As of 6 Nov 2026, the panel rates mailbox.org Business 3/5 and Tuta Business 3/5 in Business Email & Office Suites. Weighted by what each judge cares about, 5 of the 6 judges pick mailbox.org Business and 1 picks Tuta Business. mailbox.org Business scores higher on 4 of 7 criteria (Calendar, contacts & office apps, Migration, open standards & exit, Administration, identity & partner management, plus 1 more). Tuta Business scores higher on 3 of 7 criteria (European sovereignty, Security, encryption & compliance archiving and Pricing transparency). Provenance — mailbox.org Business: EU-Made; Tuta Business: EU-Made. Ratings are the AI panel’s opinion, formed from public evidence: how scores are made.
mailbox.org Business leads four criteria — mail and deliverability (5.5 vs 5.0; four lean), calendar and office (5.5 vs 4.0; five lean), administration and identity (5.3 vs 4.2; five lean), migration and portability (5.0 vs 3.8; five lean). Tuta Business leads sovereignty (8.2 vs 6.0; five lean, one tie), security and compliance (7.0 vs 5.7; two lean, four tie) and, on mean, pricing transparency (6.5 vs 5.8; leans split two mailbox.org Business, one Tuta Business, three tie). Weighted totals favor mailbox.org Business for the IT administrator (6.3 vs 5.3), public-sector IT lead (6.8 vs 5.5), IT service provider (6.8 vs 5.2), skeptic (6.4 vs 5.7); the data protection officer totals 5.7 for Tuta Business against 0; the small-firm owner shows no total. Both carry the same EU made provenance, and each recorded sovereignty attribute — legal entity jurisdiction, data residency, hosting options, open source, DPA, TIA — reads "unknown."
Choose mailbox.org Business if
You need IMAP or POP3 access for desktop clients: four of six judges lean mailbox.org Business on mail and deliverability (5.5 vs 5.0), and the Tuta Business verdict records a vendor-stated absence of IMAP and a 100 emails-per-hour cap.
Your team wants calendar, browser office editing, drive and video meetings in one bundle: calendar and office scores 5.5 vs 4.0 with five judges leaning mailbox.org Business, and the Tuta Business verdict found no public information on document co-editing.
You are moving accounts from Gmail, Outlook.com or T-Online: migration and portability leans mailbox.org Business five to one (5.0 vs 3.8), and the published Audriga list names those sources.
You are a public-sector IT lead or IT service provider: those weighted totals read 6.8 vs 5.5 and 6.8 vs 5.2 for mailbox.org Business.
Your priorities match the IT administrator's or the skeptic's: those weighted totals read 6.3 vs 5.3 and 6.4 vs 5.7.
Choose Tuta Business if
You need end-to-end encryption the vendor states even it cannot read: security and compliance scores 7.0 vs 5.7, with two judges leaning Tuta Business and four tied, crediting quantum-safe encryption.
Sovereignty is your deciding criterion: Tuta Business scores 8.2 vs 6.0, five judges lean its way with one tie, and the verdict credits hosting on its own servers in ISO 27001 certified data centres in Germany.
Your compliance file needs a published data processing agreement and a named SySS penetration test, both recorded in the Tuta Business verdict.
Your data protection officer holds the deciding vote: that judge's weighted total reads 5.7 for Tuta Business against 0 for mailbox.org Business, whose verdict records that judge's scores as 0 on the same seven criteria.
Read this comparison as one judge. Each weighs the same scores by what they care about.
The Data Protection Officer
Data protection officer for a group of nine medical practices in North Rhine-Westphalia, where a referral letter sent by mail is patient data under professional secrecy. Reads the subprocessor list and the transparency report before the feature page, asks who at the provider can open a mailbox and under which law, and wants encryption the practices can actually use with outside doctors, archiving that satisfies the tax office, and a data processing agreement that names every server.
mailbox.org Business
Tuta Business
This judge's pick
Criterion by criterion
Mail, domains & deliverability
mailbox.org Business
Own domains are documented end to end — MX records, four DKIM keys as CNAME entries, SPF and DMARC guidance — plus catch-all, mailbox sizes stated per plan (2 GB, 20 GB, 50 GB), aliases including 250 on own domains in Premium, IMAP/POP3/webmail, and MTA-STS and DANE stated on the certifications page. We found no public information on Exchange ActiveSync or native Outlook (MAPI) access, a quarantine an administrator can review, out-of-office replies, server-side rules or stated send limits.
Tuta Business
Custom domains come with the DNS set-up documented record by record (SPF, DKIM, DMARC, MTA-STS) plus catch-all, shared mailboxes, up to 30 aliases per user with unlimited own-domain aliases, a self-learning spam filter with custom rules and inbox rules, and stated send and attachment limits. The pages themselves state that IMAP is not offered, and I found no public information on POP3, Exchange ActiveSync or native Outlook MAPI, nor on out-of-office replies or distribution lists.
Calendar, contacts & office apps
mailbox.org Business
Shared calendars and address books, CalDAV and CardDAV with documented URLs and a client list, tasks, in-browser editing of common office formats, a Drive with password-protected expiring shares and real-time guest co-editing, and video meetings in every plan cover what a practice team uses daily. We found no public information on free/busy lookup, meeting invitations across providers, room and resource booking, delegated calendar access or a company-wide directory.
Tuta Business
Shared calendars with read-only, read-write and sharing-management rights, invitations via iCal with.ics import and export, contacts synced to iPhone, iPad and Android, and desktop and mobile apps are documented, alongside an encrypted file store that its own page places in closed beta. I found no public information on free/busy lookup, room or resource booking, a company-wide address book, video meetings, chat, or co-editing of office documents.
Security, encryption & compliance archiving
mailbox.org Business
PGP and S/MIME in the webmailer with no provider-held recovery key, optional after-the-fact encryption of stored mail with the customer's own key, multi-stage malware scanning, a seven-day backup snapshot, a TÜV-certified data protection officer and a transparency report naming rejection rates for authority requests over three years give me a chain I can largely defend. But two-factor sign-in is stated as optional rather than enforced, and we found no public information on GoBD-compliant archiving, retention policies or legal hold — for patient correspondence and tax retention that gap must be closed before signature.
Tuta Business
The provider states its own staff cannot read mailbox content and names exactly what it can see (sender address, recipient address, date), with end-to-end and post-quantum encryption, admin-enforced second factors, ISO 27001 certified data centres in Germany and a named SySS penetration test. For a regulated practice the gaps weigh: GoBD compliance appears as a single claim with no audit-proof archiving, retention policies, legal hold or eDiscovery, there is no transparency report on authority requests, external encryption uses shared passwords rather than S/MIME or PGP, and the terms place the timely storage and backup of data on the customer.
Administration, identity & partner management
mailbox.org Business
A central console manages contract, domains, mailboxes, forwards, passwords and storage plus security settings (virus, spam, password protection, IP whitelisting, blacklists, backups), employee accounts can be created from CSV, an API is published, and reseller accounts administer several customer organisations with white-label billing and PDF/CSV invoice export, with support response times stated per plan (48 and 24 hours, Mo–Fr). Single sign-on is offered; we found no public information on the protocol used. We also found no public information on Active Directory or LDAP sync, SCIM provisioning, admin roles, mobile device policies with remote wipe, or exportable audit logs.
Tuta Business
An administration console with multiple admin roles, user management, sign-in-as-user, centralized billing, whitelabel customization and admin-enforced second factors is documented, with email and priority email support per tier from staff based in Hanover. I found no public information on single sign-on, directory synchronisation, SCIM provisioning, mobile device policies with remote wipe, exportable audit logs, a provisioning API, or partner and reseller accounts.
Migration, open standards & exit
mailbox.org Business
A named partner (Audriga) moves mail, calendars, contacts and files automatically from a published provider list including Gmail, Outlook.com and T-Online, available in Standard and Premium, with a migration assistant in the settings plus manual second-account and iCal import/export paths documented; after contract end all account data is irreversibly deleted following a 30-day holding period, statutory retention excepted, and the user is obliged to download beforehand. We found no public information on organisation-wide export by an administrator, export formats such as mbox, EML or PST, or a self-hosted or open-source edition.
Tuta Business
Getting in is documented as forwarding from named providers plus import of contacts and calendars with.ics export, and the privacy statement commits to deleting personal data no later than 30 days after termination — the captured pages give different statements on email import, one listing it as available and another among next development steps. The pages themselves state IMAP is not offered, and I found no public information on a migration tool for whole organisations, on mailbox or organisation-wide export in standard formats, or on a self-hosted edition; the GPLv3 open source and self-build instructions cover clients for Linux and F-Droid rather than a server.
European sovereignty
mailbox.org Business
Operator and controller are Heinlein Hosting GmbH of Berlin under German register and governing law, mail and office run on the provider's own servers in Berlin data centres, and a GDPR data processing agreement is offered in Standard and Premium — one under § 43e BRAO even on request — alongside ISO 27001, BSI C5 and the BSI TR 03108 IT security label. Spam filtering, backups and support are described as in-house, and authority requests are reviewed by the data protection officer with lawyers, a quarter to a third rejected in recent reports. We found no public information on a subprocessor list with locations; the migration partner Audriga is named but not located.
Tuta Business
The contracting entity is Tutao GmbH of Hanover, registered at the district court there, hosting runs on the provider's own servers in ISO 27001 certified data centres in Germany, a GDPR data processing agreement is published, and the payment subprocessors are named with locations — PayPal in Luxembourg and Braintree in the USA for card data, the one third-country transfer, disclosed as such. The data centres are not named individually and no complete subprocessor register beyond payment is captured, so the agreement must still name every server before we sign.
Pricing transparency
mailbox.org Business
Light 1 € pro Monat, Standard 4 € pro Monat and Premium 12 € pro Monat are published with mail storage (2/20/50 GB) and drive storage (0/10/100 GB) per tier, extra storage is priced (0,20 €/0,10 € per 1 GB mail, 0,40 €/0,20 € per 5 GB drive), terms per plan are stated (Light yearly, Standard and Premium monthly), and VAT is documented as included on the pricing page and excluded with reverse charge under the business terms. We found no public information on prices for the reseller support packages Silber, Gold and Platin, single sign-on, a business price for the Audriga migration, a minimum user count, or a monthly-versus-annual billing comparison.
Tuta Business
All three business tiers are public at €6, €8 and €12 per user per month paid yearly, each marked Excludes taxes, with storage of 50, 500 and 1000 GB, custom domains, extra email addresses and the support level per tier, and the term plus anytime cancellation after the initial period stated. I found no public information on a monthly business price per user, minimum users, or the cost of storage beyond the tier amounts.
Sovereignty, side by side
Dimension
mailbox.org Business
Tuta Business
Legal entity
Not determined
Not determined
Hosting location
Not determined
Not determined
Hosting options
Not determined
Not determined
Open source
Not determined
Not determined
Data processing agreement
Not determined
Not determined
Transfer impact assessment
Not determined
Not determined
Facts, side by side
Only facts both products carry under the same definition — anything else would not be a fair row.
Questions about mailbox.org Business and Tuta Business
Which is better, mailbox.org Business or Tuta Business?
As of 6 Nov 2026, the panel rates both 3/5. Weighted by what each judge cares about, 5 of the 6 judges pick mailbox.org Business and 1 picks Tuta Business. Which one fits depends on the criteria that matter to you; the table on this page shows both side by side, and each judge’s reading has its own page. Both were scored by the same AI bench under the same rubric, from public evidence only, as the methodology describes.
Is mailbox.org Business or Tuta Business European?
mailbox.org Business is European (EU-Made). Tuta Business is European (EU-Made). Provenance is read from each company’s own legal pages: who builds it and who owns it.
Where do mailbox.org Business and Tuta Business store customer data?
Per the vendors’ own pages as captured — mailbox.org Business: Default not stated; pages mention Germany. Tuta Business: Default not stated; pages mention Germany.
Do mailbox.org Business and Tuta Business have a free plan?
As of 6 Nov 2026, Tuta Business’s own pages state a free plan; mailbox.org Business’s pages as captured do not. Each product page links the pricing page it was read from.