Combell E-mail vs Tuta

Compare Combell E-mail and Tuta on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Google Workspace, Microsoft 365, Outlook.com

Combell E-mail

Belgium· Email Services

Needs review

Shortlist when you need Benelux domain mail with phone-first support, Hosted Exchange on Combell infrastructure, or Microsoft 365 sold with local onboarding from a Belgian host. Skip when you need zero-access / E2EE mail or a vendor that never routes collaboration data through Microsoft — consider Mailfence, Proton Mail, or Tuta instead.

EU-operated (Belgium)Benelux data centres (claimed)Hosted ExchangeMicrosoft 365 resellerISO 27001 (claimed)24/7 local support

View listing Visit Website

Tuta

Germany· Email Services

Needs review

Shortlist when you need default end-to-end encrypted mail, calendar, and contacts under German law with post-quantum TutaCrypt and official multi-platform apps. Skip when teams must keep Outlook/Thunderbird via IMAP or need a full M365/Workspace suite—consider Proton Mail (Bridge) or mailbox.org instead.

Default mailbox E2EETutaCrypt post-quantumEU-operated (Germany)Open-source clientsDE data centers (claimed)No IMAP (by design)

View listing Visit Website

Highlighted rows differ between the two products.

Combell E-mail vs Tuta: Snapshot
Feature	Combell E-mail	Tuta
Country of origin	Belgium	Germany
Category	Email Services	Email Services
Open source	No	Yes
Self-hosted	No	No
Headquarters	Belgium	Germany
Legal entity	Combell nv (Skaldenstraat 121, 9042 Ghent; CBE 0541.977.701)	Tutao GmbH (HRB 208014, Hanover)
Governing law	Belgium / EU GDPR	German law / GDPR
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Basic and Hosted Exchange: Combell-operated Tier 3+ Benelux data centres (Belgium/Netherlands claimed for Exchange mail). Microsoft 365 SKUs: Microsoft cloud (US-parented provider). Flexmail and other team.blue sister tools may process campaign data. Public named subprocessor list not published — request via data protection contact. Privacy policy allows third-party processors and SCCs for some non-EU manufacturers.	Vendor states mailbox data is stored end-to-end encrypted on Tutao-operated servers in ISO 27001-certified data centers in Germany. No AWS/GCP/Azure primary hosting named on official security/privacy pages. Privacy statement discloses payment processing via PayPal (Europe) and banks for card/SEPA; no comprehensive public subprocessor list found for ops tools.
Summary	Belgian professional email hosting from Combell (team.blue): domain Basic IMAP mailboxes, Hosted Exchange, Microsoft 365 reseller options, spam protection, backups, SMTP relay, and 24/7 Benelux support.	German end-to-end encrypted email, calendar, and contacts from Tutao GmbH in Hanover—with post-quantum TutaCrypt, open-source clients, and freemium personal plus business plans.
Tags	gdpr email-hosting exchange microsoft-365 belgium smb benelux imap	gdpr open-source privacy saas encrypted-email post-quantum freemium germany

At a glance: Combell E-mail vs Tuta
At a glance	Combell E-mail	Tuta
HQ	Ghent, Belgium (Combell nv)	Hanover, Germany (Tutao GmbH)
Group	team.blue (European multi-brand)	Not listed
Product type	Hosted domain email (SaaS)	Not listed
Open source	No	Clients GPLv3 on GitHub; no productized self-host
Self-host	No	Not listed
Main SKUs	Basic IMAP · Hosted Exchange · Microsoft 365 · SMTP relay · Flexmail	Not listed
Commercial model	Paid subscription plans; money-back guarantee advertised	Freemium personal + paid personal/business (no ads)
Product	Not listed	Encrypted email, calendar, contacts (SaaS)
Hosting	Not listed	Own servers in ISO 27001 data centers in Germany (vendor claim)
Protocols	Not listed	No IMAP/SMTP client access; official apps only
Crypto	Not listed	TutaCrypt hybrid (Kyber-1024 + X25519 + AES-256) for new accounts

Key capabilities: Combell E-mail vs Tuta
Key capabilities	Combell E-mail	Tuta
EU-operated (Belgium)	Yes	Yes
Benelux data centres (claimed)	Yes	Not listed
Hosted Exchange	Yes	Not listed
Microsoft 365 reseller	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
24/7 local support	Yes	Not listed
Default mailbox E2EE	Not listed	Yes
TutaCrypt post-quantum	Not listed	Yes
Open-source clients	Not listed	Yes
DE data centers (claimed)	Not listed	Yes
No IMAP (by design)	Not listed	Yes

Combell E-mail

Domain Basic mailboxes (IMAP/POP3/SMTP)
Create addresses on your own domain with multi-device sync, client compatibility (Outlook, Apple Mail, mobile), and browser webmail. Published storage tiers include 5 GB, 50 GB, and 100 GB Basic plans with spam/antivirus filtering and daily mailbox backups. Suited to SMEs that need professional mail without Exchange collaboration features.
Hosted Exchange with calendars and push
Exchange mailboxes add shared calendars, task lists, meeting-room booking, and direct push notifications, with free transfer help for existing Exchange setups. Combell states Exchange mail runs in Belgium and Netherlands data centres. Choose this when teams need Outlook-style groupware without the full Microsoft 365 app suite.
Microsoft 365 reseller with local setup
Business and Enterprise Microsoft 365 packages combine Exchange mail with Office apps, OneDrive, Teams, and related Microsoft cloud services. Combell differentiates with DNS/mailbox configuration service and 24/7 support in local languages rather than Microsoft-only helpdesks. Mailbox and file data on this path are processed by Microsoft, not only on Combell hardware.
Spam filtering, antivirus, and daily backups
Basic and Exchange product pages include automated spam and virus scanning plus daily mailbox backups for restore after accidental deletion. Microsoft 365 customers can add a separate Combell Microsoft 365 backup product for more frequent cloud backups of mail and files. Local client backups are still recommended for dual protection.
SMTP relay and Flexmail marketing path
A dedicated mail-server / SMTP relay product targets higher-volume sending with plan-based monthly send limits and optional dedicated IP, aimed at newsletters and app transactional mail that would hit shared-mailbox limits. New mailbox customers are offered Flexmail e-mail marketing trial packages via the sister brand in the team.blue group.
24/7 multilingual Benelux support
Combell markets round-the-clock support by phone (toll-free lines advertised), chat, and e-mail in local languages, including weekends and holidays. The company claims to have been the first Belgian hoster with 24/7 support (from 2000). This is a core reason Benelux SMEs pick Combell over pure self-serve global suites.

Tuta

Default E2EE for mail, subjects, and attachments
Between Tuta users, messages encrypt automatically including subject lines, bodies, and attachments. External recipients can use a shared password for end-to-end threads without installing software. Contacts and calendars use the same zero-access model; only delivery metadata (addresses, timestamps) stays readable by design.
TutaCrypt post-quantum hybrid cryptography
New accounts use TutaCrypt: Kyber-1024 KEM plus X25519 ECDH with AES-256, targeting harvest-now-decrypt-later risks. Protocol details are published; existing accounts migrate as key rotation rolls out. Tuta intentionally avoids PGP so subjects and non-mail features can stay encrypted and algorithms can be upgraded in-product.
Zero-knowledge calendar with private reminders
Calendar events—including times, titles, locations, and attendees—are end-to-end encrypted. Reminders are pushed as encrypted payloads and fired locally so servers are not told when an event starts. Sharing stays encrypted; invites can go out via mail, optionally password-protected for externals.
Open-source multi-platform clients (no IMAP)
Web, Android (Play and F-Droid), iOS, Windows, macOS, and Linux clients are published under GPLv3 on GitHub. Desktop builds are signed for verification. There is no IMAP/SMTP bridge: third-party mail apps cannot connect, which preserves encryption at rest but forces a client switch for Outlook/Thunderbird holdouts.
Business domains, admin console, and whitelabel
Paid business plans add custom domains, aliases, shared mailboxes, multi-admin roles, password/2FA resets, catch-all, templates, and optional branding/login on your own site. Vendor-stated uptime SLA and a GDPR order-processing agreement support B2B procurement—confirm current plan matrix on tuta.com.

Assurance & compliance: Combell E-mail vs Tuta
Assurance & compliance	Combell E-mail	Tuta
Independent security / no-logs audit	Not found No public independent no-logs or mailbox-content audit found; ISO certificates are management-system certs, not no-logs proofs.	Vendor claimed Vendor states SySS GmbH penetration testing before public release; not a continuously published annual no-logs audit PDF on the marketing site.
ISO 27001	Vendor claimed Vendor states first Belgian hoster certified in 2011; certificate PDF linked on ISO page; scope includes hosting and related services. Re-verify current certificate in procurement.	Partial Official pages claim data centers are ISO 27001 certified; does not clearly establish a public Tutao GmbH organizational ISO 27001 certificate.
ISO 27701 (privacy information management)	Vendor claimed Vendor claims first Benelux hoster (2021); scope text includes e-mail and office tools. Certificate PDF linked on site.	Not listed
ISO 9001	Vendor claimed Vendor claims certification since 2007; certificate PDF linked; scope includes e-mail & tools among other services.	Not listed
SOC 2 / SOC 3	Not found No public SOC 2/3 report located on Combell marketing/trust pages during research.	Not found No SOC 2/3 report located on security, business, or privacy pages.
GDPR / EU data protection	Vendor claimed Belgian EU entity; detailed privacy policy referencing GDPR; ISO 27701 claimed for privacy management. Confirm DPA and processing roles for your use case.	Vendor claimed German controller Tutao GmbH; privacy statement cites GDPR; DPO published; DE storage claimed.
US CLOUD Act exposure (indicative)	Partial EuropeanStack assessment: no known US parent of Combell nv, but Microsoft 365 SKUs use Microsoft (US-parented) as cloud processor; public subprocessor list missing; privacy policy contemplates non-EU manufacturers with SCCs for some products. Basic/Hosted Exchange on Benelux DCs is a lower-exposure path than Microsoft 365. Not legal advice.	Partial EU entity, no known US parent, primary mailbox hosting claimed as own DE servers—not AWS/GCP/Azure. Payment may use PayPal (Europe). Assessment is low exposure for content with residual billing/processor unknowns; not a vendor 'safe' claim. Not legal advice.
Data processing agreement (B2B)	Not found No self-serve public DPA download found. Privacy policy describes processor contracts with sub-contractors; contact Data Protection Team (data.protection@combellgroup.com) to request current DPA and subprocessor list.	Vendor claimed Security/business materials state an Order Processing Agreement (Auftragsverarbeitung) is provided for GDPR; obtain signed version via sales—no public self-serve DPA URL confirmed.
EU AI Act	Not applicable Core product is email hosting; optional Microsoft Copilot add-on is Microsoft AI — evaluate under Microsoft terms if purchased, not as a Combell-native AI system.	Not applicable Encrypted email/calendar product; vendor states it does not plan AI that processes user communications for model training.

Considerations & known limitations: Combell E-mail vs Tuta
Considerations & known limitations	Combell E-mail	Tuta
Microsoft 365 path uses Microsoft cloud	High Choosing Microsoft 365 via Combell does not keep mailbox/file data solely on Belgian Combell servers. Microsoft remains the cloud provider for those tenants; CLOUD Act and transfer diligence must treat Microsoft, not only Combell.	Not listed
No public subprocessor list	Medium Privacy policy confirms third-party processors and group sharing but does not publish a named register. Buyers must request the current list (including Flexmail, Microsoft if applicable, and team.blue affiliates) before relying on residency claims.	Not listed
Not end-to-end encrypted mail	Medium Provider-side spam filtering and backups imply conventional hosted mail architecture. Unsuitable where zero-access encryption is a hard requirement.	Not listed
ISO claims not independently re-verified here	Low ISO 9001/27001/27701 are vendor-published with PDF certificates. This evaluation marks them claimed; procurement should check validity dates and scope against the actual email services purchased.	Not listed
PE-backed group ownership	Low team.blue has major PE investors (Hg and reported co-investors). This is European PE structure, not a US Big Tech parent, but ownership can change; track change-of-control clauses in contracts if sovereignty is critical.	Not listed
No IMAP/SMTP third-party clients	Not listed	High Desktop and mobile holdouts cannot stay on Outlook/Thunderbird/Apple Mail. Plan full client migration or pick a standards-based alternative.
Weaker protection to non-Tuta recipients	Not listed	Medium Without a shared password, external mail is ordinary SMTP (TLS in transit). Only Tuta-to-Tuta and password-protected external threads are true E2EE.
Hosted service, not on-prem mail	Not listed	Medium Open-source clients help inspectability, but mailboxes still depend on Tutao's German SaaS backend, uptime, and German legal process.
Data-center ISO vs company ISMS	Not listed	Low ISO 27001 wording refers to data centers. Do not tick 'vendor ISO 27001 certified' on questionnaires without the actual Tutao certificate.
Limited public subprocessor inventory	Not listed	Medium Privacy policy covers payments (e.g. PayPal Europe) but lacks a detailed live subprocessor register. Request the DPA annex for DPIA completeness.
German court orders on accessible data	Not listed	Low Transparency reports show regular German requests. Stored E2EE content stays undecryptable by Tutao; real-time monitoring can expose newly arriving unencrypted SMTP mail. Align expectations with counsel.

Fit

Combell E-mail

Best fit when

Benelux SMEs that want professional domain addresses with IMAP/POP or Exchange and a real phone helpdesk
Teams already buying domains or web hosting from Combell / team.blue and consolidating vendors
Organisations that need Hosted Exchange calendars and push without standing up their own mail servers
Buyers who want Microsoft 365 with local DNS/mailbox configuration and 24/7 Dutch/French/English support
Senders who need an SMTP relay or Flexmail path alongside domain mailboxes

Poor fit when

Requirements for end-to-end encrypted or zero-access email (provider cannot read content)
Need for open-source self-hosted mail only (Combell is hosted SaaS, not a self-host product)
Hard ban on any Microsoft-class processor when the org still wants full Office cloud collaboration
Procurement that requires a public subprocessor register before first contact (list not published online)
Teams seeking free unlimited consumer mail rather than paid professional mailboxes

Consider instead when

When: You need Belgian or EU end-to-end encrypted mail with OpenPGP / zero-access positioning
Consider: Mailfence (Belgium) or Proton Mail
Combell is classic hosting mail with spam filters and backups, not an E2EE privacy suite.
When: You want privacy-focused paid mail without Microsoft suite lock-in and are fine outside Benelux support culture
Consider: Posteo, Tuta, Soverin, or Runbox
Stronger anti-tracking or encryption narratives; thinner local Belgian phone support than Combell.
When: You only need Microsoft 365 and do not value a Benelux reseller for setup/support
Consider: Microsoft 365 direct (or Google Workspace if you prefer Google)
Combell does not remove Microsoft as processor; direct purchase may be simpler for pure Microsoft estates.

Tuta

Best fit when

Teams that will standardize on Tuta's official web/mobile/desktop clients for default zero-access email
Orgs prioritizing subject-line encryption, encrypted calendar, and post-quantum hybrid crypto under German jurisdiction
SMEs needing custom domains, aliases, shared mailboxes, and multi-admin controls without running their own mail servers
Journalists, NGOs, and privacy-led departments that value F-Droid builds, no Google Push dependency, and ad-free operation
Buyers who want open-source client auditability plus a freemium path for personal trial before business seats

Poor fit when

Hard requirement for IMAP/SMTP in Outlook, Thunderbird, Apple Mail, or third-party automation
On-prem / customer-operated mail server mandates (no productized self-host for the backend)
Workflows that depend on first-class PGP or S/MIME interoperability with external partners
Primary need is full Google Workspace or Microsoft 365 collaboration (Drive, Meet, deep Outlook) rather than encrypted mail first

Consider instead when

When: Users must keep desktop IMAP clients or need Bridge-style Outlook integration
Consider: Proton Mail (Bridge on paid plans) or mailbox.org / Posteo / Soverin
Those options trade Tuta's automatic subject E2EE model for standards-based access
When: You need a broader German digital workplace (Drive, Office, video) with optional PGP
Consider: mailbox.org
Stronger suite breadth; different default encryption depth than Tuta's full zero-access mailbox
When: Swiss jurisdiction and multi-product privacy suite (VPN, drive, pass) matter more than German HQ
Consider: Proton Mail
Compare Bridge, ecosystem lock-in, and published cert posture side by side
When: Belgian OpenPGP-centric suite with browser crypto and classic protocols is preferred
Consider: Mailfence
Different encryption UX (PGP-oriented) versus Tuta's automatic proprietary stack

Open questions for due diligence

Combell E-mail

Will Combell provide a signed DPA and a current named subprocessor list for Basic vs Hosted Exchange vs Microsoft 365 SKUs?
For Basic and Hosted Exchange, are all mailbox stores, backups, and anti-spam engines restricted to Belgium/Netherlands with no US-group subprocessors?
What Microsoft data residency / EU Data Boundary options are available on Combell-sold Microsoft 365 tenants?
Can independent auditors receive ISO certificate numbers, scopes, and any penetration-test summaries under NDA?
How is Flexmail (and other sister brands) contractually separated when mailbox customers enable marketing tools?

Tuta

Will Tutao provide a current signed AVV/DPA with a full subprocessor list (DNS, billing, support, CDN if any)?
Is there a current organizational ISO 27001 or SOC 2 report for Tutao GmbH, or only facility-level data-center certification?
What is the documented status of TutaCrypt key rotation for all legacy accounts in your tenant?
Are any US-group cloud services used for backups, DNS, or support tooling beyond payment processors named in the privacy statement?
For business rollout: migration tooling limits (EML/MBOX import on desktop) and dual-running period with legacy IMAP hosts?