As of 6 Nov 2026, the panel rates mailbox.org Business 3/5 and Tuta Business 3/5 in Business Email & Office Suites. Weighted by what each judge cares about, 5 of the 6 judges pick mailbox.org Business and 1 picks Tuta Business. mailbox.org Business scores higher on 4 of 7 criteria (Calendar, contacts & office apps, Migration, open standards & exit, Administration, identity & partner management, plus 1 more). Tuta Business scores higher on 3 of 7 criteria (European sovereignty, Security, encryption & compliance archiving and Pricing transparency). Provenance — mailbox.org Business: EU-Made; Tuta Business: EU-Made. Ratings are the AI panel’s opinion, formed from public evidence: how scores are made.
mailbox.org Business leads four criteria — mail and deliverability (5.5 vs 5.0; four lean), calendar and office (5.5 vs 4.0; five lean), administration and identity (5.3 vs 4.2; five lean), migration and portability (5.0 vs 3.8; five lean). Tuta Business leads sovereignty (8.2 vs 6.0; five lean, one tie), security and compliance (7.0 vs 5.7; two lean, four tie) and, on mean, pricing transparency (6.5 vs 5.8; leans split two mailbox.org Business, one Tuta Business, three tie). Weighted totals favor mailbox.org Business for the IT administrator (6.3 vs 5.3), public-sector IT lead (6.8 vs 5.5), IT service provider (6.8 vs 5.2), skeptic (6.4 vs 5.7); the data protection officer totals 5.7 for Tuta Business against 0; the small-firm owner shows no total. Both carry the same EU made provenance, and each recorded sovereignty attribute — legal entity jurisdiction, data residency, hosting options, open source, DPA, TIA — reads "unknown."
Choose mailbox.org Business if
You need IMAP or POP3 access for desktop clients: four of six judges lean mailbox.org Business on mail and deliverability (5.5 vs 5.0), and the Tuta Business verdict records a vendor-stated absence of IMAP and a 100 emails-per-hour cap.
Your team wants calendar, browser office editing, drive and video meetings in one bundle: calendar and office scores 5.5 vs 4.0 with five judges leaning mailbox.org Business, and the Tuta Business verdict found no public information on document co-editing.
You are moving accounts from Gmail, Outlook.com or T-Online: migration and portability leans mailbox.org Business five to one (5.0 vs 3.8), and the published Audriga list names those sources.
You are a public-sector IT lead or IT service provider: those weighted totals read 6.8 vs 5.5 and 6.8 vs 5.2 for mailbox.org Business.
Your priorities match the IT administrator's or the skeptic's: those weighted totals read 6.3 vs 5.3 and 6.4 vs 5.7.
Choose Tuta Business if
You need end-to-end encryption the vendor states even it cannot read: security and compliance scores 7.0 vs 5.7, with two judges leaning Tuta Business and four tied, crediting quantum-safe encryption.
Sovereignty is your deciding criterion: Tuta Business scores 8.2 vs 6.0, five judges lean its way with one tie, and the verdict credits hosting on its own servers in ISO 27001 certified data centres in Germany.
Your compliance file needs a published data processing agreement and a named SySS penetration test, both recorded in the Tuta Business verdict.
Your data protection officer holds the deciding vote: that judge's weighted total reads 5.7 for Tuta Business against 0 for mailbox.org Business, whose verdict records that judge's scores as 0 on the same seven criteria.
Read this comparison as one judge. Each weighs the same scores by what they care about.
The IT Administrator
IT administrator at a machine builder in Baden-Württemberg with three hundred mailboxes, an on-premises Exchange that reaches end of support, and Active Directory as the source of every account. Wants Outlook to keep working without a plug-in nobody maintains, shared mailboxes and room booking, single sign-on and directory sync, mobile devices that can be wiped, an API for provisioning, and a migration that moves calendars and permissions, not only mail.
mailbox.org Business
This judge's pick
Tuta Business
Criterion by criterion
Mail, domains & deliverability
mailbox.org Business
Custom domains are covered with a step-by-step DNS set-up — MX records, SPF, four DKIM keys as CNAME, DMARC with report guidance, TXT validation and a catch-all mailbox — and the transport security is exactly what the BSI asks of us: DNSSEC, DANE/TLSA and MTA-STS, with virus and spam filtering at receipt. But for three hundred Outlook users the protocol list stops at webmail, IMAP and POP3; we found no public information on Exchange ActiveSync or native MAPI, so Outlook mail would run over IMAP and the calendar only through a third-party CalDAV plug-in. We also found no public information on shared or functional mailboxes, server-side rules, out-of-office replies, send limits or a quarantine an admin can review.
Tuta Business
The custom-domain DNS story is well documented — TXT ownership proof, MX, SPF, DKIM, MTA-STS and a recommended DMARC record, with a status check — and tiers state storage (50/500/1000 GB), alias counts, catch-all, shared mailboxes, a 25 MB attachment limit and a 100-mails-per-hour cap.
Calendar, contacts & office apps
mailbox.org Business
The suite is genuine: browser editing of documents, spreadsheets and presentations in common Office formats, live co-editing, drive storage with guest sharing and mobile apps, video meetings and tasks in the paid plans, and CalDAV/CardDAV documented down to concrete URLs with DAVx5, Thunderbird and Outlook via CalDAV Synchronizer. What an Exchange shop like ours misses is the groupware layer on top: we found no public information on free/busy lookup, room and resource booking with approval, delegated calendar access or a company-wide directory, and no native desktop applications are documented.
Tuta Business
Shared calendars with read-only, read-write and manage-sharing permission levels, multiple calendars, iCal invitations,.ics import/export and free desktop and mobile apps with encrypted reminders are documented. We found no public information on free/busy lookup, room and resource booking, a company-wide address book or co-editing of office documents — Tuta Drive is file storage still in closed beta — and the calendar comparison page shows a CalDAV row without making clear from the capture where Tuta stands on it.
Security, encryption & compliance archiving
mailbox.org Business
Encryption is unusually strong: TLS with perfect forward secrecy, PGP and S/MIME end-to-end inside the webmailer in every plan, optional re-encryption of stored mail with the customer's own key with no provider-held recovery key, plus a published transparency report naming the share of authority requests rejected and ISO 27001 and BSI C5 stated alongside the BSI IT security label for secure mail transport. Two-factor sign-in is optional rather than enforced, and we found no public information on GoBD-compliant archiving, retention policies, legal hold or eDiscovery — for a German machine builder that gap matters, as does a backup snapshot held for only seven days on a non-contractual basis.
Tuta Business
End-to-end encryption by default (AES 256 with post-quantum Kyber-1024), a provider that states even it cannot read mailbox content, admin-enforced two-factor for all users of a paid account, ISO 27001 certified data centres in Germany, a SySS penetration test and published open-source clients put the core protection well above average. GDPR and GoBD compliance are claimed outright, but we found no public information on retention policies, legal hold, eDiscovery, a transparency report on authority requests, or the auditor and scope behind the ISO 27001 certificate — the questions a compliance audit of my archive would ask first.
Administration, identity & partner management
mailbox.org Business
The admin console manages contract, domains, mailboxes, forwards, passwords and storage centrally, business accounts can be created in bulk by CSV, there is a documented API aimed at larger environments and resellers, and the reseller tier is real: creating and deleting customer accounts, tariff limits, white-label billing, invoice export in PDF and CSV, and support packages with stated response times and 24/7 in the top package. The identity story stops short of what we run, though — we found no public information on Active Directory, Entra ID or LDAP sync, SCIM provisioning, admin role models, mobile device policies with remote wipe, or exportable audit logs, and single sign-on is offered only as individual integrations without a named protocol.
Tuta Business
There is an administration console with multiple admin roles, user management, sign-in-as-user, centralized billing, admin password resets and removal of second factors, plus whitelabeling and per-plan email or priority email support from a team based in Hanover. For a three-hundred-mailbox shop on Active Directory, we found no public information on single sign-on via SAML or OpenID Connect, directory synchronisation, SCIM provisioning, a documented provisioning API, mobile device policies with remote wipe, exportable audit logs or reseller accounts — only the remote closing of sessions is described.
Migration, open standards & exit
mailbox.org Business
The Audriga partner service imports mail, calendars, contacts and files automatically, a migration assistant sits in the settings menu, iCal and vCard import and calendar export to file are documented with concrete provider walkthroughs, and the terms state irretrievable deletion thirty days after the contract ends with a thirty-day holding period beforehand. What we found no public information on is the move we actually face: Exchange and Microsoft 365 are absent from the supported provider lists, and permissions, free/busy coexistence during the move, an admin-side export of the whole organisation and any self-hosted edition are not documented; mail export is described only as downloading or copying from a client.
Tuta Business
Import of contacts and calendars via.ics is documented, mail can be brought over by forwarding from a list of providers, personal data is deleted no later than 30 days after termination, and all clients are open source under GPLv3 with self-build documentation for Linux.
European sovereignty
mailbox.org Business
Heinlein Hosting GmbH of Berlin is the named operator and data controller with a commercial register number, servers stand exclusively in Berlin on the provider's own hardware with green power, German law governs the contract, a GDPR data processing agreement is offered in the paid plans (and one under section 43e BRAO on request), and ISO 27001 and BSI C5 are stated. The chain is not fully evidenced: the captured pages name no data centres and list no subprocessors with their locations, so hosting in Germany and a German entity are proven while the rest of the chain remains open.
Tuta Business
The chain is proven on the vendor's own pages: Tutao GmbH of Hanover is the contracting entity (registered under HRB 208014, VAT DE280903265), mail, calendars and drive sit on the company's own servers in ISO 27001 certified data centres in Germany, a data processing agreement is published, a data protection officer is named, and the listed subprocessors are PayPal (Luxembourg) and Braintree (USA) for card payments with the US transfer disclosed. Because content is end-to-end encrypted, the provider states it cannot read it; we found no public information on the named data-centre operator or a published certification report with its scope.
Pricing transparency
mailbox.org Business
Prices are public and exact — Light at 1 €, Standard at 4 € and Premium at 12 € per month with mail and drive storage per tier, extra storage priced per gigabyte, alias and disposable-address counts, terms (Light yearly, Standard and Premium monthly), a 30-day trial, one-month cancellation, and VAT treatment stated for consumer prices included by country and business prices exclusive under reverse charge. What we could not compute from the pages: minimum users for a business deployment, the cost of the Silver, Gold and Platinum support packages, catch-all or shared mailbox fees, and what a business migration via the partner costs — we found no public information on those, nor any priced archiving item.
Tuta Business
Business tiers are public with per-user prices — Essential at '€6 /user/month', Advanced at '€8 /user/month', Unlimited at '€12 /user/month', each paid yearly and 'Excludes taxes.' — together with storage of 50, 500 or 1000 GB, custom domain counts of 3, 10 or unlimited, extra address counts, support level, a one-year initial term turning into a cancellable non-fixed contract, payment methods including invoice for business customers, and even a 50,00 EUR blocking and unblocking fee. What I could not compute from the pages is the monthly-billing price, any minimum user count, or add-on prices such as extra storage; the 'Save €19.20' savings are shown without the undiscounted base being spelled out.
Sovereignty, side by side
Dimension
mailbox.org Business
Tuta Business
Legal entity
Not determined
Not determined
Hosting location
Not determined
Not determined
Hosting options
Not determined
Not determined
Open source
Not determined
Not determined
Data processing agreement
Not determined
Not determined
Transfer impact assessment
Not determined
Not determined
Facts, side by side
Only facts both products carry under the same definition — anything else would not be a fair row.
Questions about mailbox.org Business and Tuta Business
Which is better, mailbox.org Business or Tuta Business?
As of 6 Nov 2026, the panel rates both 3/5. Weighted by what each judge cares about, 5 of the 6 judges pick mailbox.org Business and 1 picks Tuta Business. Which one fits depends on the criteria that matter to you; the table on this page shows both side by side, and each judge’s reading has its own page. Both were scored by the same AI bench under the same rubric, from public evidence only, as the methodology describes.
Is mailbox.org Business or Tuta Business European?
mailbox.org Business is European (EU-Made). Tuta Business is European (EU-Made). Provenance is read from each company’s own legal pages: who builds it and who owns it.
Where do mailbox.org Business and Tuta Business store customer data?
Per the vendors’ own pages as captured — mailbox.org Business: Default not stated; pages mention Germany. Tuta Business: Default not stated; pages mention Germany.
Do mailbox.org Business and Tuta Business have a free plan?
As of 6 Nov 2026, Tuta Business’s own pages state a free plan; mailbox.org Business’s pages as captured do not. Each product page links the pricing page it was read from.