Business Email & Office Suites
Tuta Business
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Tutao GmbH · tuta.com
Compare with mailbox.org Business → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Tuta Business at a glance
- Vendor
- Tutao GmbH
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Default not stated; pages mention Germany source, captured 5 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 5 Nov 2026
- Panel verdict
- The AI panel rates Tuta Business 3/5, the mean of 6 judges. Tuta Business from Tutao GmbH of Hanover is an end-to-end encrypted mail, calendar and file bundle on custom domains, with three public business tiers at €6, €8 and €12 per user per month paid yearly, each marked "Excludes taxes". how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 5 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Tuta Business from Tutao GmbH of Hanover is an end-to-end encrypted mail, calendar and file bundle on custom domains, with three public business tiers at €6, €8 and €12 per user per month paid yearly, each marked "Excludes taxes". The bench scores it strongest on sovereignty, 8 to 9, and security and compliance, 7, crediting quantum-safe encryption the vendor states even it cannot read, hosting on its own servers in ISO 27001 certified data centres in Germany, a published data processing agreement and a named SySS penetration test. Weakest are calendar and office at 4 and administration and identity at 4 to 5: we found no public information on free/busy lookup, room booking, document co-editing, single sign-on, directory sync or SCIM provisioning, and the bundled file store is in closed beta. Splits are narrow: on mail and deliverability the small firm owner scores 4 over the vendor-stated absence of IMAP and the 100 emails-per-hour cap, while the IT administrator scores 6 on the documented DNS set-up; pricing transparency runs 6 to 7 over a missing monthly-billing figure.
Speaks for it
- Mail, calendars and contacts are end-to-end encrypted with quantum-safe algorithms, and the vendor states even it cannot read the content.
- Tutao GmbH of Hanover hosts on its own servers in ISO 27001 certified data centres in Germany, with a published data processing agreement and payment subprocessors named with their locations.
- All three business tiers are public at €6, €8 and €12 per user per month paid yearly, with storage, custom-domain and alias counts and support level stated per tier.
- Custom-domain set-up is documented record by record (TXT, MX, SPF, DKIM, MTA-STS and a recommended DMARC record) with a status check, catch-all and shared mailboxes.
- The exit is written down: personal data deleted no later than 30 days after termination, self-service termination and GPLv3 open-source clients.
Held against it
- We found no public information on single sign-on, directory synchronisation, SCIM provisioning, admin audit logs or remote device wipe.
- GoBD compliance appears as a single claim, with no public information on archiving, retention policies, legal hold, eDiscovery or a transparency report.
- The captured pages give different figures for backups, email import, maximum message size and availability.
- We found no public information on document co-editing, video meetings or chat, and the bundled file storage is in closed beta.
Best for
- You need end-to-end encrypted mail, calendars and contacts on your own domain from a German contracting entity with a published data processing agreement and named payment subprocessors.
- You run a small team that fits the documented administration console — multiple admin roles, sign-in-as-user, centralized billing and admin-enforced two-factor.
- You can pay on invoice and want to keep the one documented third-country transfer — credit card data to Braintree in the USA — out of your chain.
- You want verifiable security claims — GPLv3 open-source clients on GitHub and a named SySS penetration test.
Avoid if
- You must run audit-proof archiving with retention policies, legal hold or eDiscovery — we found no public information on these behind the GoBD claim.
- You administer hundreds of accounts through single sign-on, directory synchronisation or SCIM provisioning — we found no public information on any of these, nor on remote wipe or audit logs.
- You are migrating from Exchange or Microsoft 365 or need mailbox export in standard formats — we found no public information on a whole-organisation migration tool or standard-format export, and the send cap is 100 emails per hour per account.
The scores
| Criterion | Panel median |
|---|---|
| Mail, domains & deliverability | 2.5 of 5 |
| Calendar, contacts & office apps | 2 of 5 |
| Security, encryption & compliance archiving | 3.5 of 5 |
| Administration, identity & partner management | 2 of 5 |
| Migration, open standards & exit | 2 of 5 |
| European sovereignty | 4 of 5 |
| Pricing transparency | 3.5 of 5 |
Mail, domains & deliverability
Show reasoningHide reasoning
How this is scored
How well the mailbox itself works: custom domains and their DNS set-up, aliases, catch-all, shared and functional mailboxes, distribution lists, mailbox and attachment size limits, IMAP, POP3, SMTP and Exchange ActiveSync or MAPI for Outlook, web and mobile apps, spam and malware filtering, SPF, DKIM, DMARC and MTA-STS, out-of-office and server-side rules, send limits, and the delivery reputation of the sending infrastructure. A self-hosted groupware is judged on the mail server it ships; a suite whose mail app is only a client for another server scores at the level of that client.
0 — No mailbox at all; a product that only sends transactional mail or only reads another provider's mail without a server of its own or a documented one to pair it with.
3 — Mailboxes on a custom domain with IMAP and SMTP and a webmail; aliases, shared mailboxes, filtering and DKIM or DMARC are basic or not described.
5 — Several custom domains with a documented DNS set-up, aliases and distribution lists, shared or functional mailboxes, IMAP and SMTP plus mobile apps, spam and malware filtering, SPF and DKIM signing, mailbox size per plan stated, server-side rules and out-of-office replies.
8 — Exchange ActiveSync or native Outlook (MAPI) support, DMARC reporting and MTA-STS or DANE, catch-all and plus addressing, delegated access and send-as, quarantine an admin can review, send and attachment limits stated, and the deliverability of the outbound infrastructure documented.
10 — A mail platform a large organisation runs on: every protocol above with feature parity stated per client, inbound and outbound gateways configurable, journaling, DANE and MTA-STS enforced, delivery monitoring and bounce analysis for admins, and mail flow documented end to end.
The Small Firm Owner
The domain side is well documented: three to unlimited custom domains per tier, the exact DNS records to set (ownership TXT, MX, SPF, DKIM, MTA-STS, recommended DMARC), catch-all, up to thirty aliases per user plus unlimited on our own domain, shared mailboxes and a self-learning spam filter with custom rules. But the pages state outright that IMAP is not offered, we found no public information on Exchange ActiveSync or native Outlook connection, and mail is meant to run through Tuta's own apps only — with a 100 emails-per-hour send limit and captured pages giving different figures for maximum email size (25 MB attachments on the pricing page, 20 MB in the terms). 1 4 8 11 12 13
The IT Administrator
The custom-domain DNS story is well documented — TXT ownership proof, MX, SPF, DKIM, MTA-STS and a recommended DMARC record, with a status check — and tiers state storage (50/500/1000 GB), alias counts, catch-all, shared mailboxes, a 25 MB attachment limit and a 100-mails-per-hour cap. 1 4 8 11 12 13
The Public Sector IT Lead
Custom domains come with a documented DNS set-up including SPF, DKIM, DMARC and MTA-STS, catch-all, up to thirty aliases per user plus unlimited aliases on the own domain, shared mailboxes, a self-learning spam filter with custom rules, and stated send limits and mailbox storage per tier. The captured pages also give different figures for maximum message size, 20 MB in the terms against 25 MB attachments on the pricing page. 1 4 11 13
The IT Service Provider
Domain set-up is documented properly (TXT, MX, SPF, DKIM, MTA-STS and a recommended DMARC record with a status check), catch-all and unlimited custom-domain aliases exist, and the spam filter and regex inbox rules are real. But the vendor itself states "We do not offer IMAP", so no Outlook, no ActiveSync, and every client lives in Tuta's own apps; send limits (100 mails per hour) and attachment sizes are stated, and we found no public information on distribution lists, out-of-office replies or an admin-viewable quarantine. 1 4 8 11 12 13
The Data Protection Officer
Custom domains come with the DNS set-up documented record by record (SPF, DKIM, DMARC, MTA-STS) plus catch-all, shared mailboxes, up to 30 aliases per user with unlimited own-domain aliases, a self-learning spam filter with custom rules and inbox rules, and stated send and attachment limits. The pages themselves state that IMAP is not offered, and I found no public information on POP3, Exchange ActiveSync or native Outlook MAPI, nor on out-of-office replies or distribution lists. 1 4 11 12 13
The Skeptic
Custom domains get an unusually concrete DNS walkthrough — ownership TXT, MX, SPF, DKIM, MTA-STS and a recommended DMARC record — plus catch-all, shared mailboxes, a self-learning spam filter with custom rules and inbox rules with regular expressions. But the vendor states plainly that IMAP is not offered and is replaced by its own desktop and mobile clients, and we found no public information on POP3, Exchange ActiveSync or native Outlook access; the terms also cap sending at 100 emails per hour and prohibit bulk mailings, and we found no public information on the deliverability of the outbound infrastructure. 1 4 11 12 13
Calendar, contacts & office apps
Show reasoningHide reasoning
How this is scored
What the office plans and writes with: shared and team calendars, free/busy lookup, meeting invitations across providers, room and resource booking, shared address books and a company directory, CalDAV and CardDAV or ActiveSync for phones, Outlook calendar sync, tasks, online office documents with co-editing, file storage that comes with the suite, video meetings and chat inside the bundle, and the desktop and mobile apps.
0 — Mail only, with no calendar or contacts of any kind.
3 — A personal calendar and address book in the webmail; sharing, resources, sync protocols and office apps are basic or not described.
5 — Shared calendars and address books, meeting invitations with free/busy lookup, CalDAV and CardDAV or ActiveSync sync to phones and desktop clients, a company-wide address book, tasks, and either online office documents or a documented integration with an office suite.
8 — Room and resource booking with approval, delegated calendar access, Outlook calendar and contacts sync documented, co-editing of documents and spreadsheets in the browser, file storage with sharing, video meetings in the bundle, and apps for desktop, iOS and Android.
10 — A full office suite that replaces Microsoft 365 for a whole organisation: every function above with Microsoft file formats edited without loss, scheduling across organisations, resource planning, offline editing, an accessible interface stated against a standard, and feature parity across web, desktop and mobile documented.
The Small Firm Owner
Shared calendars with read-only, read-write and manage-sharing rights, invitations via iCal, multiple calendars with.ics import and export, contacts syncing to iPhone, iPad and Android, and free desktop clients for Windows, macOS and Linux are all documented. But we found no public information on free/busy lookup across providers, room or resource booking for our meeting room, a company-wide address book, or co-editing of documents — the Drive storage product is in closed beta, and there is nothing on video meetings or chat in the bundle. 2 13 14 15
The IT Administrator
Shared calendars with read-only, read-write and manage-sharing permission levels, multiple calendars, iCal invitations,.ics import/export and free desktop and mobile apps with encrypted reminders are documented. We found no public information on free/busy lookup, room and resource booking, a company-wide address book or co-editing of office documents — Tuta Drive is file storage still in closed beta — and the calendar comparison page shows a CalDAV row without making clear from the capture where Tuta stands on it. 2 13 14 15
The Public Sector IT Lead
Shared calendars with graded access rights (read only, read and write, write and manage sharing), multiple calendars, recurring events, invitations via iCal and.ics import and export are documented, with apps for Windows, macOS, Linux, Android and iOS. I found no public information on free/busy lookup, room and resource booking, a company-wide address book or co-editing of any documents, and the file storage in the bundle is in closed beta — for an administration leaving Microsoft 365 this is not yet a workplace suite. 2 13 14 15
The IT Service Provider
Shared calendars with read-only, read-write and manage-sharing permissions, iCal invites,.ics import and export, multiple calendars, contacts sync to phones, and apps on Windows, macOS, Linux, Android and iOS are all documented. We found no public information on free/busy lookup, room or resource booking, a company-wide directory, or any office documents — the bundled Drive is file storage in closed beta with no editing described, and no video meetings or chat appear anywhere. 1 2 13 14 15
The Data Protection Officer
Shared calendars with read-only, read-write and sharing-management rights, invitations via iCal with.ics import and export, contacts synced to iPhone, iPad and Android, and desktop and mobile apps are documented, alongside an encrypted file store that its own page places in closed beta. I found no public information on free/busy lookup, room or resource booking, a company-wide address book, video meetings, chat, or co-editing of office documents. 2 13 14 15
The Skeptic
Calendars share with read-only, read-write and manage-sharing levels, invite via iCal, import and export as.ics, and encrypt reminders so thoroughly that the notification time is hidden from the servers, with desktop and mobile apps and offline access. We found no public information on free/busy lookup, room and resource booking, tasks or video meetings, and the file store is in closed beta with no public information on document editing or co-editing; the vendor's own comparison page puts a dash next to CalDAV support. 2 13 14 15
Security, encryption & compliance archiving
Show reasoningHide reasoning
How this is scored
How mail and documents are protected and kept: TLS enforced in transit, encryption at rest, end-to-end encryption or S/MIME and PGP, who at the provider can read a mailbox, two-factor authentication and passkeys, phishing, malware and account-takeover protection, audit-proof archiving that meets GoBD, retention policies and legal hold, eDiscovery, backups and restore of deleted mail, a transparency report on authority requests, and certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No security information of any kind; no encryption, two-factor sign-in or archiving stated.
3 — Encrypted connections and a password login; encryption at rest, two-factor sign-in, archiving and certifications are basic or not described.
5 — TLS in transit and encryption at rest stated, two-factor authentication, spam, phishing and malware protection, restore of deleted mail for a stated period, archiving offered (built in or as an add-on), and a certification such as ISO 27001 stated for the data centres or the service.
8 — End-to-end encryption, S/MIME or PGP supported, GoBD-compliant archiving documented, retention policies and legal hold, enforced two-factor or passkeys for all users, a transparency report on authority requests, and certifications such as ISO 27001 or BSI C5 published with their scope and auditor.
10 — Security that holds up in an audit of a regulated organisation: zero-access or customer-held keys where the provider cannot read mail, eDiscovery, tamper-proof archive with documented verification, every certification published with its report or attestation available, independent security audits or open-source code reviewed, and incident disclosure documented.
The Small Firm Owner
This is the strongest part for a tax office: every mailbox, calendar and contact is end-to-end encrypted with the provider stating in writing it cannot read the content, two-factor with U2F and TOTP can be enforced by the administrator for all users, a SySS penetration test found no way in, data sits in ISO 27001 certified centres in Germany, and both GDPR and GoBD compliance are claimed with a data processing agreement available. What I did not find: a transparency report on authority requests, retention policies, legal hold or eDiscovery, a stated restore period for deleted mail, or S/MIME and PGP — and the captured pages give different signals on backups, with the business page promising automatic backups while the terms put timely backup on the customer. 1 4 5 6 16 17
The IT Administrator
End-to-end encryption by default (AES 256 with post-quantum Kyber-1024), a provider that states even it cannot read mailbox content, admin-enforced two-factor for all users of a paid account, ISO 27001 certified data centres in Germany, a SySS penetration test and published open-source clients put the core protection well above average. GDPR and GoBD compliance are claimed outright, but we found no public information on retention policies, legal hold, eDiscovery, a transparency report on authority requests, or the auditor and scope behind the ISO 27001 certificate — the questions a compliance audit of my archive would ask first. 1 4 5 6 16 17
The Public Sector IT Lead
End-to-end encryption under which even Tutao GmbH cannot read content, quantum-safe algorithms, two-factor enforceable by administrators for all users of a paid account, ISO 27001 certified data centres in Germany, a SySS penetration test, a claimed GDPR and GoBD compliance and a published data processing agreement are all documented, and the open-source clients invite review. What I would miss in a real audit are retention policies, legal hold, eDiscovery and a stated restore period for deleted mail, on which I found no public information, and the ISO 27001 scope and auditor are not published; the captured pages also give different statements on backups, with automatic backups advertised on the business page while the terms place timely storage and backup of the data on the customer. 4 5 6 16 17
The IT Service Provider
This is the strongest flank: end-to-end encryption of mail, calendars and contacts (AES 256, quantum-safe Kyber-1024), zero-access stated in the vendor's own words, TLS, admin-enforced two-factor with U2F and TOTP, phishing signatures, a SySS penetration test with a named auditor, GPLv3 client code and ISO 27001 data centres in Germany. Below that it thins out: a one-line GoBD claim with no archiving product, retention policies, legal hold or eDiscovery described, no transparency report, and the captured pages give different figures for backups — the business page advertises automatic backups while the terms place backup responsibility on the customer. 1 4 5 6 11 16 17 18
The Data Protection Officer
The provider states its own staff cannot read mailbox content and names exactly what it can see (sender address, recipient address, date), with end-to-end and post-quantum encryption, admin-enforced second factors, ISO 27001 certified data centres in Germany and a named SySS penetration test. For a regulated practice the gaps weigh: GoBD compliance appears as a single claim with no audit-proof archiving, retention policies, legal hold or eDiscovery, there is no transparency report on authority requests, external encryption uses shared passwords rather than S/MIME or PGP, and the terms place the timely storage and backup of data on the customer. 4 5 6 11 16 17
The Skeptic
Mail, calendar and contacts are end-to-end encrypted by default with quantum-safe algorithms, keys generated locally, and the provider stating it cannot read content — the open-source clients, a SySS penetration test and admin-enforceable second factors give those claims some footing. But the GoBD claim arrives as a slogan: we found no public information on audit-proof archiving, retention policies, legal hold or a transparency report, and ISO 27001 is stated for the data centres rather than the service. The captured pages also give different pictures on backups — the business page advertises automatic backups while the terms put timely storage and backup of the data on the customer. 1 4 5 6 11 16 17
Administration, identity & partner management
Show reasoningHide reasoning
How this is scored
How an IT team or an IT service provider runs it: an admin console for users, groups, mailboxes and domains, admin roles, single sign-on (SAML or OpenID Connect), sync with Active Directory, Entra ID or LDAP, SCIM provisioning, mobile device policies and remote wipe, audit logs of admin and user actions, usage reports, a documented API for provisioning, multi-tenant or reseller accounts for partners managing several customers, and the support channels and response times per plan.
0 — No administration; one login per mailbox and nothing managed centrally.
3 — A web console to add mailboxes and aliases; roles, single sign-on, directory sync and audit logs are basic or not described.
5 — An admin console for users, groups, mailboxes and domains, admin roles, two-factor sign-in enforceable by the admin, password policies, a documented API or command line for provisioning, an activity or audit log, and business support by phone or ticket stated per plan.
8 — Single sign-on (SAML or OpenID Connect), Active Directory, Entra ID or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, audit logs exportable, delegated administration, partner or reseller accounts that manage several customer organisations, and support response times stated.
10 — Administration that scales across many organisations: every setting reachable by API with parity stated, granular role scopes, policies by group, logs streamed to a SIEM, white-label partner offerings with separate billing, and an SLA with service credits published.
The Small Firm Owner
There is a proper administration console with multiple admin roles, user management, sign-in-as-user, centralized billing, whitelabel design options and tiered email or priority email support from a team based in Hanover — enough for a twelve-person firm without an IT department. We found no public information on single sign-on, directory synchronisation, SCIM provisioning, an audit log of admin actions, remote device wipe or a provisioning API, support response times are not stated, and the captured pages give different figures for availability (a 99.95% SLA on the business page, 99% annual average in the terms). 1 7 8 11 13 16
The IT Administrator
There is an administration console with multiple admin roles, user management, sign-in-as-user, centralized billing, admin password resets and removal of second factors, plus whitelabeling and per-plan email or priority email support from a team based in Hanover. For a three-hundred-mailbox shop on Active Directory, we found no public information on single sign-on via SAML or OpenID Connect, directory synchronisation, SCIM provisioning, a documented provisioning API, mobile device policies with remote wipe, exportable audit logs or reseller accounts — only the remote closing of sessions is described. 1 8 13 16
The Public Sector IT Lead
An administration console with multiple admin roles, user management, sign-in-as-user, centralized billing, admin-managed second factors, password resets by internal administrators and white-label options is documented, with email or priority email support per plan from a team based in Hanover. I found no public information on single sign-on, Active Directory or LDAP synchronisation, SCIM provisioning, a provisioning API, audit logs, or mobile device policies with remote wipe — precisely what my team needs to run eleven hundred accounts day to day. 1 11 13 16
The IT Service Provider
There is a genuine console — user management, multiple admin roles, sign-in-as-user, centralized billing, whitelabel, and admins who can enforce two-factor and reset employee passwords — enough for a small client. For a provider running many customers it stops there: we found no public information on a provisioning API, single sign-on or directory sync, admin audit logs, device policies with remote wipe, or reseller and partner accounts, and support is email or priority email with no response times stated. 1 4 7 13 16
The Data Protection Officer
An administration console with multiple admin roles, user management, sign-in-as-user, centralized billing, whitelabel customization and admin-enforced second factors is documented, with email and priority email support per tier from staff based in Hanover. I found no public information on single sign-on, directory synchronisation, SCIM provisioning, mobile device policies with remote wipe, exportable audit logs, a provisioning API, or partner and reseller accounts. 1 13 16
The Skeptic
An administration console with multiple admin roles, user management, sign-in-as-user, centralized billing and whitelabel is documented, and administrators of paid multi-user accounts can require every user to add a second factor. We found no public information on single sign-on, directory synchronisation, SCIM provisioning, a documented API, mobile-device policies or remote wipe, and support is email or priority email with no response times stated. That is administration for a small or mid-sized firm, not a corporate identity layer. 1 7 11 13
Migration, open standards & exit
Show reasoningHide reasoning
How this is scored
How the organisation gets in and out: migration from Exchange, Microsoft 365, Google Workspace or another IMAP provider with a documented tool or service, mail, calendars and contacts carried over, coexistence during a move, standard protocols (IMAP, CalDAV, CardDAV, JMAP, open document formats) rather than proprietary ones, export of a mailbox and of the whole organisation in standard formats (mbox, EML, PST, ICS, vCard), open-source code or a self-hosted edition, what happens to data when the contract ends, and how domains and DNS are handed back.
0 — No way to bring mail in or take it out; a proprietary store with no IMAP access or export.
3 — IMAP access to mail; a migration path, calendar and contacts export and the end-of-contract handling are basic or not described.
5 — A documented migration from Exchange, Microsoft 365 or Google (a tool, an import or a service), mail, calendars and contacts imported, IMAP, CalDAV and CardDAV or ActiveSync access, export of mail, calendars and contacts in standard formats, and the deletion of data after the contract ends stated.
8 — A migration service or tool that moves whole organisations with calendars and permissions, coexistence with free/busy during the move, open document formats supported natively, export of the whole organisation by the admin, an open-source code base or a self-hosted edition, and a data return period after cancellation stated.
10 — An exit that costs nothing but time: every record exportable in open formats with the method documented, a self-hosted open-source edition with feature parity stated, migration in and out documented with the same tools, and a contractual data return and deletion with confirmation.
The Small Firm Owner
Getting in means forwarding old mail from named providers such as Gmail, GMX, Mailbox.org, Outlook, Proton Mail, Yahoo and Zoho, with native email import still listed as a development step — no whole-organisation migration tool or service is documented, and with IMAP expressly not offered there is no standard protocol path in, which worries me for twelve accounts' worth of client threads. Calendars import and export via.ics, the clients are open source under GPLv3 (clients only, no self-hostable server), and the exit is clearly documented: personal data deleted no later than 30 days after termination, self-service termination, and prepaid fees refunded if Tuta ends the contract early; export of whole mailboxes in mbox, EML or PST is not documented anywhere I could see. 11 12 13 17 18
The IT Administrator
Import of contacts and calendars via.ics is documented, mail can be brought over by forwarding from a list of providers, personal data is deleted no later than 30 days after termination, and all clients are open source under GPLv3 with self-build documentation for Linux. 4 6 11 12 13 15 17
The Public Sector IT Lead
Getting mail in is documented as forwarding from a list of named providers plus an import of emails, contacts and calendars, while another captured page lists email import among planned next development steps — the captured pages give different pictures here. 4 12 13 17 18
The IT Service Provider
Getting in is documented as forwarding from Gmail, Outlook, GMX and others plus contact and calendar import, and getting out is honest — personal data deleted no later than 30 days after contract end, self-service termination, and all clients published under GPLv3. 4 6 10 11 12 13 17
The Data Protection Officer
Getting in is documented as forwarding from named providers plus import of contacts and calendars with.ics export, and the privacy statement commits to deleting personal data no later than 30 days after termination — the captured pages give different statements on email import, one listing it as available and another among next development steps. The pages themselves state IMAP is not offered, and I found no public information on a migration tool for whole organisations, on mailbox or organisation-wide export in standard formats, or on a self-hosted edition; the GPLv3 open source and self-build instructions cover clients for Linux and F-Droid rather than a server. 4 12 13 17 18
The Skeptic
The documented way in is forwarding mail from a previous provider or importing contacts and calendars, while the roadmap still lists email import as a next development step — the captured pages give different pictures of where import stands. The way out is thin: the vendor states IMAP is not offered, calendar export is.ics, we found no public information on exporting a mailbox in standard formats, and the GPLv3 open-source licence covers client code, with no public information on a self-hosted server edition. At least the exit terms are written down: personal data deleted no later than thirty days after termination. 4 12 13 17 18
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where mailboxes, calendars, contacts, documents and backups are stored and processed, who at the provider or its subprocessors can access them, and who the subprocessors are (data centres, spam filtering, support, payment, AI features). Independently sourced by the sovereignty pipeline. An EU data region offered by a non-EU parent is part of the chain, not the whole of it. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (spam filtering, support, backups, AI features) run through non-EU providers or a non-EU parent without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated — or a self-hosted edition documented that keeps every mailbox on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Small Firm Owner
The chain is about as European as it gets on paper: contracting entity Tutao GmbH of Deisterstrasse 17a, Hanover, registered at the local court with a German VAT number, their own servers — their own ISP, they say — in ISO 27001 certified data centres in Germany, no offices in the USA, in-house push and captcha instead of Google services, a data processing agreement available, and payment subprocessors listed with their locations. The one documented third-country transfer is credit card data to Braintree in the USA, where one captured page claims no data transfers to third countries while the privacy statement documents that card transfer; the data centre operators themselves are not named, which keeps it just short of fully evidenced end to end. 4 5 9 12 16 17
The IT Administrator
The chain is proven on the vendor's own pages: Tutao GmbH of Hanover is the contracting entity (registered under HRB 208014, VAT DE280903265), mail, calendars and drive sit on the company's own servers in ISO 27001 certified data centres in Germany, a data processing agreement is published, a data protection officer is named, and the listed subprocessors are PayPal (Luxembourg) and Braintree (USA) for card payments with the US transfer disclosed. Because content is end-to-end encrypted, the provider states it cannot read it; we found no public information on the named data-centre operator or a published certification report with its scope. 1 4 5 9 17
The Public Sector IT Lead
This is the strongest part: Tutao GmbH of Hanover, registered at the district court there, hosts on its own servers in ISO 27001 certified data centres in Germany, states it is its own ISP, independent of the US Cloud Act, with no offices in the USA, and publishes a data processing agreement; content is only disclosed on a valid order from a German judge. The one documented third-country transfer is credit card data to Braintree in the USA, which we could avoid by paying on invoice; the data centre operators are not named and no BSI C5 appears, so I stop short of the top mark. 1 5 9 16 17
The IT Service Provider
Tutao GmbH in Hanover is the registered contracting entity, mail, calendars and files sit on the vendor's own servers in ISO 27001 certified data centres in Germany, a data processing agreement is published, and the privacy statement names its subprocessors with locations — Braintree in the USA for credit-card payments (disclosed as a third-country transfer), PayPal in Luxembourg, support staff in Hanover. The chain is about as European as a hosted service gets; it stays below the top because card payments can route through a US processor and the certification is stated for the data centres without a published report. 1 4 5 9 16 17
The Data Protection Officer
The contracting entity is Tutao GmbH of Hanover, registered at the district court there, hosting runs on the provider's own servers in ISO 27001 certified data centres in Germany, a GDPR data processing agreement is published, and the payment subprocessors are named with locations — PayPal in Luxembourg and Braintree in the USA for card data, the one third-country transfer, disclosed as such. The data centres are not named individually and no complete subprocessor register beyond payment is captured, so the agreement must still name every server before we sign. 1 4 5 9 17
The Skeptic
Tutao GmbH is registered at the Hanover district court with a German VAT number, states it owns its servers in ISO 27001-certified data centres in Germany, calls itself its own ISP with no US offices, and publishes a data processing agreement. The named subprocessors handle payment only — PayPal in Luxembourg and Braintree in the USA for credit-card data — and authority access runs through a German judge, with IP logging only after a court order. That is a genuinely European chain; the certification covers the data centres rather than the whole service, which keeps it one step from the top. 4 5 9 16 17
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or mailbox per tier, storage per user, what shared mailboxes, aliases and extra domains cost, which features (archiving, office apps, SSO, advanced security, more storage) cost extra, the first-year discount and the regular price after it, minimum users and term, monthly versus annual billing, and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price per user exists, but how cost scales with storage, users, add-ons or after the first year is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (archiving, extra storage, shared mailboxes, SSO, the price after the introductory period) is unpriced or "on request".
8 — Every tier priced publicly per user with storage, add-ons priced, the regular price after any introductory discount stated, minimum users and term stated, monthly and annual billing compared, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of users, storage and add-ons, with every support, migration and archive fee and the cancellation and data-return terms published.
The Small Firm Owner
The business tiers are public and complete enough to budget: €6, €8 and €12 per user per month paid yearly, each marked "Excludes taxes", with storage of 50 GB, 500 GB and 1000 GB, extra address counts (15/30/30), custom domain counts (3/10/unlimited) and support level per tier — and since plans auto-renew into a cancellable non-fixed term at the same tier, the second-year price is the listed price, which is exactly what I need. Missing for full computability: a monthly-billing figure next to the yearly savings, any minimum user count, and we found no public information on the price of storage beyond a tier or of services such as migration help. 1 8 11 13 17
The IT Administrator
Business tiers are public with per-user prices — Essential at '€6 /user/month', Advanced at '€8 /user/month', Unlimited at '€12 /user/month', each paid yearly and 'Excludes taxes.' — together with storage of 50, 500 or 1000 GB, custom domain counts of 3, 10 or unlimited, extra address counts, support level, a one-year initial term turning into a cancellable non-fixed contract, payment methods including invoice for business customers, and even a 50,00 EUR blocking and unblocking fee. What I could not compute from the pages is the monthly-billing price, any minimum user count, or add-on prices such as extra storage; the 'Save €19.20' savings are shown without the undiscounted base being spelled out. 1 8 11
The Public Sector IT Lead
The three business tiers are public at €6, €8 and €12 per user/month paid yearly, each with its storage (50 GB, 500 GB, 1000 GB), number of custom domains, extra addresses and support level, VAT stated as excluding taxes, and contract terms that become a non-fixed term cancellable at any time after the initial period. What I still cannot compute from the pages alone is the monthly-billing price, any minimum user count or the cost of additional storage, and the terms carry a fee of 50,00 EUR including purchase tax for each blocking and each unblocking of the service. 1 8 11
The IT Service Provider
The three business tiers are public with per-user prices (€6, €8 and €12 per user per month, paid yearly, excluding taxes), and each tier's storage, custom-domain count, extra addresses and support level sit side by side, with contract terms (monthly or yearly, then cancellable anytime) and payment options including invoice for business customers. Gaps remain before I could quote a client blind: we found no public information on monthly billing prices for business plans, extra-storage add-ons or minimum users, and the "Save €19.20" figures appear without the comparison base, so any introductory saving is not separable from the regular price. 1 8 11 13
The Data Protection Officer
All three business tiers are public at €6, €8 and €12 per user per month paid yearly, each marked Excludes taxes, with storage of 50, 500 and 1000 GB, custom domains, extra email addresses and the support level per tier, and the term plus anytime cancellation after the initial period stated. I found no public information on a monthly business price per user, minimum users, or the cost of storage beyond the tier amounts. 1 8 11 13
The Skeptic
Three business tiers sit on the public page at €6, €8 and €12 per user per month paid yearly, each with storage, extra addresses, custom-domain counts and support level stated, and the terms spell out contract periods, auto-renewal, payment methods, invoice payment for business customers and a 50,00 EUR blocking fee. But the Save €19.20 banners imply a monthly price the pages never state, whitelabel, the SMTP relay and further domains carry no public price, and the business tiers are marked Excludes taxes while private tiers say Includes taxes. A buyer can budget roughly but cannot compute the year from the public pages alone. 1 8 11 13
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Tuta Business
Is Tuta Business European?
Yes. whats-best.ai classifies Tuta Business as EU-Made.
Where does Tuta Business store data?
The default storage location for customer data is not stated on the vendor’s pages as of 5 Nov 2026. The vendor’s pages mention Germany as hosting location, per the vendor’s page captured 5 Nov 2026.
Does Tuta Business have a free plan?
Yes. Tuta Business has a free plan, per the vendor’s page captured 5 Nov 2026.
What are the best alternatives to Tuta Business?
As of 6 Nov 2026, the panel rates grommunio (3.5/5), Infomaniak kSuite (3.5/5) and Nextcloud Hub (Groupware & Office) (3.5/5) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is grommunio (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Tuta Business alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Open source, Hosting location, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (business) tuta.com Checked 5 Nov 2026 Details →
- 2 Features page (calendar) tuta.com Checked 5 Nov 2026 Details →
- 3 Features page (encryption) tuta.com Checked 5 Nov 2026 Details →
- 4 Security / trust page tuta.com Checked 5 Nov 2026 Details →
- 5 Features page (digital sovereignty) tuta.com Checked 5 Nov 2026 Details →
- 6 Features page (open source) tuta.com Checked 5 Nov 2026 Details →
- 7 Documentation (help and FAQ) tuta.com Checked 5 Nov 2026 Details →
- 8 Pricing page tuta.com Checked 5 Nov 2026 Details →
- 9 Legal notice tuta.com Checked 5 Nov 2026 Details →
- 10 Privacy policy tuta.com Checked 5 Nov 2026 Details →
- 11 Terms of service tuta.com Checked 5 Nov 2026 Details →
- 12 Mail, domains & deliverability — found from sitemap tuta.com Checked 5 Nov 2026 Details →
- 13 Mail, domains & deliverability — found from sitemap tuta.com Checked 5 Nov 2026 Details →
- 14 Calendar, contacts & office apps — found from sitemap tuta.com Checked 5 Nov 2026 Details →
- 15 Calendar, contacts & office apps — found from sitemap tuta.com Checked 5 Nov 2026 Details →
- 16 Security, encryption & compliance archiving — found from sitemap tuta.com Checked 5 Nov 2026 Details →
- 17 Security, encryption & compliance archiving — found from sitemap tuta.com Checked 5 Nov 2026 Details →
- 18 Migration, open standards & exit — found from sitemap tuta.com Checked 5 Nov 2026 Details →