As of 6 Nov 2026, the panel rates mailbox.org Business 3/5 and Tuta Business 3/5 in Business Email & Office Suites. Weighted by what each judge cares about, 5 of the 6 judges pick mailbox.org Business and 1 picks Tuta Business. mailbox.org Business scores higher on 4 of 7 criteria (Calendar, contacts & office apps, Migration, open standards & exit, Administration, identity & partner management, plus 1 more). Tuta Business scores higher on 3 of 7 criteria (European sovereignty, Security, encryption & compliance archiving and Pricing transparency). Provenance — mailbox.org Business: EU-Made; Tuta Business: EU-Made. Ratings are the AI panel’s opinion, formed from public evidence: how scores are made.
mailbox.org Business leads four criteria — mail and deliverability (5.5 vs 5.0; four lean), calendar and office (5.5 vs 4.0; five lean), administration and identity (5.3 vs 4.2; five lean), migration and portability (5.0 vs 3.8; five lean). Tuta Business leads sovereignty (8.2 vs 6.0; five lean, one tie), security and compliance (7.0 vs 5.7; two lean, four tie) and, on mean, pricing transparency (6.5 vs 5.8; leans split two mailbox.org Business, one Tuta Business, three tie). Weighted totals favor mailbox.org Business for the IT administrator (6.3 vs 5.3), public-sector IT lead (6.8 vs 5.5), IT service provider (6.8 vs 5.2), skeptic (6.4 vs 5.7); the data protection officer totals 5.7 for Tuta Business against 0; the small-firm owner shows no total. Both carry the same EU made provenance, and each recorded sovereignty attribute — legal entity jurisdiction, data residency, hosting options, open source, DPA, TIA — reads "unknown."
Choose mailbox.org Business if
You need IMAP or POP3 access for desktop clients: four of six judges lean mailbox.org Business on mail and deliverability (5.5 vs 5.0), and the Tuta Business verdict records a vendor-stated absence of IMAP and a 100 emails-per-hour cap.
Your team wants calendar, browser office editing, drive and video meetings in one bundle: calendar and office scores 5.5 vs 4.0 with five judges leaning mailbox.org Business, and the Tuta Business verdict found no public information on document co-editing.
You are moving accounts from Gmail, Outlook.com or T-Online: migration and portability leans mailbox.org Business five to one (5.0 vs 3.8), and the published Audriga list names those sources.
You are a public-sector IT lead or IT service provider: those weighted totals read 6.8 vs 5.5 and 6.8 vs 5.2 for mailbox.org Business.
Your priorities match the IT administrator's or the skeptic's: those weighted totals read 6.3 vs 5.3 and 6.4 vs 5.7.
Choose Tuta Business if
You need end-to-end encryption the vendor states even it cannot read: security and compliance scores 7.0 vs 5.7, with two judges leaning Tuta Business and four tied, crediting quantum-safe encryption.
Sovereignty is your deciding criterion: Tuta Business scores 8.2 vs 6.0, five judges lean its way with one tie, and the verdict credits hosting on its own servers in ISO 27001 certified data centres in Germany.
Your compliance file needs a published data processing agreement and a named SySS penetration test, both recorded in the Tuta Business verdict.
Your data protection officer holds the deciding vote: that judge's weighted total reads 5.7 for Tuta Business against 0 for mailbox.org Business, whose verdict records that judge's scores as 0 on the same seven criteria.
Read this comparison as one judge. Each weighs the same scores by what they care about.
The Small Firm Owner
Runs a tax and accounting firm of twelve in Lower Saxony. Every member of staff lives in Outlook, the shared "kanzlei@" mailbox is the busiest address in the office, and the meeting room is booked by shouting across the corridor. Wants mail on the firm's own domain that arrives, a shared calendar and address book on every phone, a move from the old provider that does not lose a single client thread, and a per-user price that is still the price in the second year.
mailbox.org Business
This judge's pick
Tuta Business
Criterion by criterion
Mail, domains & deliverability
mailbox.org Business
Mail on our own domain is documented down to the last DNS record — MX hosts, TXT validation, four DKIM keys as CNAME records, a single SPF record and DMARC with monitoring guidance — plus a catch-all mailbox and aliases on the firm's domain, with IMAP, POP3 and webmail in every tariff and DANE as well as MTA-STS named on the BSI-recommended protocol list. We found no public information on Exchange ActiveSync or native Outlook (MAPI); the help pages describe Outlook via app passwords and a CalDAV plug-in. We also found no public information on shared or functional mailboxes for our kanzlei@ address, on out-of-office rules or on send and attachment limits.
Tuta Business
The domain side is well documented: three to unlimited custom domains per tier, the exact DNS records to set (ownership TXT, MX, SPF, DKIM, MTA-STS, recommended DMARC), catch-all, up to thirty aliases per user plus unlimited on our own domain, shared mailboxes and a self-learning spam filter with custom rules. But the pages state outright that IMAP is not offered, we found no public information on Exchange ActiveSync or native Outlook connection, and mail is meant to run through Tuta's own apps only — with a 100 emails-per-hour send limit and captured pages giving different figures for maximum email size (25 MB attachments on the pricing page, 20 MB in the terms).
Calendar, contacts & office apps
mailbox.org Business
Shared calendars and address books, tasks, browser editing of documents that support common Office formats, a Drive with password-protected sharing and video meetings are all documented, and CalDAV and CardDAV set-up is written out for DAVx⁵, iOS, Thunderbird and Outlook via CalDAV Synchronizer — so the shared calendar would reach every phone in the office. We found no public information on free/busy lookup across providers, room and resource booking for our meeting room, a company-wide address book, or native desktop applications.
Tuta Business
Shared calendars with read-only, read-write and manage-sharing rights, invitations via iCal, multiple calendars with.ics import and export, contacts syncing to iPhone, iPad and Android, and free desktop clients for Windows, macOS and Linux are all documented. But we found no public information on free/busy lookup across providers, room or resource booking for our meeting room, a company-wide address book, or co-editing of documents — the Drive storage product is in closed beta, and there is nothing on video meetings or chat in the bundle.
Security, encryption & compliance archiving
mailbox.org Business
PGP and S/MIME sit in the webmailer with Mailvelope support and an own key server, two-factor is available in every tariff (though optional), mail is scanned multiple times for malware, a seven-day self-service backup snapshot is stated, and a transparency report is published that even names the share of authority requests rejected, alongside ISO 27001 and BSI C5. But for a tax office the archiving question decides the purchase, and we found no public information on GoBD-compliant archiving, retention policies or legal hold for mail, nor on enforced two-factor for all users.
Tuta Business
This is the strongest part for a tax office: every mailbox, calendar and contact is end-to-end encrypted with the provider stating in writing it cannot read the content, two-factor with U2F and TOTP can be enforced by the administrator for all users, a SySS penetration test found no way in, data sits in ISO 27001 certified centres in Germany, and both GDPR and GoBD compliance are claimed with a data processing agreement available. What I did not find: a transparency report on authority requests, retention policies, legal hold or eDiscovery, a stated restore period for deleted mail, or S/MIME and PGP — and the captured pages give different signals on backups, with the business page promising automatic backups while the terms put timely backup on the customer.
Administration, identity & partner management
mailbox.org Business
A web console manages contract, domains, mailboxes, forwards, passwords and storage, business customers create staff accounts in bulk by CSV, and a documented API is offered for larger environments; support response windows are stated (usually 48 hours Standard, 24 hours Premium) with a 24/7 emergency hotline in the top package. The reseller platform is genuinely partner-grade — create and delete customer accounts, set tariff and mailing-list limits, export invoices as PDF or CSV, keep billing and support in your own name. We found no public information on Active Directory or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, admin roles or exportable audit logs, and single sign-on is offered only as an individual integration without protocol details.
Tuta Business
There is a proper administration console with multiple admin roles, user management, sign-in-as-user, centralized billing, whitelabel design options and tiered email or priority email support from a team based in Hanover — enough for a twelve-person firm without an IT department. We found no public information on single sign-on, directory synchronisation, SCIM provisioning, an audit log of admin actions, remote device wipe or a provisioning API, support response times are not stated, and the captured pages give different figures for availability (a 99.95% SLA on the business page, 99% annual average in the terms).
Migration, open standards & exit
mailbox.org Business
The Audriga move service transfers mail, calendars, contacts and files from a named list of providers including Gmail, Outlook.com and T-Online, a migration assistant sits in the settings, and there is a second-account drag-and-drop path described as running without interruption, plus iCal and vCard import and calendar export to file; thirty days after the contract ends data is irreversibly deleted and users are told to download beforehand. We found no public information on a whole-organisation export by the administrator or a documented migration from Exchange or Microsoft 365, and the migration service is priced as free only for private customers.
Tuta Business
Getting in means forwarding old mail from named providers such as Gmail, GMX, Mailbox.org, Outlook, Proton Mail, Yahoo and Zoho, with native email import still listed as a development step — no whole-organisation migration tool or service is documented, and with IMAP expressly not offered there is no standard protocol path in, which worries me for twelve accounts' worth of client threads. Calendars import and export via.ics, the clients are open source under GPLv3 (clients only, no self-hostable server), and the exit is clearly documented: personal data deleted no later than 30 days after termination, self-service termination, and prepaid fees refunded if Tuta ends the contract early; export of whole mailboxes in mbox, EML or PST is not documented anywhere I could see.
European sovereignty
mailbox.org Business
The imprint names Heinlein Hosting GmbH of Berlin as operator, while the terms name Heinlein Support GmbH for the prepaid service — both Berlin companies — and the business and security pages state that all servers sit exclusively in Berlin on the provider's own infrastructure under German data protection law, with ISO 27001 and BSI C5 stated and a GDPR data processing agreement listed in the Standard and Premium tariffs. The privacy policy names self-hosted Matomo and Conviva via the video player as third-party elements, but we found no public information on a full subprocessor list with their locations, and data centre operators are not named.
Tuta Business
The chain is about as European as it gets on paper: contracting entity Tutao GmbH of Deisterstrasse 17a, Hanover, registered at the local court with a German VAT number, their own servers — their own ISP, they say — in ISO 27001 certified data centres in Germany, no offices in the USA, in-house push and captcha instead of Google services, a data processing agreement available, and payment subprocessors listed with their locations. The one documented third-country transfer is credit card data to Braintree in the USA, where one captured page claims no data transfers to third countries while the privacy statement documents that card transfer; the data centre operators themselves are not named, which keeps it just short of fully evidenced end to end.
Pricing transparency
mailbox.org Business
Three tiers are public at Light 1 €, Standard 4 € and Premium 12 € per month with mail storage of 2, 20 and 50 GB and Drive storage of 0, 10 and 100 GB, extra mail storage quoted at 0,20 € or 0,10 € per GB and extra Drive at 0,40 € or 0,20 € per 5 GB, monthly terms for Standard and Premium, a 30-day trial, and business prices expressly excluding VAT on 14-day invoice terms. We found no introductory discount on the captured pages, so the monthly figures read as the ongoing price — exactly what I need for the second year. We found no public information on minimum user counts, a monthly-versus-annual billing comparison, or the cost of single sign-on and the business migration service.
Tuta Business
The business tiers are public and complete enough to budget: €6, €8 and €12 per user per month paid yearly, each marked "Excludes taxes", with storage of 50 GB, 500 GB and 1000 GB, extra address counts (15/30/30), custom domain counts (3/10/unlimited) and support level per tier — and since plans auto-renew into a cancellable non-fixed term at the same tier, the second-year price is the listed price, which is exactly what I need. Missing for full computability: a monthly-billing figure next to the yearly savings, any minimum user count, and we found no public information on the price of storage beyond a tier or of services such as migration help.
Sovereignty, side by side
Dimension
mailbox.org Business
Tuta Business
Legal entity
Not determined
Not determined
Hosting location
Not determined
Not determined
Hosting options
Not determined
Not determined
Open source
Not determined
Not determined
Data processing agreement
Not determined
Not determined
Transfer impact assessment
Not determined
Not determined
Facts, side by side
Only facts both products carry under the same definition — anything else would not be a fair row.
Questions about mailbox.org Business and Tuta Business
Which is better, mailbox.org Business or Tuta Business?
As of 6 Nov 2026, the panel rates both 3/5. Weighted by what each judge cares about, 5 of the 6 judges pick mailbox.org Business and 1 picks Tuta Business. Which one fits depends on the criteria that matter to you; the table on this page shows both side by side, and each judge’s reading has its own page. Both were scored by the same AI bench under the same rubric, from public evidence only, as the methodology describes.
Is mailbox.org Business or Tuta Business European?
mailbox.org Business is European (EU-Made). Tuta Business is European (EU-Made). Provenance is read from each company’s own legal pages: who builds it and who owns it.
Where do mailbox.org Business and Tuta Business store customer data?
Per the vendors’ own pages as captured — mailbox.org Business: Default not stated; pages mention Germany. Tuta Business: Default not stated; pages mention Germany.
Do mailbox.org Business and Tuta Business have a free plan?
As of 6 Nov 2026, Tuta Business’s own pages state a free plan; mailbox.org Business’s pages as captured do not. Each product page links the pricing page it was read from.