# Tuta Business — Business Email & Office Suites

Tuta Business by Tutao GmbH holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-05. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Tutao GmbH (https://tuta.com/business)
- Category: [Business Email & Office Suites](https://whats-best.ai/software/business-email.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/business-email/tuta-business
- Alternatives: https://whats-best.ai/software/business-email/tuta-business/alternatives ([markdown](https://whats-best.ai/software/business-email/tuta-business/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-05 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Tutao GmbH
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Default not stated; pages mention Germany [S16]
- Free plan: Yes, per the vendor’s own page [S10]

## The panel's verdict

Tuta Business from Tutao GmbH of Hanover is an end-to-end encrypted mail, calendar and file bundle on custom domains, with three public business tiers at €6, €8 and €12 per user per month paid yearly, each marked "Excludes taxes". The bench scores it strongest on sovereignty, 8 to 9, and security and compliance, 7, crediting quantum-safe encryption the vendor states even it cannot read, hosting on its own servers in ISO 27001 certified data centres in Germany, a published data processing agreement and a named SySS penetration test. Weakest are calendar and office at 4 and administration and identity at 4 to 5: we found no public information on free/busy lookup, room booking, document co-editing, single sign-on, directory sync or SCIM provisioning, and the bundled file store is in closed beta. Splits are narrow: on mail and deliverability the small firm owner scores 4 over the vendor-stated absence of IMAP and the 100 emails-per-hour cap, while the IT administrator scores 6 on the documented DNS set-up; pricing transparency runs 6 to 7 over a missing monthly-billing figure.

**Speaks for it:**
- Mail, calendars and contacts are end-to-end encrypted with quantum-safe algorithms, and the vendor states even it cannot read the content.
- Tutao GmbH of Hanover hosts on its own servers in ISO 27001 certified data centres in Germany, with a published data processing agreement and payment subprocessors named with their locations.
- All three business tiers are public at €6, €8 and €12 per user per month paid yearly, with storage, custom-domain and alias counts and support level stated per tier.
- Custom-domain set-up is documented record by record (TXT, MX, SPF, DKIM, MTA-STS and a recommended DMARC record) with a status check, catch-all and shared mailboxes.
- The exit is written down: personal data deleted no later than 30 days after termination, self-service termination and GPLv3 open-source clients.

**Held against it:**
- We found no public information on single sign-on, directory synchronisation, SCIM provisioning, admin audit logs or remote device wipe.
- GoBD compliance appears as a single claim, with no public information on archiving, retention policies, legal hold, eDiscovery or a transparency report.
- The captured pages give different figures for backups, email import, maximum message size and availability.
- We found no public information on document co-editing, video meetings or chat, and the bundled file storage is in closed beta.

**Best for:**
- You need end-to-end encrypted mail, calendars and contacts on your own domain from a German contracting entity with a published data processing agreement and named payment subprocessors.
- You run a small team that fits the documented administration console — multiple admin roles, sign-in-as-user, centralized billing and admin-enforced two-factor.
- You can pay on invoice and want to keep the one documented third-country transfer — credit card data to Braintree in the USA — out of your chain.
- You want verifiable security claims — GPLv3 open-source clients on GitHub and a named SySS penetration test.

**Avoid if:**
- You must run audit-proof archiving with retention policies, legal hold or eDiscovery — we found no public information on these behind the GoBD claim.
- You administer hundreds of accounts through single sign-on, directory synchronisation or SCIM provisioning — we found no public information on any of these, nor on remote wipe or audit logs.
- You are migrating from Exchange or Microsoft 365 or need mailbox export in standard formats — we found no public information on a whole-organisation migration tool or standard-format export, and the send cap is 100 emails per hour per account.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Small Firm Owner | The IT Administrator | The Public Sector IT Lead | The IT Service Provider | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Mail, domains & deliverability | 2/5 | 3/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 |
| Calendar, contacts & office apps | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Security, encryption & compliance archiving | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Administration, identity & partner management | 2.5/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Migration, open standards & exit | 2/5 | 2/5 | 2/5 | 2/5 | 1.5/5 | 2/5 |
| European sovereignty | 4.5/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Pricing transparency | 3.5/5 | 3/5 | 3.5/5 | 3/5 | 3/5 | 3.5/5 |
| **Weighted verdict** | **3/5** | **2.5/5** | **3/5** | **2.5/5** | **3/5** | **3/5** |

### The judges

- **The Small Firm Owner** (v1.0): Runs a tax and accounting firm of twelve in Lower Saxony. Every member of staff lives in Outlook, the shared "kanzlei@" mailbox is the busiest address in the office, and the meeting room is booked by shouting across the corridor. Wants mail on the firm's own domain that arrives, a shared calendar and address book on every phone, a move from the old provider that does not lose a single client thread, and a per-user price that is still the price in the second year.
- **The IT Administrator** (v1.0): IT administrator at a machine builder in Baden-Württemberg with three hundred mailboxes, an on-premises Exchange that reaches end of support, and Active Directory as the source of every account. Wants Outlook to keep working without a plug-in nobody maintains, shared mailboxes and room booking, single sign-on and directory sync, mobile devices that can be wiped, an API for provisioning, and a migration that moves calendars and permissions, not only mail.
- **The Public Sector IT Lead** (v1.0): Head of IT at a district administration in Bavaria with eleven hundred staff, told by the council to leave Microsoft within three years. Has read what Schleswig-Holstein did and what it cost. Needs mail, calendars and documents that a whole administration can work in, open formats and open source where possible, BSI C5 or ISO 27001 on paper, a provider whose owners answer to European law only, and an exit plan before the contract is signed.
- **The IT Service Provider** (v1.0): Runs a six-person IT service company in Austria that looks after mail for forty client firms, from a two-person architect's office to a hotel group. Spends Mondays on mails that landed in spam and phones that stopped syncing. Wants one partner console for every client, DKIM and DMARC set up without a ticket, migrations it can run itself, support that answers within the hour, and margins it can calculate before it quotes.
- **The Data Protection Officer** (v1.0): Data protection officer for a group of nine medical practices in North Rhine-Westphalia, where a referral letter sent by mail is patient data under professional secrecy. Reads the subprocessor list and the transparency report before the feature page, asks who at the provider can open a mailbox and under which law, and wants encryption the practices can actually use with outside doctors, archiving that satisfies the tax office, and a data processing agreement that names every server.
- **The Skeptic** (v1.0): Has seen "hosted in Germany" from a provider whose spam filter and support desk sit in the United States, "Exchange-compatible" that meant IMAP with a calendar plug-in, and a first-year price of one euro that became seven. Asks which protocols Outlook really uses, whether the archive would survive a tax audit, what the certification actually covers — and how ten years of mail, calendars and contacts would leave.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Audit syss: penetration test · SySS GmbH · system not hacked, no encrypted data retrieved [S6]
- Code published github: yes [S6]
- Data location: own servers in Germany · yes [S1]
- Data minimization: yes · yes [S4]
- DPA: yes [S4]
- Encrypted content no access: no [S17]
- Encryption scope: email addresses of users, senders and recipients · yes [S17]
- GDPR: yes · yes · Germany [S14]
- GDPR: yes [S4]
- GDPR: yes · yes [S2]
- GDPR DPA: yes · yes [S1]
- GDPR gobd: yes · yes [S5]
- ISO 27001 data centers: Germany · yes [S17]
- Metadata exception: sender and recipient email addresses · no [S4]
- No cookies: no [S17]
- No google analytics: no · no [S17]
- No third party disclosure: no · yes · no [S17]
- Privacy by design: data minimization · privacy by design [S17]
- Privacy reference: Data Privacy Statement of Tutao [S11]
- Provider cannot read data: Tutao GmbH · no [S16]
- Right to object: hello@tutao.de · yes [S17]
- Security features listed: yes · yes · Europe · yes · yes [S12]
- Syss penetration test: penetration test · no intrusion or access to encrypted data · SySS GmbH [S18]

**Data**
- Account termination: yes [S7]
- Account termination: Terminate account · Revoke contract [S10]
- Backup responsibility: customer [S11]
- Campaign analysis retention: 72 [S17]
- Collected inventory data: customer country · name and invoicing address (optional for private users) · VAT identification number (business customers of some countries) [S17]
- Collected payment data: banking details · credit card data · PayPal user name [S17]
- Inventory data retention: 2 [S17]
- Mail server log retention: 7 · no [S17]
- Personal data deletion period: 30 [S17]
- Session ip retention: yes · 7 [S4]
- Usage statistics consent: yes · yes [S17]
- Usage statistics revocable: yes [S17]

**Hosting**
- Data centers: Germany · yes · yes [S4]
- Germany ISO 27001: Germany · yes · yes [S5]
- Own servers germany: Germany · own servers [S14]
- Server access control: yes · yes [S4]
- Server location: Germany · German privacy protection laws · ISO27001 [S16]

**Integrations**
- Domains hint: Exclusive domain @tuta.com for paid plans [S8]
- Open source: yes · web · desktop · Android · iOS [S4]
- Products suite: Tuta Mail · Tuta Calendar · Tuta Drive [S12]

**Legal**
- Cancellation right: private customers, distance selling contracts · 14 [S11]
- Controller: Tutao GmbH [S17]
- Controller address: Deisterstr. 17a, 30449 Hannover, Germany [S17]
- English contact email: hello@tutao.de [S17]
- Entity name: Tutao GmbH · Deisterstr. 17a, 30449 Hanover, Germany [S9]
- Founded: Hanover, Germany · 2014 [S5]
- GDPR compliance: yes [S17]
- Oin membership: 2017 · Open Invention Network [S6]
- Privacy statement language precedence: German [S17]
- Registration: District court Hanover · HRB 208014 [S9]
- Support contact note: Support requests to hello@tutao.de will be ignored; contact via Support channel. [S9]
- Terms language precedence: yes [S11]
- VAT id: DE280903265 [S9]

**Pricing**
- Advanced: yearly · no · 8 [S1]
- Blocking unblocking fee: incl. purchase tax · EUR · each of blocking and unblocking · 50 [S11]
- Business plans link: yes [S8]
- Contract terms: 1 year · 1 month · non-fixed term, cancellable anytime [S8]
- Essential: yearly · no · 6 [S1]
- Free accounts limit: 1 [S11]
- Free plan: Free · 0 [S8]
- Free tier private only: paid versions only · yes [S11]
- Invoicing: yes · yes [S11]
- Legend plan: Legend · yearly · 8 · yes [S8]
- Open source special offer: open source projects · yes [S6]
- Payment methods: banking account · credit card · PayPal · Business customers may choose to pay on invoice. [S11]
- Prepayment: charged with invoice · payable in advance [S11]
- Refund on tutao termination: Tutao ends contract prior to end of billing period [S11]
- Renewal policy: monthly · yearly · yes [S1]
- Revolutionary plan: Revolutionary · yearly · 3 · yes [S8]
- Termination for nonpayment: 2 [S11]
- Unlimited: yearly · no · 12 [S1]
- User cost: yes [S13]

**Product**
- 2FA: yes [S1]
- 2FA admin management: yes · yes [S13]
- 2FA methods: U2F · TOTP [S16]
- 2FA recovery code: yes [S13]
- 2FA session accept: yes [S13]
- 2FA types: U2F security keys · TOTP authenticator apps [S13]
- Accounts: +10 million [S2]
- Ad free: Service is ad-free, no tracking or personalized ads [S15]
- Ad free: yes [S12]
- Ad free no tracking: yes · no · no [S5]
- Address book encrypted: yes · no [S16]
- Address recycling: no [S16]
- Admin recommendation: 2 [S1]
- AI usage policy: Tuta states it does not plan to develop an AI that processes/abuses user data [S10]
- Alias limit: 30 · unlimited [S1]
- Aliases paid minimum: 5 [S13]
- Anonymous signup: no · yes [S4]
- App rating: 4.7 [S2]
- App unlock biometrics: pin · pattern · fingerprint · Face ID [S16]
- App unlock methods: pin · pattern · biometrics [S13]
- Attachment size: 25 [S1]
- Attachment size: 25 [S8]
- Automatic backups: yes [S1]
- Automatic encryption: end-to-end encryption applied automatically, no setup needed [S14]
- Availability SLA: 24 hours per day, seven days per week · 99 [S11]
- Backup: file backup included [S14]
- Beta status: closed_beta · a few months [S14]
- Bulk mail ban: no [S11]
- Bundle: Tuta Mail · Tuta Calendar · Tuta Drive [S2]
- Business features listed: Business feature rows compared across Tuta Calendar, Google Calendar, Microsoft Outlook, iCloud/Apple Calendar: access on any device; monthly/weekly/daily view; recurring events; invites via iCal; import/export of calendars; multiple calen… [S15]
- Business features listed: Custom domains, unlimited custom domain addresses, multi-user support, email aliases, whitelabel, encrypted calendar [S12]
- Business offering: yes [S2]
- Calendar ics import export: .ics [S13]
- Catch all: yes [S1]
- Catch all paid: yes [S13]
- Client platforms: Windows · macOS · Linux · Android · iOS · web [S6]
- Clients open source: yes [S6]
- Community involvement: translation · pull-requests · recruiting [S6]
- Company funding: no [S6]
- Compare features criteria: Comparison criteria: ease of use, functional design, sending invites, sharing entire calendars [S15]
- Compared services: Services compared: Google Calendar, Outlook Calendar, iCloud/Apple Calendar, Tuta Calendar [S15]
- Csp and sanitizer: yes · yes · yes [S4]
- Custom alias unlimited: no · yes [S13]
- Custom builds: Linux · F-Droid · yes [S6]
- Custom domain dns records: TXT · ownership proof · MX · MX relay · TXT · SPF · CNAME · _domainkey · DKIM · CNAME · MTA-STS · TXT · _dmarc · DMARC · yes [S13]
- Custom domain requirement: yes [S13]
- Custom domains tiers: 10 · 3 · unlimited [S1]
- Customer count: 10,000+ [S1]
- Customer count: over 10,000 business customers [S5]
- Desktop client signing: yes [S4]
- Desktop clients: Windows · macOS · Linux · yes · yes [S2]
- Developer: developed by Tuta, maker of Tuta Mail and Tuta Calendar [S14]
- Device sync: yes · iPhone · Android · desktop [S14]
- Dns verification: yes [S13]
- E2e between tuta users: yes [S16]
- E2e encrypted mailbox: yes [S12]
- E2e encryption: yes · yes [S6]
- E2e encryption default: yes [S13]
- E2e encryption row: Comparison row 'Automatic end-to-end encryption of all data'; Google, Microsoft Outlook and iCloud/Apple Calendar marked with '-' (not offered), Tuta Calendar implied to offer it [S15]
- E2e encryption scope: yes · yes · yes · yes [S4]
- E2e reminders row: Comparison row 'Automatic end-to-end encryption of reminders'; competitors marked with '-' [S15]
- Eco friendly claim: yes · yes · yes [S12]
- Encrypted calendar reminders: yes · yes [S4]
- Encrypted data types: Contacts · Calendars · Emails · Email signature · Inbox rules · Invoice data · Payment method · Certificate · Private keys of your own domains [S16]
- Encrypted email storage: Germany, own servers · yes [S5]
- Encrypted search index: sender · recipient · subject line · body · attachment · yes [S4]
- Encryption: yes · yes · yes [S14]
- Encryption: emails · calendars · contacts · yes [S1]
- Encryption: yes · yes · yes [S2]
- Encryption algorithms: yes · yes · yes · ECDH (x25519) Kyber-1024 [S4]
- Encryption algorithms: AES 256 · RSA 2048 · ECC x25519 · Kyber-1024 quantum-safe [S16]
- Encryption claims: yes · yes [S8]
- Encryption features listed: Comparison table encryption features: TLS transmission, E2E storage, E2E internal email, E2E to external recipients, E2E contact details, encrypted subject lines [S12]
- Encryption location: yes [S16]
- End to end encryption: yes [S18]
- Enforce 2FA all users: paid accounts with multiple users · yes [S16]
- Europe servers row: Comparison row 'Servers in Europe'; competitors marked with '-' [S15]
- External encrypted email: yes · yes [S4]
- External encryption: yes [S1]
- Extra addresses tiers: 30 · 15 · 30 [S1]
- F droid: yes · yes [S6]
- Fdroid first email app: yes [S18]
- File sharing: upload, organize and share files [S14]
- File types: files, documents, images, videos [S14]
- Free: yes [S2]
- Free account inactivity deletion: 6 [S16]
- Free account termination: 6 [S11]

**Subprocessors**
- Braintree: Braintree · USA · credit card payments [S17]
- Paypal: PayPal (Europe) S.à r.l. et Cie, S.C.A. · 22-24 Boulevard Royal, L-2449 Luxembourg · PayPal payments [S17]

**Support**
- Abuse reporting: abuse team via forwarded message [S7]
- Bug reporting: https://github.com/tutao/tutanota/issues · GitHub issues [S7]
- Business sales contact: yes [S7]
- Faq sections: General questions · Security and Privacy · How to use Tuta · Payment [S7]
- Forum available: yes [S7]
- Inactivity deletion: no · yes · 6 [S7]
- Location: Hanover, Germany [S1]
- Password reset self service: no · yes [S7]
- Plan support: priority email support · email support [S8]
- Support languages: English · German [S7]

130 more facts on the canonical page: https://whats-best.ai/software/business-email/tuta-business

## Questions

### Is Tuta Business European?

Yes. whats-best.ai classifies Tuta Business as EU-Made.

### Where does Tuta Business store data?

The default storage location for customer data is not stated on the vendor’s pages as of 5 Nov 2026. The vendor’s pages mention Germany as hosting location, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/18341).

### Does Tuta Business have a free plan?

Yes. Tuta Business has a free plan, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/18320).

### What are the best alternatives to Tuta Business?

As of 6 Nov 2026, the panel rates [grommunio (3.5/5)](https://whats-best.ai/software/business-email/grommunio), [Infomaniak kSuite (3.5/5)](https://whats-best.ai/software/business-email/infomaniak-ksuite) and [Nextcloud Hub (Groupware & Office) (3.5/5)](https://whats-best.ai/software/business-email/nextcloud-hub) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [grommunio](https://whats-best.ai/software/business-email/grommunio) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Tuta Business alternatives](https://whats-best.ai/software/business-email/tuta-business/alternatives).

## Head-to-head

- [Tuta Business vs mailbox.org Business](https://whats-best.ai/compare/mailbox-org-vs-tuta-business.md)

## What this page leaves out

- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage (business): https://tuta.com/business (checked 2026-11-05)
- [S2] Features page (calendar): https://tuta.com/calendar (checked 2026-11-05)
- [S3] Features page (encryption): https://tuta.com/encryption (checked 2026-11-05)
- [S4] Security / trust page: https://tuta.com/security (checked 2026-11-05)
- [S5] Features page (digital sovereignty): https://tuta.com/digital-sovereignty (checked 2026-11-05)
- [S6] Features page (open source): https://tuta.com/open-source (checked 2026-11-05)
- [S7] Documentation (help and FAQ): https://tuta.com/support (checked 2026-11-05)
- [S8] Pricing page: https://tuta.com/pricing (checked 2026-11-05)
- [S9] Legal notice: https://tuta.com/imprint (checked 2026-11-05)
- [S10] Privacy policy: https://tuta.com/privacy (checked 2026-11-05)
- [S11] Terms of service: https://tuta.com/terms (checked 2026-11-05)
- [S12] Mail, domains & deliverability — found from sitemap: https://tuta.com/mailbox (checked 2026-11-05)
- [S13] Mail, domains & deliverability — found from sitemap: https://tuta.com/support/domain (checked 2026-11-05)
- [S14] Calendar, contacts & office apps — found from sitemap: https://tuta.com/drive (checked 2026-11-05)
- [S15] Calendar, contacts & office apps — found from sitemap: https://tuta.com/calendar-app-comparison (checked 2026-11-05)
- [S16] Security, encryption & compliance archiving — found from sitemap: https://tuta.com/support/security (checked 2026-11-05)
- [S17] Security, encryption & compliance archiving — found from sitemap: https://tuta.com/privacy-policy-archived (checked 2026-11-05)
- [S18] Migration, open standards & exit — found from sitemap: https://tuta.com/de/open-source (checked 2026-11-05)

---

Cite as: whats-best.ai, "Tuta Business — Business Email & Office Suites", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-email/tuta-business

Corrections: https://whats-best.ai/correct/1546?target=page