GMX Mail vs Tuta

Compare GMX Mail and Tuta on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Outlook.com

GMX Mail

Germany· Email Services

Needs review

Shortlist GMX Mail for consumer or light-professional freemail when you want a German United Internet operator, claimed German mailbox data centers, large free storage, and standard IMAP/POP—with optional OpenPGP. Skip when you need zero-access encryption by default, enterprise DPA/audit packs, or an ad-free architecture as the baseline; consider Proton Mail instead.

German operatorMailbox in DE (claimed)IMAP / POP3 / SMTPOptional OpenPGPFree ad-supportedSaaS only

View listing Visit Website

Tuta

Germany· Email Services

Needs review

Shortlist when you need default end-to-end encrypted mail, calendar, and contacts under German law with post-quantum TutaCrypt and official multi-platform apps. Skip when teams must keep Outlook/Thunderbird via IMAP or need a full M365/Workspace suite—consider Proton Mail (Bridge) or mailbox.org instead.

Default mailbox E2EETutaCrypt post-quantumEU-operated (Germany)Open-source clientsDE data centers (claimed)No IMAP (by design)

View listing Visit Website

Highlighted rows differ between the two products.

GMX Mail vs Tuta: Snapshot
Feature	GMX Mail	Tuta
Country of origin	Germany	Germany
Category	Email Services	Email Services
Open source	No	Yes
Self-hosted	No	No
Headquarters	Germany	Germany
Legal entity	1&1 Mail & Media GmbH (Zweigniederlassung Karlsruhe; Hauptsitz Montabaur)	Tutao GmbH (HRB 208014, Hanover)
Governing law	German law (international T&Cs); GDPR applies as EU controller	German law / GDPR
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Vendor privacy (EN): FreeMail emails, address book, and calendar processed in secure data centers in Germany. Product security pages: European data centers for stored mail. Group United Internet AG (DE). Named non-mail paths: Google Analytics/GTM on portal; Google/Yahoo search partnership; international ad partners under consent; DE privacy allows third-country transfers with Chapter V safeguards when used. No public exhaustive mail-infra subprocessor list found.	Vendor states mailbox data is stored end-to-end encrypted on Tutao-operated servers in ISO 27001-certified data centers in Germany. No AWS/GCP/Azure primary hosting named on official security/privacy pages. Privacy statement discloses payment processing via PayPal (Europe) and banks for card/SEPA; no comprehensive public subprocessor list found for ops tools.
Summary	German FreeMail from 1&1 Mail & Media GmbH (United Internet): large free storage, IMAP/POP/SMTP, optional OpenPGP and 2FA, ad-supported consumer webmail.	German end-to-end encrypted email, calendar, and contacts from Tutao GmbH in Hanover—with post-quantum TutaCrypt, open-source clients, and freemium personal plus business plans.
Tags	germany freemail webmail imap openpgp united-internet ad-supported consumer	germany open-source privacy saas encrypted-email gdpr post-quantum freemium

At a glance: GMX Mail vs Tuta
At a glance	GMX Mail	Tuta
HQ / entity	1&1 Mail & Media GmbH, Montabaur (DE)	Not listed
Parent group	United Internet AG (DE)	Not listed
Product type	Consumer FreeMail + optional paid tiers	Not listed
Hosting (claimed)	Mailbox/calendar data in German data centers	Not listed
Protocols	Webmail; POP3/IMAP/SMTP (opt-in)	No IMAP/SMTP client access; official apps only
Open source	No	Clients GPLv3 on GitHub; no productized self-host
Self-hosted	No	Not listed
HQ	Not listed	Hanover, Germany (Tutao GmbH)
Product	Not listed	Encrypted email, calendar, contacts (SaaS)
Hosting	Not listed	Own servers in ISO 27001 data centers in Germany (vendor claim)
Crypto	Not listed	TutaCrypt hybrid (Kyber-1024 + X25519 + AES-256) for new accounts
Commercial model	Not listed	Freemium personal + paid personal/business (no ads)

Key capabilities: GMX Mail vs Tuta
Key capabilities	GMX Mail	Tuta
German operator	Yes	Not listed
Mailbox in DE (claimed)	Yes	Not listed
IMAP / POP3 / SMTP	Yes	Not listed
Optional OpenPGP	Yes	Not listed
Free ad-supported	Yes	Not listed
SaaS only	Yes	Not listed
Default mailbox E2EE	Not listed	Yes
TutaCrypt post-quantum	Not listed	Yes
EU-operated (Germany)	Not listed	Yes
Open-source clients	Not listed	Yes
DE data centers (claimed)	Not listed	Yes
No IMAP (by design)	Not listed	Yes

GMX Mail

Large free mailbox storage with open protocols
gmx.com free accounts advertise up to 65 GB email storage and 50 MB attachments. POP3, IMAP, and SMTP are supported after you enable them in settings (TLS 1.2+; imap.gmx.com / mail.gmx.com). Suits users who want client choice (Thunderbird, Outlook, mobile) without Google or Microsoft as the mailbox host.
Optional OpenPGP end-to-end encryption (Mailvelope)
GMX offers free OpenPGP messaging via the Mailvelope browser extension: key generation, local key storage, key directory, and mobile recovery. Encryption is opt-in per message after setup—not whole-mailbox zero-access by default. Best for occasional sensitive threads when both parties can use OpenPGP.
Aliases, Mail Collector, and multi-account inbox
Create up to 10 alias addresses (including other GMX domains) managed in one inbox, and pull up to 10 external accounts via Mail Collector. Useful for freelancers and project mail without juggling multiple passwords or providers day-to-day.
Spam filtering, antivirus, and optional TOTP 2FA
Free accounts include automated spam filtering (user blacklist and optional improved detection) and antivirus scanning of mail and cloud files. Optional two-factor authentication uses an authenticator app (TOTP); third-party clients use app-specific passwords when 2FA is on.
Bundled Cloud, calendar, contacts, and Online Office
Accounts include contacts, calendar/organizer, about 2 GB GMX Cloud with share links, and Online Office for common document formats—enough for light personal productivity without a separate suite subscription.

Tuta

Default E2EE for mail, subjects, and attachments
Between Tuta users, messages encrypt automatically including subject lines, bodies, and attachments. External recipients can use a shared password for end-to-end threads without installing software. Contacts and calendars use the same zero-access model; only delivery metadata (addresses, timestamps) stays readable by design.
TutaCrypt post-quantum hybrid cryptography
New accounts use TutaCrypt: Kyber-1024 KEM plus X25519 ECDH with AES-256, targeting harvest-now-decrypt-later risks. Protocol details are published; existing accounts migrate as key rotation rolls out. Tuta intentionally avoids PGP so subjects and non-mail features can stay encrypted and algorithms can be upgraded in-product.
Zero-knowledge calendar with private reminders
Calendar events—including times, titles, locations, and attendees—are end-to-end encrypted. Reminders are pushed as encrypted payloads and fired locally so servers are not told when an event starts. Sharing stays encrypted; invites can go out via mail, optionally password-protected for externals.
Open-source multi-platform clients (no IMAP)
Web, Android (Play and F-Droid), iOS, Windows, macOS, and Linux clients are published under GPLv3 on GitHub. Desktop builds are signed for verification. There is no IMAP/SMTP bridge: third-party mail apps cannot connect, which preserves encryption at rest but forces a client switch for Outlook/Thunderbird holdouts.
Business domains, admin console, and whitelabel
Paid business plans add custom domains, aliases, shared mailboxes, multi-admin roles, password/2FA resets, catch-all, templates, and optional branding/login on your own site. Vendor-stated uptime SLA and a GDPR order-processing agreement support B2B procurement—confirm current plan matrix on tuta.com.

Assurance & compliance: GMX Mail vs Tuta
Assurance & compliance	GMX Mail	Tuta
Independent security / no-logs audit	Not found OpenPGP/Mailvelope path described as externally reviewed; no public independent no-logs audit for FreeMail mailbox access found on product pages.	Vendor claimed Vendor states SySS GmbH penetration testing before public release; not a continuously published annual no-logs audit PDF on the marketing site.
ISO 27001	Not found No GMX FreeMail-branded ISO 27001 certificate located on security/privacy pages in this research pass (group companies may hold certs under other brands).	Partial Official pages claim data centers are ISO 27001 certified; does not clearly establish a public Tutao GmbH organizational ISO 27001 certificate.
SOC 2 / SOC 3	Not found No SOC 2/3 report found on GMX public security pages.	Not found No SOC 2/3 report located on security, business, or privacy pages.
GDPR / EU data protection	Vendor claimed EU/German controller; public privacy notices under GDPR; DPO published; supervisory authorities named (BfDI / LfDI RLP).	Vendor claimed German controller Tutao GmbH; privacy statement cites GDPR; DPO published; DE storage claimed.
US CLOUD Act exposure (indicative)	Partial German entity and parent (United Internet AG); mailbox data claimed in German DCs. Partial/medium because portal analytics include Google LLC tools, freemail ads involve international partners, and no full public mail-infra subprocessor list. Not legal advice.	Partial EU entity, no known US parent, primary mailbox hosting claimed as own DE servers—not AWS/GCP/Azure. Payment may use PayPal (Europe). Assessment is low exposure for content with residual billing/processor unknowns; not a vendor 'safe' claim. Not legal advice.
Data processing agreement (B2B)	Not found Product is primarily consumer FreeMail under GTCs/privacy policy; no public self-serve B2B DPA flow found for FreeMail shortlisting.	Vendor claimed Security/business materials state an Order Processing Agreement (Auftragsverarbeitung) is provided for GDPR; obtain signed version via sales—no public self-serve DPA URL confirmed.
EU AI Act	Not applicable Not an AI-centric product; optional assistive features may appear in product privacy text but FreeMail is not marketed as an AI system.	Not applicable Encrypted email/calendar product; vendor states it does not plan AI that processes user communications for model training.

Considerations & known limitations: GMX Mail vs Tuta
Considerations & known limitations	GMX Mail	Tuta
Advertising-funded free tier	Medium FreeMail depends on ads and (with consent) interest-based targeting and partner sharing. Privacy posture differs from paid privacy mail. Practical impact: expect consent UX, ad surfaces, and partner lists—not a zero-ads default.	Not listed
E2E encryption is optional, not default	Medium Without OpenPGP setup, mailbox content is accessible to the provider like conventional hosted mail. Practical impact: do not treat GMX FreeMail as zero-access encryption architecture.	Not listed
Incomplete public infrastructure subprocessors	Medium Residency for mail is claimed (Germany/EU), but there is no enterprise-style published subprocessor inventory for core mail infrastructure. Portal paths name Google Analytics and global ad partners. Practical impact: extra questionnaire work for high-assurance buyers.	Not listed
Inactivity and freemail operational policies	Low Terms/privacy allow deletion of free mailbox content after prolonged inactivity (about 180 days without login on FreeMail privacy text). Practical impact: inactive project addresses can disappear if not maintained.	Not listed
No public ISO/SOC package for FreeMail	Low Security pages emphasize product features (spam, AV, 2FA, PGP) rather than downloadable ISO/SOC evidence for FreeMail. Practical impact: may fail enterprise vendor security questionnaires without further vendor dialogue.	Not listed
No IMAP/SMTP third-party clients	Not listed	High Desktop and mobile holdouts cannot stay on Outlook/Thunderbird/Apple Mail. Plan full client migration or pick a standards-based alternative.
Weaker protection to non-Tuta recipients	Not listed	Medium Without a shared password, external mail is ordinary SMTP (TLS in transit). Only Tuta-to-Tuta and password-protected external threads are true E2EE.
Hosted service, not on-prem mail	Not listed	Medium Open-source clients help inspectability, but mailboxes still depend on Tutao's German SaaS backend, uptime, and German legal process.
Data-center ISO vs company ISMS	Not listed	Low ISO 27001 wording refers to data centers. Do not tick 'vendor ISO 27001 certified' on questionnaires without the actual Tutao certificate.
Limited public subprocessor inventory	Not listed	Medium Privacy policy covers payments (e.g. PayPal Europe) but lacks a detailed live subprocessor register. Request the DPA annex for DPIA completeness.
German court orders on accessible data	Not listed	Low Transparency reports show regular German requests. Stored E2EE content stays undecryptable by Tutao; real-time monitoring can expose newly arriving unencrypted SMTP mail. Align expectations with counsel.

Fit

GMX Mail

Best fit when

Individuals and freelancers who want a European freemail address with large free storage and IMAP client freedom
Users consolidating multiple addresses via aliases (up to 10) and Mail Collector
Buyers who prefer a German legal controller (1&1 Mail & Media GmbH / United Internet) over US Big Tech freemail
Teams that only need optional OpenPGP for specific sensitive threads, not zero-access by default
Users already familiar with GMX/WEB.DE in German-speaking markets who need international domains (e.g. gmx.com)

Poor fit when

Organizations that require default end-to-end / zero-access encryption for all mail
Procurement that needs a published independent security audit pack, ISO/SOC evidence, and a B2B DPA as standard shortlist inputs
Teams that cannot accept advertising-funded freemail economics or interest-based ad consent UX
Custom-domain corporate mail and admin controls at Microsoft 365 / Google Workspace depth
Self-hosted or open-source mail stack requirements

Consider instead when

When: You need zero-access encryption by default and a privacy-first paid model without ad-funded freemail as the core product
Consider: Proton Mail
Proton is the stronger shortlist peer in this catalog for E2E-first evaluation.
When: You need Google Workspace-class collaboration and are willing to accept US Big Tech jurisdiction
Consider: Gmail / Google Workspace
Richer suite integration; different sovereignty and ad/ecosystem tradeoffs.
When: You need Microsoft ecosystem mail, calendar, and compliance tooling
Consider: Outlook.com / Microsoft 365
Strong enterprise admin story; US parent and CLOUD Act path differ from GMX.

Tuta

Best fit when

Teams that will standardize on Tuta's official web/mobile/desktop clients for default zero-access email
Orgs prioritizing subject-line encryption, encrypted calendar, and post-quantum hybrid crypto under German jurisdiction
SMEs needing custom domains, aliases, shared mailboxes, and multi-admin controls without running their own mail servers
Journalists, NGOs, and privacy-led departments that value F-Droid builds, no Google Push dependency, and ad-free operation
Buyers who want open-source client auditability plus a freemium path for personal trial before business seats

Poor fit when

Hard requirement for IMAP/SMTP in Outlook, Thunderbird, Apple Mail, or third-party automation
On-prem / customer-operated mail server mandates (no productized self-host for the backend)
Workflows that depend on first-class PGP or S/MIME interoperability with external partners
Primary need is full Google Workspace or Microsoft 365 collaboration (Drive, Meet, deep Outlook) rather than encrypted mail first

Consider instead when

When: Users must keep desktop IMAP clients or need Bridge-style Outlook integration
Consider: Proton Mail (Bridge on paid plans) or mailbox.org / Posteo / Soverin
Those options trade Tuta's automatic subject E2EE model for standards-based access
When: You need a broader German digital workplace (Drive, Office, video) with optional PGP
Consider: mailbox.org
Stronger suite breadth; different default encryption depth than Tuta's full zero-access mailbox
When: Swiss jurisdiction and multi-product privacy suite (VPN, drive, pass) matter more than German HQ
Consider: Proton Mail
Compare Bridge, ecosystem lock-in, and published cert posture side by side
When: Belgian OpenPGP-centric suite with browser crypto and classic protocols is preferred
Consider: Mailfence
Different encryption UX (PGP-oriented) versus Tuta's automatic proprietary stack

Open questions for due diligence

GMX Mail

Will 1&1 Mail & Media sign a B2B DPA and publish a current mail-infrastructure subprocessor list for our use case?
Are FreeMail mailbox systems solely on United Internet / 1&1 operated German DCs, or are any US-group cloud providers used for primary storage, backup, or DR?
What independent audits or certifications (if any) cover the FreeMail platform beyond the Mailvelope/OpenPGP path?
For paid/premium mailboxes: which advertising and tracking paths remain, and what contractual residency language is available?

Tuta

Will Tutao provide a current signed AVV/DPA with a full subprocessor list (DNS, billing, support, CDN if any)?
Is there a current organizational ISO 27001 or SOC 2 report for Tutao GmbH, or only facility-level data-center certification?
What is the documented status of TutaCrypt key rotation for all legacy accounts in your tenant?
Are any US-group cloud services used for backups, DNS, or support tooling beyond payment processors named in the privacy statement?
For business rollout: migration tooling limits (EML/MBOX import on desktop) and dual-running period with legacy IMAP hosts?