Compare Infomaniak kMail and Tuta on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Outlook.com
Switzerland· Email Services
Needs review
Shortlist when you need Swiss-hosted professional email with custom domains, IMAP/CalDAV, suite bundling (kSuite), and operator-owned DCs. Skip when zero-access client-side E2EE or full self-host is mandatory—consider Proton Mail (E2EE) or a self-hosted stack instead.
Germany· Email Services
Needs review
Shortlist when you need default end-to-end encrypted mail, calendar, and contacts under German law with post-quantum TutaCrypt and official multi-platform apps. Skip when teams must keep Outlook/Thunderbird via IMAP or need a full M365/Workspace suite—consider Proton Mail (Bridge) or mailbox.org instead.
Highlighted rows differ between the two products.
| Feature | Infomaniak kMail | Tuta |
|---|---|---|
| Country of origin | Switzerland | Germany |
| Category | Email Services | Email Services |
| Open source | Yes | Yes |
| Self-hosted | No | No |
| Headquarters | Switzerland | Germany |
| Legal entity | Infomaniak Network SA (Rue Eugène Marziano 25, 1227 Les Acacias, Geneva; CH-660.0.059.996-1; IDE CHE-103.167.648) | Tutao GmbH (HRB 208014, Hanover) |
| Governing law | Not listed | German law / GDPR |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Low |
| Hosting / residency | Primary mail hosting on Infomaniak-operated Swiss data centres (Geneva/Zurich region; Swiss Hosting label claimed); dual-DC backups in Switzerland. Confidentiality policy names payment partners (e.g. PayPal, Checkout) and other ancillary third parties for account/billing/measurement—not AWS/GCP/Azure as primary mail hosts in public materials. | Vendor states mailbox data is stored end-to-end encrypted on Tutao-operated servers in ISO 27001-certified data centers in Germany. No AWS/GCP/Azure primary hosting named on official security/privacy pages. Privacy statement discloses payment processing via PayPal (Europe) and banks for card/SEPA; no comprehensive public subprocessor list found for ops tools. |
| Summary | Swiss-hosted professional email, contacts and calendars from Infomaniak Network SA—custom domains, open protocols, optional encryption, part of kSuite. | German end-to-end encrypted email, calendar, and contacts from Tutao GmbH in Hanover—with post-quantum TutaCrypt, open-source clients, and freemium personal plus business plans. |
| Tags |
| At a glance | Infomaniak kMail | Tuta |
|---|---|---|
| HQ | Geneva, Switzerland (Les Acacias) | Hanover, Germany (Tutao GmbH) |
| Legal entity | Infomaniak Network SA | Not listed |
| Hosting | Own Swiss data centres; dual-site mailbox backups | Own servers in ISO 27001 data centers in Germany (vendor claim) |
| Open source | Mobile clients GPL-3.0; backend SaaS | Clients GPLv3 on GitHub; no productized self-host |
| Self-host | No (hosted only) | Not listed |
| Commercial model | Free my kSuite tier; paid kSuite / Mail Service seats | Freemium personal + paid personal/business (no ads) |
| Product | Not listed | Encrypted email, calendar, contacts (SaaS) |
| Protocols | Not listed | No IMAP/SMTP client access; official apps only |
| Crypto | Not listed | TutaCrypt hybrid (Kyber-1024 + X25519 + AES-256) for new accounts |
| Key capabilities | Infomaniak kMail | Tuta |
|---|---|---|
| Swiss-hosted mail | Yes | Not listed |
| Custom domains | Yes | Not listed |
| IMAP / CalDAV | Yes | Not listed |
| OSS mobile clients | Yes | Yes |
| ISO 27001 (claimed) | Yes | Not listed |
| Optional send encryption | Yes | Not listed |
| Default mailbox E2EE | Not listed | Yes |
| TutaCrypt post-quantum | Not listed | Yes |
| EU-operated (Germany) | Not listed | Yes |
| DE data centers (claimed) | Not listed | Yes |
| No IMAP (by design) | Not listed | Yes |
Custom-domain mail with IMAP, CalDAV and CardDAV
Host name@your-domain addresses with standard IMAP/SMTP plus CalDAV/CardDAV so Thunderbird, Apple Mail, Outlook and other clients stay usable. Paid kSuite/Mail Service tiers add multi-mailbox management, aliases/categories, signatures and team admin; free my kSuite is limited to one address without aliases.
One-click send-time encryption (OpenPGP / ECC / AES)
Optional encryption at send uses OpenPGP, ECC and AES-256-GCM; Infomaniak-to-Infomaniak is automatic after auth, while external recipients often open a password-protected secure page. Private keys stay on Infomaniak infrastructure—useful for sensitive sends, but not zero-access client-side E2EE with user-held keys.
Open-source Infomaniak Mail mobile clients
Official iOS and Android mail apps are published on GitHub under GPL-3.0 for local inspection and contribution. The hosted mail backend remains Infomaniak SaaS only—there is no supported self-hosted server stack for kMail.
Swiss dual-DC backups, SPF/DKIM/DMARC and antivirus
Mailboxes are backed up across Swiss data centres with vendor-stated restore windows around 30 days; anti-spam/antivirus plus domain authentication (SPF, DKIM, DMARC) are standard. Availability claims (e.g. high uptime for essential services) should be checked against the current SLA for your plan.
Sovereign AI assist (Euria) inside the mailbox
In-product AI can help draft, correct, translate and process mail context; Infomaniak states messages sent to its AI are processed in Switzerland and not stored for other purposes. Treat AI features as operator-side processing of content you choose to submit—not as end-to-end private AI.
Default E2EE for mail, subjects, and attachments
Between Tuta users, messages encrypt automatically including subject lines, bodies, and attachments. External recipients can use a shared password for end-to-end threads without installing software. Contacts and calendars use the same zero-access model; only delivery metadata (addresses, timestamps) stays readable by design.
TutaCrypt post-quantum hybrid cryptography
New accounts use TutaCrypt: Kyber-1024 KEM plus X25519 ECDH with AES-256, targeting harvest-now-decrypt-later risks. Protocol details are published; existing accounts migrate as key rotation rolls out. Tuta intentionally avoids PGP so subjects and non-mail features can stay encrypted and algorithms can be upgraded in-product.
Zero-knowledge calendar with private reminders
Calendar events—including times, titles, locations, and attendees—are end-to-end encrypted. Reminders are pushed as encrypted payloads and fired locally so servers are not told when an event starts. Sharing stays encrypted; invites can go out via mail, optionally password-protected for externals.
Open-source multi-platform clients (no IMAP)
Web, Android (Play and F-Droid), iOS, Windows, macOS, and Linux clients are published under GPLv3 on GitHub. Desktop builds are signed for verification. There is no IMAP/SMTP bridge: third-party mail apps cannot connect, which preserves encryption at rest but forces a client switch for Outlook/Thunderbird holdouts.
Business domains, admin console, and whitelabel
Paid business plans add custom domains, aliases, shared mailboxes, multi-admin roles, password/2FA resets, catch-all, templates, and optional branding/login on your own site. Vendor-stated uptime SLA and a GDPR order-processing agreement support B2B procurement—confirm current plan matrix on tuta.com.
| Assurance & compliance | Infomaniak kMail | Tuta |
|---|---|---|
| Independent security / no-logs audit | Not found Bug bounty and ISO ISMS claimed; no public independent no-logs audit of mailbox content found. Encryption is optional and keys remain with Infomaniak. | Vendor claimed Vendor states SySS GmbH penetration testing before public release; not a continuously published annual no-logs audit PDF on the marketing site. |
| ISO 27001 | Vendor claimed Vendor publishes ISO 27001:2022 certificate (certified since 2018 per certifications page); downloadable PDF and SoA references. | Partial Official pages claim data centers are ISO 27001 certified; does not clearly establish a public Tutao GmbH organizational ISO 27001 certificate. |
| SOC 2 / SOC 3 | Not found Not listed among published certifications (ISO 27001/9001/14001/50001, B Corp, Swiss labels). | Not found No SOC 2/3 report located on security, business, or privacy pages. |
| GDPR / EU data protection | Vendor claimed Swiss entity; GDPR and Swiss FADP commitments on legal pages; DPO listed; Swiss hosting of service data claimed. | Vendor claimed German controller Tutao GmbH; privacy statement cites GDPR; DPO published; DE storage claimed. |
| US CLOUD Act exposure (indicative) | Partial Swiss Infomaniak Network SA, no known US parent, own Swiss DCs for mail—not a claimed clean bill. Account payments via partners such as PayPal/Checkout (US-group) per confidentiality policy. Indicative only; not legal advice. | Partial EU entity, no known US parent, primary mailbox hosting claimed as own DE servers—not AWS/GCP/Azure. Payment may use PayPal (Europe). Assessment is low exposure for content with residual billing/processor unknowns; not a vendor 'safe' claim. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Downloadable DPA linked from trust centre (Data_Processing_Agreement (DPA).pdf). | Vendor claimed Security/business materials state an Order Processing Agreement (Auftragsverarbeitung) is provided for GDPR; obtain signed version via sales—no public self-serve DPA URL confirmed. |
| EU AI Act | Not applicable Euria AI assist exists inside mail; product is primarily email/hosting, not an AI-system vendor offering. | Not applicable Encrypted email/calendar product; vendor states it does not plan AI that processes user communications for model training. |
| Considerations & known limitations | Infomaniak kMail | Tuta |
|---|---|---|
| Encryption is not zero-access by default | Medium Optional send encryption keeps private keys on Infomaniak infrastructure. Operators with warrant or insider access to the platform may still access unencrypted stored mail. Practical impact: do not treat kMail as a zero-knowledge vault for all messages. | Not listed |
| SaaS-only mail backend | Low No official self-host for the mail service; exit means IMAP export/migration. OSS clients do not equal portable server stack. | Not listed |
| Free tier residency and feature caps | Low my kSuite requires OECD residency and phone verification; no aliases, limited storage, enforced free signature. Unsuitable as free global professional mail. | Not listed |
| Limited public mail-path subprocessor table | Low Hosting is own Swiss DCs per vendor docs; confidentiality policy lists payment and marketing-class third parties. Procurement should request a current subprocessor list for mailbox content paths. | Not listed |
| No HDS health-hosting cert | Medium Vendor FAQ states French HDS certification is not planned—material for French health-sector workloads. | Not listed |
| No IMAP/SMTP third-party clients | Not listed | High Desktop and mobile holdouts cannot stay on Outlook/Thunderbird/Apple Mail. Plan full client migration or pick a standards-based alternative. |
| Weaker protection to non-Tuta recipients | Not listed | Medium Without a shared password, external mail is ordinary SMTP (TLS in transit). Only Tuta-to-Tuta and password-protected external threads are true E2EE. |
| Hosted service, not on-prem mail | Not listed | Medium Open-source clients help inspectability, but mailboxes still depend on Tutao's German SaaS backend, uptime, and German legal process. |
| Data-center ISO vs company ISMS | Not listed | Low ISO 27001 wording refers to data centers. Do not tick 'vendor ISO 27001 certified' on questionnaires without the actual Tutao certificate. |
| Limited public subprocessor inventory | Not listed | Medium Privacy policy covers payments (e.g. PayPal Europe) but lacks a detailed live subprocessor register. Request the DPA annex for DPIA completeness. |
| German court orders on accessible data | Not listed | Low Transparency reports show regular German requests. Stored E2EE content stays undecryptable by Tutao; real-time monitoring can expose newly arriving unencrypted SMTP mail. Align expectations with counsel. |
When: You need zero-access end-to-end encryption as the default mail model
Consider: Proton Mail
Different trust model: client-side E2EE vs Infomaniak operator-held keys for optional encryption
When: You want European hosted mail with a different encryption or non-profit posture
Consider: Mailfence or Posteo
Compare encryption UX, storage model, and commercial terms on each vendor site
When: You need full control of the MTA and storage stack
Consider: Self-hosted mail (e.g. mailcow/Stalwart) or a host that publishes server software
Infomaniak mobile apps are OSS; the hosted service is not self-hostable
When: Users must keep desktop IMAP clients or need Bridge-style Outlook integration
Consider: Proton Mail (Bridge on paid plans) or mailbox.org / Posteo / Soverin
Those options trade Tuta's automatic subject E2EE model for standards-based access
When: You need a broader German digital workplace (Drive, Office, video) with optional PGP
Consider: mailbox.org
Stronger suite breadth; different default encryption depth than Tuta's full zero-access mailbox
When: Swiss jurisdiction and multi-product privacy suite (VPN, drive, pass) matter more than German HQ
Consider: Proton Mail
Compare Bridge, ecosystem lock-in, and published cert posture side by side
When: Belgian OpenPGP-centric suite with browser crypto and classic protocols is preferred
Consider: Mailfence
Different encryption UX (PGP-oriented) versus Tuta's automatic proprietary stack