost but are all yearly subscription plans.

The Micro plan gives users access to 1 GB of email storage with an extra 100 Mb of file storage space. Micro users do not get access to any custom domain names - these must be purchased as an add on. In addition, the micro account does not permit users to attach any existing custom domains they have (previously registered domains from other services) to their account. A Micro plan costs $19.95 per year.

The Mini plan gives subscribers to 5 GB of storage and 500 Mb of file storage. Mini users are permitted to use five custom domains they have previously registered with another provider. However, if they want to register a new custom domain, they will have to purchase it as an add on. The mini-plan costs $34.95 per year.

The Medium plan gives users access to 10 GB of email storage and 1 Gb of file storage. Users can use the account with up to 10 previously registered custom domains. However, if they want to register a new custom domain, they will have to purchase it as an add on. The medium plan costs $49.95 per year.

The Max plan gives users access to 25 GB of email storage and 2 GB of file storage. Users can use the account with up to 25 previously registered custom domains. As with the other plans, they will need to pay to register a new custom domain. The Max plan costs $79.95 per year.

Anybody wanting to purchase extra email aliases (in packs of five), custom domains, or extra storage space can do so at various bolt-on prices. This pricing structure is quite complicated compared to other email services. However, it does give users a lot of customizability - as long as they are willing to pay.

Users can elect to pay for Runbox via credit or debit card, PayPal, or Bitcoin for added privacy.

Runbox Features

  • Based in Norway. Which is generally thought to be a good location in terms of privacy compared to many EU locations, the UK, and the US
  • 100 aliases included with every account (for a single user’s inbox)
  • Spam detection
  • POP and IMAP and SMTPS supported for sending and receiving emails across various clients.
  • Data storage included
  • Synchronize with Apple Mail, Mozilla Thunderbird, and Microsoft Outlook.
  • Drag and drop attachments
  • Custom domain support
  • A+ score for security with Qualys SSL Labs

Privacy

The Runbox Terms of Service requires users to register using their real name. Thus, this email provider should be considered private but not anonymous. 

Despite this, users can theoretically use a burner email address to subscribe. From that moment on, it is possible to make support requests from within the Runbox account -meaning that you don’t necessarily have to hold on to that burner address, either.

We checked the Runbox privacy policy to see what kind of data the firm collects about its users. The good news is that the policy is GDPR compliant. In addition, Runbox does not state that it collects user IP addresses, and claims that none of the data collected while using the service is defined as sensitive.

The information provided by subscribers at the time of signing up to the service is retained for the period that it is necessary to provide the service. However, anybody that pays for a subscription should be aware that their data is also held for five years after the end of a subscription to comply with Norwegian bookkeeping laws.

Email service content (data associated with the webmail, Contacts, and Files in the Service) is stored for the duration of an account being held, and for up to 3 months after the closure of a trial account or up to 6 months after the closure of a paid subscription.

Overall, the privacy policy seems strong, and there is no reason we could see to question their dedication to consumer privacy.

Security

All communications with Runbox servers are handled with TLS/SSL encryption. This ensures that data is always secure in transit between the sender and Runbox’s servers and between Runbox’s servers and the recipient. The service gets a score of A+ with Qualys SSL Labs, meaning that connections to its servers are indeed secure. (SHA256 with RSA 4096 bits.)

Unfortunately, there is no built-in end-to-end encryption within the Runbox webmail interface. For this reason, you will need to install a third-party extension such as Mailvelope to encrypt emails with PGP. This is slightly trickier than with some other providers but will get the job done.

Users also have the option to encrypt emails using S/MIME as long as they use their Runbox account with a third party standalone email client such as Mozilla Thunderbird, Apple Mail, or Microsoft Outlook.

The good news is that Runbox is planning to introduce native PGP encryption to its Runbox 7 client (currently in Beta). So watch this space.

Anybody that does use the webmail interface rather than a stand-alone client must be aware that because encryption occurs within their browser (using Mailvelope) - there are some security issues to bear in mind (which apply to all JavaScript mail clients and not just Mailfence).

Javascript has vulnerabilities that can permit a man-in-the-middle attack to force compromised encryption keys onto both the sender and recipient’s browsers. Anybody who wants to avoid these JavaScript vulnerabilities will need to use an email provider with a dedicated email client.

One thing worth bearing in mind is that Runbox does not currently implement encryption for emails that are at rest on its servers, this may concern any user that does not implement strong E2EE using S/MIME or PGP.

Finally, Runbox implements IP stripping from all sent messages. This means that your IP address is never attached to an outgoing email.

Ease of Use

Signing up for a free trial of Runbox is easy, but does require you to provide an alternate email address that you already own. This is slightly frustrating for those people who value privacy and don’t want to link their new account to a previous one. While the firm does prefer customers to hand over a phone number, thankfully this is optional - which is one saving grace.

Runbox free trial

Having subscribed, you will receive a validation email in the inbox that you provided. Click on the link in that email to get started. The link takes you, fully logged in, to the web client where you are ready to start taking advantage of the secure email service.

Setting up folders is nice and easy thanks to the form that appears just underneath the directory of inboxes. I went ahead and set a folder up just to see how it works. You can see the results below.

creating folders in runbox client

To import contacts from Google or any other email provider, you simply click on Contacts in the top left of the web mail client and then click on import. The feature allows you to import contacts via CSV, which means you can import them from Google Mail or just about any other email provider. We found the feature to work without a hitch.

importing a file to runbox

With imports contacted you are ready to start sending emails. Clicking on compose opens a separate window, and we were shocked to find that there were no options for OpenPGP encryption. In fact, at first glance, we could see no options for encrypting emails at all; this confused us because we were under the impression that this was a secure email provider.

We contacted support to get clear confirmation about this point and were informed that Runbox stores all emails on secure servers but does not provide any PGP functionality or password encrypted email options. 

What’s more, feature-wise Runbox is very thin on the ground: it provides email storage and file storage (for uploading documents onto its equivalent of Google Drive) - but no extras such as spreadsheets, webchat - and all those other goodies you find with so many other encrypted email providers. However, it is worth noting that the firm does appear to be expanding its feature set (it has already added a calendar to the Runbox 7 beta, for example).  

All in all, we were a little disappointed with what is on offer considering the cost of even a micro account (other email providers exist that are just 1 Euro a month - and provide more features baked in). 

However, to be fair, Runbox is extremely easy to use. And, if you don’t actually want to send encrypted emails - and are just looking for secure email storage (that is not being scanned by Google for advertising purposes, and that is stored safely to protect it from hacking) - this email provider might be an option for you.

Customer Support

Where customer support is concerned Runbox is a little bit of a slog. Users must begin the process by sending an email from their account. With that done an automated response will arrive. However, in order to actually open a support ticket, it is necessary to reply to that initial auto-response to assert that you have not been able to find the solution in the help section of its website. With that done, another automated response arrives and following that the actual help.

Overall, the system does work - and we did get a response within an hour - which isn’t terrible. However, for people that are forking out for a Max account, I suspect a live chat feature would be welcomed, and considering what they are charging; probably ought to be an available resource.

With that said, both the help and blog sections of the website are useful and will provide users with answers to many commonly asked questions. We found the help center easy to use, and we particularly enjoyed the way that the top nav bar is split into tabs: Search, How-tos, FAQs, Documentation, and Support.

This lets you quickly hone in on what you are looking for - whether it be information about the service, or specific setup guides for IMAP, POP, or setting up aliases, for example.

Runbox email conclusion

Runbox is an email provider that is extremely easy to get used to. However, if you want something that comes with PGP encryption right out of the box - you might be better off looking elsewhere.

For those people who prefer using their email account with Outlook, Thunderbird, Apple Mail, or another third-party client; the availability of both PGP encryption and S/MIME means that you will be able to use this email provider to send secure E2EE on your emails.

One thing worth bearing in mind is that as it stands the webmail client is not open source. This may put diehard privacy and security advocates off the service. However, Runbox 7 which is currently in Beta, is going to have PGP baked and it is claimed that it will be open source.

An easy-to-use provider with useful browser-based webmail - as long as you don’t mind following guides to get PGP encryption up and running with Mailvelope or a separate standalone client.

With all that said, Runbox is pricier than some of its competitors, and, many of those providers come with a lot more features baked in. So, depending on your needs, you may be better off looking around for something else.

Written by: Ray Walsh

Digital privacy expert with 5 years experience testing and reviewing VPNs. He's been quoted in The Express, The Times, The Washington Post, The Register, CNET & many more. Ray is currently rated #4 VPN and #3 internet privacy authority by Agilience.com.

0 Comments

There are no comments yet.

Write Your Own Comment

Your comment has been sent to the queue. It will appear shortly.

Your comment has been sent to the queue. It will appear shortly.

Your comment has been sent to the queue. It will appear shortly.

  Your comment has been sent to the queue. It will appear shortly.

We recommend you check out one of these alternatives: