--- title: "Is Runbox Safe? Norwegian Privacy, Readable Mail" date: "2026-11-12" author: "Ahsan Luqman" canonical_url: "https://aliasfleet.com/blog/is-runbox-safe" tags: ["Email Safety", "Runbox", "Privacy"] description: "Runbox is a Norwegian email service in operation since 2000. Its protection rests on Norwegian law and GDPR, not on end-to-end encryption by default." --- # Is Runbox Safe? Norwegian Privacy, Readable Mail Runbox is a Norwegian email service in operation since 2000. Its protection rests on Norwegian law and GDPR, not on end-to-end encryption by default. Runbox is a paid email service run by Runbox Solutions AS from Oslo, Norway. The service has operated since 2000, keeps mail on servers the company owns in Oslo, and bases its protection on Norwegian law and the [GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679) rather than on encryption of stored mail. Connections to Runbox use TLS with Perfect Forward Secrecy, stored data carries full-disk encryption, and no end-to-end encryption applies by default, so the operator can read stored mail. The two sides of the service sit far apart. Sign-in controls are thorough, the bar for disclosure is high, and the published request figures are small. Stored mail is readable by the operator at the same time, no published date exists for account-level encryption, and no published independent security audit was found. Strong sign-in controls and a high disclosure bar stand beside readable stored mail, no published audit, and no encryption date. ## Company background An independent review dates the start of Runbox to August 2000, when the service offered 100 MB of storage without charge. [Runbox](https://runbox.com/) gives its own operating history as more than 25 years and counts 26 years on its comparison page. The company is independent and employee owned, with no venture capital. Its homepage gives the scale as over 1 million accounts served and customers in over 170 countries, both figures being the company's own claims. Mail sits on servers Runbox owns inside a maximum security data centre in Oslo. The data centre was originally constructed for the Norwegian Government Computer Centre. The centre runs on 100 percent renewable energy, mainly Norwegian hydropower, and describes its operations as carbon negative through double offsetting. Ethical Consumer has named Runbox a Best Buy in each year since 2020. ## Norwegian law and jurisdiction Norway belongs to the European Economic Area, and the GDPR applies there through the Norwegian Personal Data Act. Enforcement belongs to the Norwegian Data Protection Authority, [Datatilsynet](https://www.datatilsynet.no/), which began work on 1 January 1980 and ranks among the oldest data protection agencies in the world. [Runbox records](https://runbox.com/about/norwegian-privacy/) that it collects only the data needed to run the service, that Norwegian law does not ordinarily require it to retain traffic logs, and that it deletes user data on request. Disclosure turns on a court order. Runbox [requires a Norwegian court order](https://runbox.com/blog/2026/03/why-we-require-a-norwegian-court-order-to-disclose-user-data/) under the Norwegian Criminal Procedure Act before it gives information to the Norwegian police, and it applies the same test to requests from foreign authorities. A foreign request ordinarily passes through diplomatic channels and the Ministry of Justice before it reaches a Norwegian court. Runbox records that a subpoena, a warrant, or a request from a government or foreign agency does not suffice on its own. The same pages record that the company complies with legally valid requests where Norwegian law or its Terms of Service have clearly been broken, so the court order rule sets a high bar rather than a refusal to cooperate in all cases. ## The United States CLOUD Act The United States CLOUD Act of 2018 allows United States authorities to compel a United States company, or a company using infrastructure under United States control, to hand over user data wherever the data is stored. Runbox records that [the Act does not apply](https://runbox.com/blog/2026/04/runbox-vs-the-cloud-act-your-data-stays-safe-in-norway/) to the service, because the company is Norwegian, owns its servers in Oslo, and uses no infrastructure under United States control. Its business pages add that GDPR Article 48 restricts transfers of personal data to authorities outside the European Union. The position rests on server ownership and location, and it is the company's legal position, not a point settled by a court. Norway belongs to the Nine Eyes intelligence-sharing arrangement, a point an independent review raises when it weighs Norway against Switzerland as a location for email. Runbox does not discuss the point on its own pages. ## Mail protection in transit and at rest Every connection to Runbox servers carries TLS with Perfect Forward Secrecy, and the servers carry full-disk encryption at rest. Full-disk encryption guards against a drive that is physically taken. It leaves stored mail readable by the operator, because the operator holds the keys. Runbox states the position plainly on its [comparison page](https://runbox.com/features/runbox-compared/): account-level and end-to-end encryption are not offered by default yet, and platform upgrades are under way to prepare for them. No date is given for that work. No published independent security audit of Runbox was found while this article was prepared, and no ISO 27001 certificate appeared on the company's primary pages. The absence of a published audit is a gap in public evidence, not a record of a failed audit. Users can add end-to-end encryption themselves. PGP works in webmail through the [Mailvelope](https://www.mailvelope.com/) browser extension, and S/MIME works through mail clients, with OpenPGP built into Thunderbird and native S/MIME support in Apple Mail. Runbox notes in [its September comparison](https://runbox.com/blog/2026/09/how-runbox-compares-to-proton-tuta-fastmail-posteo-and-mailbox/) that end-to-end encryption holds in full only between users of the same system, and a message sent to a Gmail or Outlook address carries no end-to-end encryption unless keys have been exchanged. The comparison places Runbox beside Fastmail in the group without account-level encryption by default, while Proton and Tuta encrypt by default. Mail is therefore guarded in transit and at rest against outsiders, while the operator and a lawful order can still reach it. ## Login and session protection Two-factor authentication rests on TOTP codes from an authenticator app, with six-digit codes that change every 30 seconds. App passwords allow Outlook, Apple Mail, or Thunderbird to connect without the main account password. Trusted browsers, an unlock code held as a backup for two-factor authentication, per-protocol service toggles, IP-based access control, and active session monitoring complete the set, and session monitoring allows access to be inspected and revoked at any time. Every provider in the comparison group offers some form of two-factor authentication, so it does not distinguish Runbox. The combination of app passwords, trusted browsers, an unlock code, and per-protocol toggles is the thorough part of the Runbox set. On IP addresses, an independent review lists the removal of IP addresses from outgoing messages as a benefit. Runbox does not state that on its own pages, so the claim belongs to the review and not to Runbox. ## Advertising, tracking and server logs Subscriptions fund the service in full. Runbox shows no advertisements, uses no third-party tracking tools and no web beacons, and records that it uses neither Google Analytics nor any other third-party tracking. Mail passes through scanning for virus and spam protection only, and the company records that it [never scans messages for advertising](https://runbox.com/blog/2025/01/protecting-your-privacy-the-runbox-commitment/), data mining, or sharing with third parties. [The privacy policy](https://runbox.com/about/privacy-policy/) records that the hosting provider and the ISP keep no logs of traffic to or from the Runbox servers. Server logs for email delivery are kept for 10 days, and server logs for use of the web interface are kept for 1 month. The logs stay on the servers that run the service and go to no other company. The privacy policy records that incoming and outgoing mail may pass through automatic scanning for virus and spam protection, and that mail contents are indexed automatically to provide search. The policy page itself carries a 2018 date, while the [privacy pages](https://runbox.com/why-runbox/privacy-protection/) around it were updated during 2026. Email content is kept for up to 6 months after a paid account closes and up to 1 month after a trial account closes, with immediate deletion available on request to support. Account information is kept for up to 5 years after closure, as Norwegian bookkeeping law requires. Backups of account content sit on separate secure servers for up to 6 months, even after the content has gone from main storage. ## Disclosure requests and the transparency record Runbox publishes a [Transparency Report](https://runbox.com/why-runbox/privacy-protection/transparency-report/) with figures for requests for disclosure of individual customer data received directly from authorities and others. The page stood up to date as of 9 September 2026 when this article was prepared. The figures are small. | Year | Norwegian requests | Foreign requests | Outcome | | --- | --- | --- | --- | | 2026 | 0 | 1 | 1 complied with | | 2025 | 1 | 3 | Norwegian request complied with; 1 foreign complied with, 2 rejected | | 2024 | 2 | 4 | Both Norwegian complied with; 1 foreign complied with, 3 rejected | Few requests reach Runbox, and a share of the foreign requests are turned down, which supports the court order claim. The company still complies when the legal standard is met, including with the single foreign request in 2026, which matches its own statement that it is not a safe haven for criminal activity. ## Plans and prices Runbox has no free tier. A 30-day free trial comes with every plan, and a 60-day money-back guarantee applies to paid subscriptions. Six plans are listed by [an independent review](https://cyberinsider.com/email/reviews/runbox/), because the official pricing page did not render content when checked for this article: Micro with 2 GB of mail storage at $19.95 per year, Mini with 10 GB at $34.95, Medium with 25 GB at $49.95, Max with 50 GB at $79.95, Max 100 with 100 GB at $119.95, and Max 250 with 250 GB at $179.95. [Three-year plans](https://runbox.com/blog/2025/10/we-are-celebrating-25-years-with-new-3-year-sub-account-plans/) are available at a discount, including for sub-accounts since October 2025. Every plan includes 100 aliases on Runbox domains, unlimited aliases on the user's own domain, and unlimited plus-addressing, according to the [Runbox help pages](https://help.runbox.com/features-and-quotas/). All plans include calendar and contacts over CalDAV and CardDAV, file storage, and standard IMAP, POP, and SMTP access. The Runbox 7 webmail is open source and available on GitHub, while the rest of the service is not. Payment takes cards, PayPal, wire transfer, cryptocurrencies, and cash, according to the [Runbox help pages](https://help.runbox.com/runbox-7-payment-methods/). Runbox [describes the model](https://runbox.com/blog/2025/03/decentralized-email-for-maximum-privacy-and-security/) as email only, with no ads and no data mining, funded by subscriptions. ## AliasFleet and Runbox [AliasFleet](https://aliasfleet.com/blog/are-email-aliases-safe) provides managed, persistent email aliases that forward to a destination inbox. Runbox serves as that destination inbox: forwarded mail arrives at the Runbox address, while the Runbox address itself is never given to websites or services. A leak or a spam run against one alias stays with that alias, and the Runbox address stays unexposed. Two-factor authentication codes can be [received at an alias](https://aliasfleet.com/blog/can-you-receive-two-factor-authentication-codes-at-an-email-alias), so sign-in and recovery mail can also stay behind aliases. AliasFleet does not encrypt mail and does not replace the destination inbox; the Runbox account still holds the mail, and the limits set out above still apply to it. The separation between the address given out and the address that holds the mail is the point of pairing aliases with a provider such as Runbox. [Have I Been Pwned](https://haveibeenpwned.com/) checks whether an address has already appeared in a breach. ## Runbox beside other providers The same trust series covers [Posteo](https://aliasfleet.com/blog/is-posteo-safe), [GMX](https://aliasfleet.com/blog/is-gmx-mail-safe), and [iCloud](https://aliasfleet.com/blog/is-icloud-mail-safe), and Runbox differs from each in the same way: jurisdiction, rather than encryption, is the selling point. Posteo is a German provider with optional encrypted mailbox storage, and the Posteo piece turns on that option. GMX is a free ad-supported German service, and the GMX piece turns on the advertising model. iCloud Mail is tied to Apple accounts and Apple infrastructure, and the iCloud piece turns on that integration. Runbox is the provider in the series whose case rests on Norwegian law, a published transparency record, and a long operating history, with readable stored mail as the stated cost. Proton and Tuta encrypt by default. Those properties fit a reader who wants a stable paid inbox under strong privacy law and accepts the encryption limit. [The Have I Been Pwned safety piece](https://aliasfleet.com/blog/is-have-i-been-pwned-safe) covers the breach-checking service named above in more detail.