Security, encryption & compliance archiving — found from sitemap — Tuta Business

Cited by

Facts read from this source

• 2FA methods Report an error

  “Yes, Tuta supports two-factor authentication with U2F and TOTP.”

• Encryption algorithms Report an error

  “Tuta uses symmetric (AES 256) and asymmetric encryption (RSA 2048 or ECC (x25519) and Kyber-1024 as quantum-safe algorithms ) to encrypt emails end-to-end.”

• E2e between tuta users Report an error

  “When both parties use Tuta, all emails are automatically end-to-end encrypted (asymmetric encryption).”

• Password encrypted external Report an error

  “For an encrypted email to an external recipient, a password for encrypting & decrypting the email (symmetric encryption) must be exchanged once.”

• Ip logging default Report an error

  “By default, we do not log IP addresses when you log in or when you send an email. The IP addresses of sent and received emails are stripped so that your location remains unknown.”

• Ip logging exceptions Report an error

  “We only log IP addresses of individual accounts in case of serious criminal acts such as murder, child pornography, robbery, bomb threats and blackmail after being served a valid court order by a German judge.”

• Registration no personal data Report an error

  “Upon registration you do not need to provide any personal data (e.g. no phone number required).”

• Transport tls Report an error

  “Independent of the end-to-end encryption, the transport between the client and Tuta servers is secured with TLS to maximize security.”

• Address book encrypted Report an error

  “Yes, all data within Tuta is end-to-end encrypted and only accessible with your password. Scanning and profiling of your data is not possible.”

• Encryption location Report an error

  “Encryption and decryption of data always happens locally on your device upon login.”

• Header stripping Report an error

  “Tuta strips headers from emails sent to protect your privacy.”

• Address recycling Report an error

  “A deleted email address (also if it is an alias) will not be recycled for security reasons.”

• Free account inactivity deletion Report an error

  “Free of charge accounts are deleted after an inactive period of six months. A regular login is necessary to prevent automatic deletion.”

• Key generation local Report an error

  “Your private and your public keys are generated locally within your browser upon registration. Your private key is encrypted with your password.”

• Password hashing Report an error

  “It is salted and then hashed with Argon2 locally on your device so that neither the server nor we have access to your password.”

• Image loading blocked Report an error

  “Tuta does not load pictures automatically when you open an email.”

• Mail authentication required Report an error

  “We require all messages to be authenticated. Without authentication, the email could be coming from anyone or could be modified so you should always treat such emails with scrutiny.”

• Phishing signatures Report an error

  “If you see a phishing banner, it means that some parts of this email match our phishing signatures after other users reported similar emails as phishing.”

• Server location Report an error

  “The Tuta servers are located in secure and ISO27001 certified data centers in Germany. All saved data are subject to the strict German privacy protection laws.”

• Provider cannot read data Report an error

  “Independent of that all data is end-to-end encrypted and cannot be read by the Tutao GmbH as the provider or by any third party.”

• Remote session close Report an error

  “Yes. You can view and remotely close active sessions by going to: Settings → Login.”

• Session ip storage Report an error

  “The IP address is stored encrypted, and only the user can decrypt this information. No one else - not even we at Tuta - can access this information. IP addresses are only stored for one week and then automatically deleted.”

• Encrypted data types Report an error

  “Tuta encrypts all data stored in your mailbox: Contacts Calendars Emails Email signature Inbox rules Invoice data Payment method Certificate Private keys of your own domains”

• Visible metadata Report an error

  “We can read only the following metadata: Sender email address Recipient email address Date of the email”

• Vulnerability reporting Report an error

  “If you have found any security issues, please send us an email in either English or German with a detailed report in order for us to fix them.”

• Open source Report an error

  “The Tuta code is open source and published on Github, and we invite all security experts to review it.”

• Tutacrypt Report an error

  “In 2024, Tuta introduced TutaCrypt, the first quantum-safe encryption protocol for emails.”

• Key verification Report an error

  “You can verify someone's identity key in one of two ways: By scanning a QR code with the Tuta app By entering your recipient's email address and comparing the verification code with the one that is displayed in the other's Key Verification settings.”

• Trust on first use Report an error

  “By default, your client trusts public identity keys from the server the first time they are needed and stores them on the device. After that, the server will no longer be able to change them.”

• Key verification web client limit Report an error

  “Currently, it is not possible to use this feature with a web client. To get the highest possible level of security, you should always use our free desktop clients or mobile apps.”

• Enforce 2FA all users Report an error

  “To improve account security, administrators of paid Tuta accounts with multiple users can require all users of that account to add a second factor.”

• App unlock biometrics Report an error

  “You can secure the stored app login with a pin, pattern or biometrics (fingerprint, Face ID, etc.).”

• Password no limits Report an error

  “Tuta has no limitations in regard to the password length or used characters; all unicode characters are respected.”

• Passphrase generator Report an error

  “The generator chooses six easy words from a huge curated list and outputs a passphrase that is secure as well as easy to type and remember.”

• Recovery code format Report an error

  “The recovery code is a 64-character long string and consists of the characters a-f and 0-9 only. This means that there can be no confusion between similar looking letters and numbers like the letter "o" and the number zero "0" for example.”

• Password reset self service Report an error

  “Our secure password reset feature allows only you to reset your password. We have no influence on this process.”

• Recovery with lost 2FA paid only Report an error

  “If you know your password but still cannot log in because of a lost second authentication factor, we can only help if you have one of our paid plans and have either your PayPal or credit card stored on your account.”

• Webassembly requirement Report an error

  “Tuta's web client uses WebAssembly for its encryption primitives, which might be restricted on your device platform.”

Scores citing this record

• The Data Protection Officer Security, encryption & compliance archiving
• The Data Protection Officer Administration, identity & partner management
• The IT Administrator Security, encryption & compliance archiving
• The IT Administrator Administration, identity & partner management
• The IT Service Provider Security, encryption & compliance archiving
• The IT Service Provider Administration, identity & partner management
• The IT Service Provider European sovereignty
• The Public Sector IT Lead Security, encryption & compliance archiving
• The Public Sector IT Lead Administration, identity & partner management
• The Public Sector IT Lead European sovereignty
• The Skeptic Security, encryption & compliance archiving
• The Skeptic European sovereignty
• The Small Firm Owner Security, encryption & compliance archiving
• The Small Firm Owner Administration, identity & partner management
• The Small Firm Owner European sovereignty