Security / trust page — Tuta Business

Cited by

Facts read from this source

• Encryption algorithms Report an error

  “We do not use PGP, but a slightly different implementation (initially based on AES 256 and RSA 2048), which lets us encrypt much more data (subject lines) as well as encrypt all other features that we add to Tuta such as contacts and calendars - which are all 100% encrypted. We have replaced RSA with ECDH (x25519) Kyber-1024 to release quantum-safe cryptography to all Tuta users.”

• Encrypted search index Report an error

  “Instead Tuta builds an encrypted search index, which is stored locally on your device or in your browser and searched there. This enables you to search through your entire emails (sender, recipient, subject line, body, attachment) locally while protecting your privacy.”

• No imap Report an error

  “We do not offer IMAP as it would only work if we sent decrypted data to your device. Instead we have built our own open source desktop clients, which store your data encrypted.”

• Desktop client signing Report an error

  “The desktop clients are also signed so that everyone can verify that the client is running exactly the same code as the code published on GitHub.”

• E2e encryption scope Report an error

  “Tuta encrypts all data by default: Email, calendars, contacts.”

• External encrypted email Report an error

  “You can easily send encrypted emails to external recipients by defining a password. The password is valid for all emails that you exchange with this person, there’s no need to define a new password for each email like with other secure providers.”

• Encrypted calendar reminders Report an error

  “Our calendar is an outstanding achievement because not only all data is encrypted, but also the reminders are E2E encrypted. Even the time when a notification is sent to the user is obscured from our servers”

• Mta sts Report an error

  “Tuta supports MTA-STS. This standard should be supported by all email services by now because it is to an email what strict HTTPS is to a website: It enforces transport encryption (TLS) whenever TLS is possible.”

• Spf dkim dmarc Report an error

  “Tuta also supports SPF, DKIM and DMARC. These three protocols are necessary to harden the infrastructure against intrusion from phishing and spam emails.”

• Csp and sanitizer Report an error

  “Tuta uses strict CSP (Content Security Policy), an HTML sanitizer for showing unknown content (in emails) to prevent XSS-attacks, and, by default, does not load external content from other servers (pictures and videos in emails).”

• Password handling Report an error

  “When you login to your secure mailbox, Tuta hashes and salts your password before transmitting the hash to our servers. It is impossible to derive the actual password from this hash, so no one can know your password, not even we at Tuta. To protect your password, we use Argon2 and SHA256.”

• Two factor auth Report an error

  “Tuta also provides two-factor authentication (2FA) to add an extra layer of security. To secure your login credentials, you can use TOTP or U2F. We recommend using U2F with a security device as this is the most secure form of two-factor authentication.”

• Zero knowledge Report an error

  “Tuta uses a zero-knowledge architecture, which means that the user's data is never stored in plain text on Tuta's servers. Tuta's servers only store the encrypted data, and the decryption key is only available to the user.”

• GDPR Report an error

  “Email encryption guarantees GDPR compliance, and Tuta offers the most secure email solution for businesses with full GDPR-compliance.”

• DPA Report an error

  “Tuta provides an Order Processing Agreement with legally binding data protection guarantees to help you demonstrate your compliance with GDPR.”

• Data minimization Report an error

  “Tuta is based on the data privacy principles of "data minimization" and "privacy by design".”

• Metadata exception Report an error

  “All user data is stored end-to-end encrypted in Tuta (except for metadata such as email addresses of senders and recipients of emails as this information is needed by the email protocol to deliver the email to the correct address).”

• Data centers Report an error

  “All data in Tuta is stored end-to-end encrypted on our own servers in ISO 27001 certified data centers in Germany.”

• Server access control Report an error

  “No one has access to our servers except our permanent administrators, who need to pass multiple-factor-authentication before gaining access. All productive systems are monitored 24/7 for unauthorized access and extraordinary activity.”

• No tracking no ads Report an error

  “We do not track you. We do not send targeted advertisements to your mailbox. This means that your data is not used for any other purpose than to provide email and calendar services.”

• No ip logging Report an error

  “By default, Tuta does not log IP addresses when you login or when you send an email.”

• Anonymous signup Report an error

  “Upon registration you do not need to provide any personal data (e.g. no phone number is required), even when you register via the Tor browser.”

• Ip stripped from headers Report an error

  “Tuta strips the IP addresses from the mail headers in the emails sent, so that your location remains unknown.”

• Sender spoofing warning Report an error

  “Tuta warns you when the technical sender differs from the from sender. To fake the from sender is a typical method used in phishing attacks.”

• Session monitoring Report an error

  “Tuta lets you check active and closed sessions as an opt-in feature. This allows you to verify that no one but yourself has logged into your account. Closed sessions are automatically deleted after one week. Tuta’s session handling also enables you to close sessions remotely.”

• Session ip retention Report an error

  “IP addresses of open and closed sessions are always stored encrypted and automatically deleted after one week. Due to the encryption only you can access this information. We at Tuta have absolutely no access to this information.”

• Open source Report an error

  “We have published the Tuta web client, the Tuta desktop clients as well as the Android and iOS apps as open source software on GitHub.”

• Own tech stack Report an error

  “One main differentiation of Tuta is that we build all major parts of Tuta ourselves, even outside of the core email functionality such as our captcha, our push notification service on Android and more.”

• No vpn browser Report an error

  “Despite all these protections, you might still want to keep your IP address hidden even from us, which is why we will never add a VPN or a browser to our offer.”

• Image blocking default Report an error

  “Tuta blocks images by default. No external content is loaded when you open an email unless you actively allow this.”

• Planned forward secrecy Report an error

  “In the future, we plan to also support forward secrecy.”

Scores citing this record

• The Data Protection Officer Mail, domains & deliverability
• The Data Protection Officer Security, encryption & compliance archiving
• The Data Protection Officer Migration, open standards & exit
• The Data Protection Officer European sovereignty
• The IT Administrator Mail, domains & deliverability
• The IT Administrator Security, encryption & compliance archiving
• The IT Administrator Migration, open standards & exit
• The IT Administrator European sovereignty
• The IT Service Provider Mail, domains & deliverability
• The IT Service Provider Security, encryption & compliance archiving
• The IT Service Provider Administration, identity & partner management
• The IT Service Provider Migration, open standards & exit
• The IT Service Provider European sovereignty
• The Public Sector IT Lead Mail, domains & deliverability
• The Public Sector IT Lead Security, encryption & compliance archiving
• The Public Sector IT Lead Migration, open standards & exit
• The Skeptic Mail, domains & deliverability
• The Skeptic Security, encryption & compliance archiving
• The Skeptic Migration, open standards & exit
• The Skeptic European sovereignty
• The Small Firm Owner Mail, domains & deliverability
• The Small Firm Owner Security, encryption & compliance archiving
• The Small Firm Owner European sovereignty