As of 6 Nov 2026, the panel rates mailbox.org Business 3/5 and Tuta Business 3/5 in Business Email & Office Suites. Weighted by what each judge cares about, 5 of the 6 judges pick mailbox.org Business and 1 picks Tuta Business. mailbox.org Business scores higher on 4 of 7 criteria (Calendar, contacts & office apps, Migration, open standards & exit, Administration, identity & partner management, plus 1 more). Tuta Business scores higher on 3 of 7 criteria (European sovereignty, Security, encryption & compliance archiving and Pricing transparency). Provenance — mailbox.org Business: EU-Made; Tuta Business: EU-Made. Ratings are the AI panel’s opinion, formed from public evidence: how scores are made.
mailbox.org Business leads four criteria — mail and deliverability (5.5 vs 5.0; four lean), calendar and office (5.5 vs 4.0; five lean), administration and identity (5.3 vs 4.2; five lean), migration and portability (5.0 vs 3.8; five lean). Tuta Business leads sovereignty (8.2 vs 6.0; five lean, one tie), security and compliance (7.0 vs 5.7; two lean, four tie) and, on mean, pricing transparency (6.5 vs 5.8; leans split two mailbox.org Business, one Tuta Business, three tie). Weighted totals favor mailbox.org Business for the IT administrator (6.3 vs 5.3), public-sector IT lead (6.8 vs 5.5), IT service provider (6.8 vs 5.2), skeptic (6.4 vs 5.7); the data protection officer totals 5.7 for Tuta Business against 0; the small-firm owner shows no total. Both carry the same EU made provenance, and each recorded sovereignty attribute — legal entity jurisdiction, data residency, hosting options, open source, DPA, TIA — reads "unknown."
Choose mailbox.org Business if
You need IMAP or POP3 access for desktop clients: four of six judges lean mailbox.org Business on mail and deliverability (5.5 vs 5.0), and the Tuta Business verdict records a vendor-stated absence of IMAP and a 100 emails-per-hour cap.
Your team wants calendar, browser office editing, drive and video meetings in one bundle: calendar and office scores 5.5 vs 4.0 with five judges leaning mailbox.org Business, and the Tuta Business verdict found no public information on document co-editing.
You are moving accounts from Gmail, Outlook.com or T-Online: migration and portability leans mailbox.org Business five to one (5.0 vs 3.8), and the published Audriga list names those sources.
You are a public-sector IT lead or IT service provider: those weighted totals read 6.8 vs 5.5 and 6.8 vs 5.2 for mailbox.org Business.
Your priorities match the IT administrator's or the skeptic's: those weighted totals read 6.3 vs 5.3 and 6.4 vs 5.7.
Choose Tuta Business if
You need end-to-end encryption the vendor states even it cannot read: security and compliance scores 7.0 vs 5.7, with two judges leaning Tuta Business and four tied, crediting quantum-safe encryption.
Sovereignty is your deciding criterion: Tuta Business scores 8.2 vs 6.0, five judges lean its way with one tie, and the verdict credits hosting on its own servers in ISO 27001 certified data centres in Germany.
Your compliance file needs a published data processing agreement and a named SySS penetration test, both recorded in the Tuta Business verdict.
Your data protection officer holds the deciding vote: that judge's weighted total reads 5.7 for Tuta Business against 0 for mailbox.org Business, whose verdict records that judge's scores as 0 on the same seven criteria.
Read this comparison as one judge. Each weighs the same scores by what they care about.
The Public Sector IT Lead
Head of IT at a district administration in Bavaria with eleven hundred staff, told by the council to leave Microsoft within three years. Has read what Schleswig-Holstein did and what it cost. Needs mail, calendars and documents that a whole administration can work in, open formats and open source where possible, BSI C5 or ISO 27001 on paper, a provider whose owners answer to European law only, and an exit plan before the contract is signed.
mailbox.org Business
This judge's pick
Tuta Business
Criterion by criterion
Mail, domains & deliverability
mailbox.org Business
Mailboxes on custom domains with webmail, IMAP and POP3, per-plan storage of 2, 20 and 50 GB, spam and virus filtering, and a thoroughly documented DNS set-up covering MX records, SPF, four DKIM keys and DMARC with reporting guidance; DANE, MTA-STS and DNSSEC are in use, the plans carry the BSI IT security label under TR 03108, and catch-all mailboxes are documented. For an administration of our size, though, we found no public information on Exchange ActiveSync or native Outlook connectivity, out-of-office replies and server-side rules, send or attachment limits, or a quarantine an administrator can review.
Tuta Business
Custom domains come with a documented DNS set-up including SPF, DKIM, DMARC and MTA-STS, catch-all, up to thirty aliases per user plus unlimited aliases on the own domain, shared mailboxes, a self-learning spam filter with custom rules, and stated send limits and mailbox storage per tier. The captured pages also give different figures for maximum message size, 20 MB in the terms against 25 MB attachments on the pricing page.
Calendar, contacts & office apps
mailbox.org Business
The bundle includes shared calendars and address books, tasks, browser editing of documents and spreadsheets with real-time co-editing, drive storage with guest sharing and expiry-dated links, video meetings in every plan, and CalDAV and CardDAV synchronisation documented down to URLs and clients including DAVx⁵, Thunderbird and Outlook via CalDAV Synchronizer. For a Microsoft 365 replacement we found no public information on free/busy lookup across providers, room and resource booking, delegated calendar access, or lossless editing of Microsoft file formats — and the web client itself cannot subscribe to external calendars.
Tuta Business
Shared calendars with graded access rights (read only, read and write, write and manage sharing), multiple calendars, recurring events, invitations via iCal and.ics import and export are documented, with apps for Windows, macOS, Linux, Android and iOS. I found no public information on free/busy lookup, room and resource booking, a company-wide address book or co-editing of any documents, and the file storage in the bundle is in closed beta — for an administration leaving Microsoft 365 this is not yet a workplace suite.
Security, encryption & compliance archiving
mailbox.org Business
PGP and S/MIME end-to-end encryption in the webmailer, optional encryption of stored mail and files with the customer's own key and no provider-held recovery key, two-factor sign-in in all plans, seven-day backups, and published ISO 27001 and BSI C5 alongside a transparency report on authority requests complete with rejection rates. Two-factor is optional rather than enforceable for all users, and we found no public information on GoBD-compliant archiving, retention policies or legal hold — for a district administration with statutory retention duties that gap would have to be closed by a separate archive.
Tuta Business
End-to-end encryption under which even Tutao GmbH cannot read content, quantum-safe algorithms, two-factor enforceable by administrators for all users of a paid account, ISO 27001 certified data centres in Germany, a SySS penetration test, a claimed GDPR and GoBD compliance and a published data processing agreement are all documented, and the open-source clients invite review. What I would miss in a real audit are retention policies, legal hold, eDiscovery and a stated restore period for deleted mail, on which I found no public information, and the ISO 27001 scope and auditor are not published; the captured pages also give different statements on backups, with automatic backups advertised on the business page while the terms place timely storage and backup of the data on the customer.
Administration, identity & partner management
mailbox.org Business
A central web console manages contract, domains, mailboxes, forwards, passwords and storage, accounts can be created by CSV or through an API, catch-all addresses are configured in the console, and there is a genuinely mature reseller programme with white-label billing, PDF and CSV invoice export and tiered support packages; support response times are stated per plan next to a 99.9% availability commitment. We found no public information on Active Directory, Entra ID or LDAP synchronisation, SCIM provisioning, admin roles, mobile device policies with remote wipe, or exportable audit logs — with eleven hundred accounts I would be provisioning and auditing by hand.
Tuta Business
An administration console with multiple admin roles, user management, sign-in-as-user, centralized billing, admin-managed second factors, password resets by internal administrators and white-label options is documented, with email or priority email support per plan from a team based in Hanover. I found no public information on single sign-on, Active Directory or LDAP synchronisation, SCIM provisioning, a provisioning API, audit logs, or mobile device policies with remote wipe — precisely what my team needs to run eleven hundred accounts day to day.
Migration, open standards & exit
mailbox.org Business
A documented migration service through the partner Audriga moves mail, calendars, contacts and files from IMAP and POP3 mailboxes with a named provider list and an in-product migration assistant, manual drag-and-drop is described as an alternative, calendar import and export are documented, the switch is described as occurring without operational interruption, and end-of-contract handling is clear: a 30-day retention after contract end with deletion thereafter, while domains remain at the customer's own registrar. The named source providers include Gmail, Outlook.com and GMX but not Exchange or Microsoft 365, and we found no public information on organisation-wide export by an administrator or a self-hosted edition — our exit from Exchange would rest on a generic IMAP path.
Tuta Business
Getting mail in is documented as forwarding from a list of named providers plus an import of emails, contacts and calendars, while another captured page lists email import among planned next development steps — the captured pages give different pictures here.
European sovereignty
mailbox.org Business
The operator and data controller is Heinlein Hosting GmbH of Berlin, registered at the Amtsgericht Berlin-Charlottenburg under HRB 220010 B and part of a German group, with servers exclusively in Germany on the provider's own hardware in Berlin data centres, German governing law, a GDPR data processing agreement offered in the Standard and Premium plans, a § 43e BRAO agreement on request, and ISO 27001 and BSI C5 stated alongside the Software Hosted in Germany seal. What holds this below the top mark: the captured pages name individual third parties such as video analytics via Conviva and the migration partner Audriga, but we found no public list of subprocessors with their locations, and no self-hosted edition is documented.
Tuta Business
This is the strongest part: Tutao GmbH of Hanover, registered at the district court there, hosts on its own servers in ISO 27001 certified data centres in Germany, states it is its own ISP, independent of the US Cloud Act, with no offices in the USA, and publishes a data processing agreement; content is only disclosed on a valid order from a German judge. The one documented third-country transfer is credit card data to Braintree in the USA, which we could avoid by paying on invoice; the data centre operators are not named and no BSI C5 appears, so I stop short of the top mark.
Pricing transparency
mailbox.org Business
All three tiers are public — Light at 1 € per month, Standard at 4 €, Premium at 12 € — with mail storage of 2, 20 and 50 GB, drive storage of 10 and 100 GB in the paid tiers, priced add-on storage (mail per 1 GB at 0,20 € or 0,10 € depending on tier, drive per 5 GB at 0,40 € or 0,20 €) and per-plan feature tables; the business terms state monthly invoicing in advance, a 14-day payment term and a one-month termination right. However, the consumer price page shows prices including VAT while the business terms state all fees exclusive of VAT — a buyer must reconcile that — and we found no public information on minimum seats, shared or functional mailbox pricing, or the cost of the Silber, Gold and Platin support packages.
Tuta Business
The three business tiers are public at €6, €8 and €12 per user/month paid yearly, each with its storage (50 GB, 500 GB, 1000 GB), number of custom domains, extra addresses and support level, VAT stated as excluding taxes, and contract terms that become a non-fixed term cancellable at any time after the initial period. What I still cannot compute from the pages alone is the monthly-billing price, any minimum user count or the cost of additional storage, and the terms carry a fee of 50,00 EUR including purchase tax for each blocking and each unblocking of the service.
Sovereignty, side by side
Dimension
mailbox.org Business
Tuta Business
Legal entity
Not determined
Not determined
Hosting location
Not determined
Not determined
Hosting options
Not determined
Not determined
Open source
Not determined
Not determined
Data processing agreement
Not determined
Not determined
Transfer impact assessment
Not determined
Not determined
Facts, side by side
Only facts both products carry under the same definition — anything else would not be a fair row.
Questions about mailbox.org Business and Tuta Business
Which is better, mailbox.org Business or Tuta Business?
As of 6 Nov 2026, the panel rates both 3/5. Weighted by what each judge cares about, 5 of the 6 judges pick mailbox.org Business and 1 picks Tuta Business. Which one fits depends on the criteria that matter to you; the table on this page shows both side by side, and each judge’s reading has its own page. Both were scored by the same AI bench under the same rubric, from public evidence only, as the methodology describes.
Is mailbox.org Business or Tuta Business European?
mailbox.org Business is European (EU-Made). Tuta Business is European (EU-Made). Provenance is read from each company’s own legal pages: who builds it and who owns it.
Where do mailbox.org Business and Tuta Business store customer data?
Per the vendors’ own pages as captured — mailbox.org Business: Default not stated; pages mention Germany. Tuta Business: Default not stated; pages mention Germany.
Do mailbox.org Business and Tuta Business have a free plan?
As of 6 Nov 2026, Tuta Business’s own pages state a free plan; mailbox.org Business’s pages as captured do not. Each product page links the pricing page it was read from.