eclipso Mail Europe vs Tuta

Compare eclipso Mail Europe and Tuta on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Microsoft 365, Outlook.com

eclipso Mail Europe

Germany· Email Services

Needs review

Shortlist when you want German-hosted mail with direct IMAP/SMTP, optional OpenPGP/S/MIME free on all tiers, prepaid freemium cost control, and a small business suite (drive, calendar, hybrid SMS/fax/post). Skip when you need zero-access defaults, published ISO/SOC audits, or large-enterprise identity—consider Posteo, Tuta, Proton Mail, or mailbox.org instead.

Germany-hosted (claimed)OpenPGP + S/MIMEIMAP/SMTP nativePrepaid freemiumOwner-operated DEBusiness DPA (Art. 28)

View listing Visit Website

Tuta

Germany· Email Services

Needs review

Shortlist when you need default end-to-end encrypted mail, calendar, and contacts under German law with post-quantum TutaCrypt and official multi-platform apps. Skip when teams must keep Outlook/Thunderbird via IMAP or need a full M365/Workspace suite—consider Proton Mail (Bridge) or mailbox.org instead.

Default mailbox E2EETutaCrypt post-quantumEU-operated (Germany)Open-source clientsDE data centers (claimed)No IMAP (by design)

View listing Visit Website

Highlighted rows differ between the two products.

eclipso Mail Europe vs Tuta: Snapshot
Feature	eclipso Mail Europe	Tuta
Country of origin	Germany	Germany
Category	Email Services	Email Services
Open source	No	Yes
Self-hosted	No	No
Headquarters	Germany	Germany
Legal entity	Claus-Peter Beringer (eclipso Mail Europe), Grubstr. 9b, 95445 Bayreuth	Tutao GmbH (HRB 208014, Hanover)
Governing law	German / EU law (GDPR, BDSG); BayLDA supervisory authority named in privacy notice	German law / GDPR
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Primary hosting claimed exclusively in Germany; privacy policy names Speedloc Datacenter (Görlitz) with AVV. Optional SMS/fax/post: Commify Germany, CM.com Germany, letterei.de (all DE). Payments: Stripe Payments Europe and PayPal (Europe). Site: Google reCAPTCHA; marketing ad partners documented; Matomo self-hosted analytics.	Vendor states mailbox data is stored end-to-end encrypted on Tutao-operated servers in ISO 27001-certified data centers in Germany. No AWS/GCP/Azure primary hosting named on official security/privacy pages. Privacy statement discloses payment processing via PayPal (Europe) and banks for card/SEPA; no comprehensive public subprocessor list found for ops tools.
Summary	Owner-operated German email and cloud suite with IMAP, optional OpenPGP/S/MIME, prepaid freemium, Drive/organizer, and hybrid SMS/fax/post—hosted in Germany.	German end-to-end encrypted email, calendar, and contacts from Tutao GmbH in Hanover—with post-quantum TutaCrypt, open-source clients, and freemium personal plus business plans.
Tags	privacy gdpr germany email openpgp prepaid cloud-storage imap	privacy gdpr germany open-source saas encrypted-email post-quantum freemium

At a glance: eclipso Mail Europe vs Tuta
At a glance	eclipso Mail Europe	Tuta
HQ	Bayreuth, Germany	Hanover, Germany (Tutao GmbH)
Legal entity	Claus-Peter Beringer (owner-operated)	Not listed
Founded	2003 (vendor)	Not listed
Hosting	Germany; Speedloc Datacenter (Görlitz) named in privacy policy	Own servers in ISO 27001 data centers in Germany (vendor claim)
Open source	No	Clients GPLv3 on GitHub; no productized self-host
Self-hosted	No (SaaS)	Not listed
Commercial model	Freemail (ad-supported) + prepaid paid tiers	Freemium personal + paid personal/business (no ads)
Encryption	Optional OpenPGP + S/MIME; TLS in transit	Not listed
Product	Not listed	Encrypted email, calendar, contacts (SaaS)
Protocols	Not listed	No IMAP/SMTP client access; official apps only
Crypto	Not listed	TutaCrypt hybrid (Kyber-1024 + X25519 + AES-256) for new accounts

Key capabilities: eclipso Mail Europe vs Tuta
Key capabilities	eclipso Mail Europe	Tuta
Germany-hosted (claimed)	Yes	Not listed
OpenPGP + S/MIME	Yes	Not listed
IMAP/SMTP native	Yes	Not listed
Prepaid freemium	Yes	Not listed
Owner-operated DE	Yes	Not listed
Business DPA (Art. 28)	Yes	Not listed
Default mailbox E2EE	Not listed	Yes
TutaCrypt post-quantum	Not listed	Yes
EU-operated (Germany)	Not listed	Yes
Open-source clients	Not listed	Yes
DE data centers (claimed)	Not listed	Yes
No IMAP (by design)	Not listed	Yes

eclipso Mail Europe

Native OpenPGP and S/MIME in every plan
OpenPGP (RFC 4880/9580) key wizard and import work in webmail and apps, free from Freemail upward; S/MIME accepts user-supplied X.509 certificates for business clients. E2EE only applies when both sides use it—plain IMAP mail is not zero-access by default. Private keys for webmail PGP are held in the account under a passphrase for multi-device use.
Standard IMAP, POP3, SMTP plus CalDAV/CardDAV
Direct protocol access for Thunderbird, Outlook, Apple Mail, and mobile clients without a bridge product. Calendar and contacts sync via CalDAV/CardDAV; Premium and Business add WebDAV for the cloud drive. Suits teams that refuse locked-in web-only mail.
German-hosted suite: mail, drive, organizer
One account covers webmail, eclipso Drive file storage with link sharing, Media Center, calendar, address book, notes, and tasks. Vendor claims exclusive Germany data centres (privacy policy names Speedloc Datacenter, Görlitz). Storage and address limits scale by prepaid tariff; WebDAV and higher quotas need paid tiers.
Prepaid freemium with optional hybrid channels
Freemail signs up without credit card or phone number and is ad-supported; paid Connect/Premium/Business terms are prepaid and end automatically after a reminder. Credits enable SMS, fax, and hybrid physical post through named German gateways—useful for crafts and SMEs still on those channels.
Business domain and Art. 28 DPA on Business plan
Business includes a custom mail domain option, higher alias counts, daily send limits suitable for small campaigns, and an in-product Art. 28 GDPR DPA download per vendor docs. Not a full enterprise workspace: no public SCIM/SSO pack or multi-org admin model documented.

Tuta

Default E2EE for mail, subjects, and attachments
Between Tuta users, messages encrypt automatically including subject lines, bodies, and attachments. External recipients can use a shared password for end-to-end threads without installing software. Contacts and calendars use the same zero-access model; only delivery metadata (addresses, timestamps) stays readable by design.
TutaCrypt post-quantum hybrid cryptography
New accounts use TutaCrypt: Kyber-1024 KEM plus X25519 ECDH with AES-256, targeting harvest-now-decrypt-later risks. Protocol details are published; existing accounts migrate as key rotation rolls out. Tuta intentionally avoids PGP so subjects and non-mail features can stay encrypted and algorithms can be upgraded in-product.
Zero-knowledge calendar with private reminders
Calendar events—including times, titles, locations, and attendees—are end-to-end encrypted. Reminders are pushed as encrypted payloads and fired locally so servers are not told when an event starts. Sharing stays encrypted; invites can go out via mail, optionally password-protected for externals.
Open-source multi-platform clients (no IMAP)
Web, Android (Play and F-Droid), iOS, Windows, macOS, and Linux clients are published under GPLv3 on GitHub. Desktop builds are signed for verification. There is no IMAP/SMTP bridge: third-party mail apps cannot connect, which preserves encryption at rest but forces a client switch for Outlook/Thunderbird holdouts.
Business domains, admin console, and whitelabel
Paid business plans add custom domains, aliases, shared mailboxes, multi-admin roles, password/2FA resets, catch-all, templates, and optional branding/login on your own site. Vendor-stated uptime SLA and a GDPR order-processing agreement support B2B procurement—confirm current plan matrix on tuta.com.

Assurance & compliance: eclipso Mail Europe vs Tuta
Assurance & compliance	eclipso Mail Europe	Tuta
Independent security / no-logs audit	Not found No public third-party security or no-logs audit PDF located on official pages	Vendor claimed Vendor states SySS GmbH penetration testing before public release; not a continuously published annual no-logs audit PDF on the marketing site.
ISO 27001	Not found No ISO 27001 claim found on official security/about pages at research time	Partial Official pages claim data centers are ISO 27001 certified; does not clearly establish a public Tutao GmbH organizational ISO 27001 certificate.
SOC 2 / SOC 3	Not found No SOC 2/3 report referenced on official site	Not found No SOC 2/3 report located on security, business, or privacy pages.
GDPR / EU data protection	Vendor claimed German controller, DPO contact, BayLDA authority, GDPR rights language in privacy policy; servers claimed in Germany	Vendor claimed German controller Tutao GmbH; privacy statement cites GDPR; DPO published; DE storage claimed.
US CLOUD Act exposure (indicative)	Partial EU/DE owner-operated entity with DE hosting (Speedloc), but Stripe, PayPal, and Google reCAPTCHA/ad tooling introduce US-group processing paths for payment and website data. Not legal advice.	Partial EU entity, no known US parent, primary mailbox hosting claimed as own DE servers—not AWS/GCP/Azure. Payment may use PayPal (Europe). Assessment is low exposure for content with residual billing/processor unknowns; not a vendor 'safe' claim. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Art. 28 DPA described as included and downloadable on Business plan; confirm for lower tiers	Vendor claimed Security/business materials state an Order Processing Agreement (Auftragsverarbeitung) is provided for GDPR; obtain signed version via sales—no public self-serve DPA URL confirmed.
EU AI Act	Not applicable Email/cloud suite; not an AI system product	Not applicable Encrypted email/calendar product; vendor states it does not plan AI that processes user communications for model training.

Considerations & known limitations: eclipso Mail Europe vs Tuta
Considerations & known limitations	eclipso Mail Europe	Tuta
Not zero-access by default	Medium Without OpenPGP/S/MIME, mailbox content is accessible to the operator like traditional IMAP hosts. Webmail PGP private keys are stored in-account under a passphrase—review threat model vs pure local keys.	Not listed
US-group payment and site tooling	Medium Stripe, PayPal, Google reCAPTCHA, and documented ad partners process personal data outside pure DE mailbox hosting. Material for CLOUD Act and transfer diligence even if mail servers stay in Germany.	Not listed
No public ISO/SOC or independent audit	Medium Security assurance is first-party documentation only. Regulated buyers will need questionnaires, AVVs, and possibly on-request evidence.	Not listed
Freemail is ad-supported	Low Free tier includes advertising as a service component. Paid tiers are marketed as ad-free; verify current footer/banner behaviour on the live product.	Not listed
Owner-operated scale limits	Low Independent DE operator (not VC-backed hyperscale). Expect SME-grade support hours and product depth rather than global enterprise SLAs.	Not listed
No IMAP/SMTP third-party clients	Not listed	High Desktop and mobile holdouts cannot stay on Outlook/Thunderbird/Apple Mail. Plan full client migration or pick a standards-based alternative.
Weaker protection to non-Tuta recipients	Not listed	Medium Without a shared password, external mail is ordinary SMTP (TLS in transit). Only Tuta-to-Tuta and password-protected external threads are true E2EE.
Hosted service, not on-prem mail	Not listed	Medium Open-source clients help inspectability, but mailboxes still depend on Tutao's German SaaS backend, uptime, and German legal process.
Data-center ISO vs company ISMS	Not listed	Low ISO 27001 wording refers to data centers. Do not tick 'vendor ISO 27001 certified' on questionnaires without the actual Tutao certificate.
Limited public subprocessor inventory	Not listed	Medium Privacy policy covers payments (e.g. PayPal Europe) but lacks a detailed live subprocessor register. Request the DPA annex for DPIA completeness.
German court orders on accessible data	Not listed	Low Transparency reports show regular German requests. Stored E2EE content stays undecryptable by Tutao; real-time monitoring can expose newly arriving unencrypted SMTP mail. Align expectations with counsel.

Fit

eclipso Mail Europe

Best fit when

Individuals and freelancers who want German mail with Thunderbird/Outlook IMAP and optional OpenPGP without a bridge
SMEs needing a custom domain, German server claims, and an Art. 28 DPA on the Business plan
Buyers who prefer prepaid terms that end automatically over auto-renewing Big Tech suites
Users who still send SMS, fax, or hybrid physical post from the same account
Teams migrating from Gmail/Outlook that value CalDAV/CardDAV and a bundled drive/organizer

Poor fit when

Orgs that require zero-access architecture where the provider never stores decryptable mailbox keys by default
Enterprises needing public ISO 27001/SOC 2 reports, SCIM/SSO, or multi-tenant admin
Buyers who refuse any US-group payment or website tooling (Stripe, PayPal, Google reCAPTCHA/ads)
Users seeking open-source or self-hosted mail only

Consider instead when

When: You want a simple paid-only German privacy mailbox without freemium advertising
Consider: Posteo
Posteo is ad-free paid; eclipso differentiates with freemail and hybrid channels
When: You prioritise always-on encryption over standard IMAP clients
Consider: Tuta or Proton Mail
Tuta uses proprietary E2EE clients; Proton needs Bridge for full IMAP-style access
When: You need a broader paid German workplace suite with stronger enterprise packaging
Consider: mailbox (formerly mailbox.org)
Compare admin, audit, and collaboration depth on current vendor docs
When: You need Google/Microsoft collaboration depth more than EU operator control
Consider: Gmail or Microsoft 365
Different jurisdiction and data-use models

Tuta

Best fit when

Teams that will standardize on Tuta's official web/mobile/desktop clients for default zero-access email
Orgs prioritizing subject-line encryption, encrypted calendar, and post-quantum hybrid crypto under German jurisdiction
SMEs needing custom domains, aliases, shared mailboxes, and multi-admin controls without running their own mail servers
Journalists, NGOs, and privacy-led departments that value F-Droid builds, no Google Push dependency, and ad-free operation
Buyers who want open-source client auditability plus a freemium path for personal trial before business seats

Poor fit when

Hard requirement for IMAP/SMTP in Outlook, Thunderbird, Apple Mail, or third-party automation
On-prem / customer-operated mail server mandates (no productized self-host for the backend)
Workflows that depend on first-class PGP or S/MIME interoperability with external partners
Primary need is full Google Workspace or Microsoft 365 collaboration (Drive, Meet, deep Outlook) rather than encrypted mail first

Consider instead when

When: Users must keep desktop IMAP clients or need Bridge-style Outlook integration
Consider: Proton Mail (Bridge on paid plans) or mailbox.org / Posteo / Soverin
Those options trade Tuta's automatic subject E2EE model for standards-based access
When: You need a broader German digital workplace (Drive, Office, video) with optional PGP
Consider: mailbox.org
Stronger suite breadth; different default encryption depth than Tuta's full zero-access mailbox
When: Swiss jurisdiction and multi-product privacy suite (VPN, drive, pass) matter more than German HQ
Consider: Proton Mail
Compare Bridge, ecosystem lock-in, and published cert posture side by side
When: Belgian OpenPGP-centric suite with browser crypto and classic protocols is preferred
Consider: Mailfence
Different encryption UX (PGP-oriented) versus Tuta's automatic proprietary stack

Open questions for due diligence

eclipso Mail Europe

Can non-Business tariffs obtain a signed Art. 28 DPA and full subprocessor list on request?
Is Speedloc the sole host for mailbox content (not only the marketing site), and are backup/DR locations exclusively in Germany?
Are independent penetration tests or ISO plans available under NDA for enterprise buyers?
What exact data minimisation applies to freemail advertising versus paid ad-free tiers (inbox content vs account metadata)?
How are OpenPGP private keys encrypted at rest in the account store, and is export/deletion documented for offboarding?

Tuta

Will Tutao provide a current signed AVV/DPA with a full subprocessor list (DNS, billing, support, CDN if any)?
Is there a current organizational ISO 27001 or SOC 2 report for Tutao GmbH, or only facility-level data-center certification?
What is the documented status of TutaCrypt key rotation for all legacy accounts in your tenant?
Are any US-group cloud services used for backups, DNS, or support tooling beyond payment processors named in the privacy statement?
For business rollout: migration tooling limits (EML/MBOX import on desktop) and dual-running period with legacy IMAP hosts?