Kolab Now vs Tuta

Compare Kolab Now and Tuta on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Gmail, Google Workspace, Microsoft 365

Kolab Now

Switzerland· Groupware

Needs review

Shortlist when you want Swiss-operated, FOSS-based classical groupware (mail, CalDAV/CardDAV, ActiveSync, files, Collabora) on operator-owned Bern infrastructure. Skip when you need default zero-access E2EE mail, public ISO/SOC evidence, or mature video — consider Proton Mail/Tuta for E2EE mail or Google Workspace/Microsoft 365 for enterprise suite depth.

Swiss-operatedFOSS Kolab stackFull groupware suiteIMAP / CalDAV / ActiveSyncHosted in Bern (claimed)Optional PGP

View listing Visit Website

Tuta

Germany· Email Services

Needs review

Shortlist when you need default end-to-end encrypted mail, calendar, and contacts under German law with post-quantum TutaCrypt and official multi-platform apps. Skip when teams must keep Outlook/Thunderbird via IMAP or need a full M365/Workspace suite—consider Proton Mail (Bridge) or mailbox.org instead.

Default mailbox E2EETutaCrypt post-quantumEU-operated (Germany)Open-source clientsDE data centers (claimed)No IMAP (by design)

View listing Visit Website

Highlighted rows differ between the two products.

Kolab Now vs Tuta: Snapshot
Feature	Kolab Now	Tuta
Country of origin	Switzerland	Germany
Category	Groupware	Email Services
Open source	Yes	Yes
Self-hosted	No	No
Headquarters	Switzerland	Germany
Legal entity	Apheleia IT AG (trade register CH-036.3.053.227-3; VAT CHE-149.254.861)	Tutao GmbH (HRB 208014, Hanover)
Governing law	Swiss law (see Terms of Service for contract details)	German law / GDPR
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Primary mailbox/groupware hosting claimed on operator-controlled infrastructure in Bern, Switzerland (IBM OpenPOWER hypervisors, hardware-encrypted IBM storage, RHEL). No AWS/GCP/Azure hosting advertised for customer mail. Billing wallet supports PayPal, credit card, and EUR bank transfer — US-linked payment processors for payment data. Full subprocessor/backup register not published on pages reviewed.	Vendor states mailbox data is stored end-to-end encrypted on Tutao-operated servers in ISO 27001-certified data centers in Germany. No AWS/GCP/Azure primary hosting named on official security/privacy pages. Privacy statement discloses payment processing via PayPal (Europe) and banks for card/SEPA; no comprehensive public subprocessor list found for ops tools.
Summary	Swiss-hosted FOSS Kolab groupware from Apheleia IT AG: email, calendars, contacts, files and optional Collabora collab on operator infrastructure in Bern.	German end-to-end encrypted email, calendar, and contacts from Tutao GmbH in Hanover—with post-quantum TutaCrypt, open-source clients, and freemium personal plus business plans.
Tags	open-source privacy groupware email switzerland caldav activesync foss	open-source privacy saas encrypted-email gdpr post-quantum freemium germany

At a glance: Kolab Now vs Tuta
At a glance	Kolab Now	Tuta
HQ / operator	Apheleia IT AG, Bern, Switzerland	Not listed
Product since	2013 (Swiss-operated hosted Kolab)	Not listed
Hosting	Operator rack in Bern; IBM OpenPOWER + encrypted storage (vendor FAQ)	Own servers in ISO 27001 data centers in Germany (vendor claim)
Stack	Kolab FOSS; RHEL; open mail/groupware protocols	Not listed
Self-host this SKU	No (managed); Kolab suite is self-hostable separately	Not listed
Commercial model	Paid modular subscriptions via prepaid wallet; trial month	Freemium personal + paid personal/business (no ads)
HQ	Not listed	Hanover, Germany (Tutao GmbH)
Product	Not listed	Encrypted email, calendar, contacts (SaaS)
Open source	Not listed	Clients GPLv3 on GitHub; no productized self-host
Protocols	Not listed	No IMAP/SMTP client access; official apps only
Crypto	Not listed	TutaCrypt hybrid (Kyber-1024 + X25519 + AES-256) for new accounts

Key capabilities: Kolab Now vs Tuta
Key capabilities	Kolab Now	Tuta
Swiss-operated	Yes	Not listed
FOSS Kolab stack	Yes	Not listed
Full groupware suite	Yes	Not listed
IMAP / CalDAV / ActiveSync	Yes	Not listed
Hosted in Bern (claimed)	Yes	Not listed
Optional PGP	Yes	Not listed
Default mailbox E2EE	Not listed	Yes
TutaCrypt post-quantum	Not listed	Yes
EU-operated (Germany)	Not listed	Yes
Open-source clients	Not listed	Yes
DE data centers (claimed)	Not listed	Yes
No IMAP (by design)	Not listed	Yes

Kolab Now

FOSS Kolab groupware with open clients
Hosted Kolab stack: IMAP/SMTP mail, CalDAV/CardDAV calendars and contacts, tasks, notes, and WebDAV files. ActiveSync is available for mobile/Outlook-style sync on full groupware subscriptions. Teams keep standard desktop and mobile clients instead of a proprietary-only app.
Private domains, multi-user cockpit, shared folders
Primary account owners verify custom domains (DNS guides in the KB), add users under one wallet, and share mail folders, calendars, notes, and files inside the domain. Fits small businesses and families that need branded addresses and shared inboxes without Google Workspace.
Swiss own-rack hosting with PFS and header hygiene
Operator FAQ places production systems in a Bern rack on IBM OpenPOWER with hardware-encrypted storage, RHEL, and segmented firewalls. TLS is described as end-to-end inside the platform with Perfect Forward Secrecy; outbound mail strips client IP and MUA identity from headers.
Sieve filters, DKIM, modular spam controls
Server-side Sieve rules (folder, redirect, vacation, discard) run in the web client. Outbound DKIM is supported with CNAME delegation for private domains. Spam tagging is available; aggressive auto-junk is deliberately left to customer Sieve policy rather than opaque provider filtering.
Collabora Online files plus optional PGP and Kolab Meet
Domain users can collaboratively edit documents/presentations via Collabora Online on shared files. Webmail can import PGP keys for optional message encryption (vendor warns keys on server are weaker than offline E2EE). Kolab Meet adds personal video rooms on groupware plans but remains public beta.
TOTP 2FA with an important client trade-off
Time-based one-time passwords (e.g. Aegis) can be required for accounts. When 2FA is enabled for a user, vendor docs state non-web clients (IMAP, POP, ActiveSync, CalDAV/CardDAV, WebDAV) are blocked — evaluate this before mandating 2FA on mobile-heavy fleets.

Tuta

Default E2EE for mail, subjects, and attachments
Between Tuta users, messages encrypt automatically including subject lines, bodies, and attachments. External recipients can use a shared password for end-to-end threads without installing software. Contacts and calendars use the same zero-access model; only delivery metadata (addresses, timestamps) stays readable by design.
TutaCrypt post-quantum hybrid cryptography
New accounts use TutaCrypt: Kyber-1024 KEM plus X25519 ECDH with AES-256, targeting harvest-now-decrypt-later risks. Protocol details are published; existing accounts migrate as key rotation rolls out. Tuta intentionally avoids PGP so subjects and non-mail features can stay encrypted and algorithms can be upgraded in-product.
Zero-knowledge calendar with private reminders
Calendar events—including times, titles, locations, and attendees—are end-to-end encrypted. Reminders are pushed as encrypted payloads and fired locally so servers are not told when an event starts. Sharing stays encrypted; invites can go out via mail, optionally password-protected for externals.
Open-source multi-platform clients (no IMAP)
Web, Android (Play and F-Droid), iOS, Windows, macOS, and Linux clients are published under GPLv3 on GitHub. Desktop builds are signed for verification. There is no IMAP/SMTP bridge: third-party mail apps cannot connect, which preserves encryption at rest but forces a client switch for Outlook/Thunderbird holdouts.
Business domains, admin console, and whitelabel
Paid business plans add custom domains, aliases, shared mailboxes, multi-admin roles, password/2FA resets, catch-all, templates, and optional branding/login on your own site. Vendor-stated uptime SLA and a GDPR order-processing agreement support B2B procurement—confirm current plan matrix on tuta.com.

Assurance & compliance: Kolab Now vs Tuta
Assurance & compliance	Kolab Now	Tuta
Independent security / no-logs audit	Not found Vendor describes no content analytics and limited operational logs (up to six months). No public third-party no-logs or security audit PDF located.	Vendor claimed Vendor states SySS GmbH penetration testing before public release; not a continuously published annual no-logs audit PDF on the marketing site.
ISO 27001	Not found No public ISO 27001 certificate found on primary site/KB materials reviewed.	Partial Official pages claim data centers are ISO 27001 certified; does not clearly establish a public Tutao GmbH organizational ISO 27001 certificate.
SOC 2 / SOC 3	Not found No public SOC 2/3 report found.	Not found No SOC 2/3 report located on security, business, or privacy pages.
GDPR / EU data protection	Vendor claimed Swiss operator; KB GDPR article asserts customer data ownership, no ad analytics, export/delete paths, and Swiss warrant process for third-party access. Confirm DPA/ToS for EU controllers.	Vendor claimed German controller Tutao GmbH; privacy statement cites GDPR; DPO published; DE storage claimed.
US CLOUD Act exposure (indicative)	Partial Swiss entity / no known US parent; mail claimed on Bern own-infra (not hyperscaler). Partial residual exposure via PayPal/card payment processors and unpublished full subprocessor list. Not legal advice.	Partial EU entity, no known US parent, primary mailbox hosting claimed as own DE servers—not AWS/GCP/Azure. Payment may use PayPal (Europe). Assessment is low exposure for content with residual billing/processor unknowns; not a vendor 'safe' claim. Not legal advice.
Data processing agreement (B2B)	Not found No public standalone DPA download located on marketing/KB pages in this pass; may exist in ToS or on request — confirm before B2B processing.	Vendor claimed Security/business materials state an Order Processing Agreement (Auftragsverarbeitung) is provided for GDPR; obtain signed version via sales—no public self-serve DPA URL confirmed.
EU AI Act	Not applicable Groupware/email product; not an AI system offering.	Not applicable Encrypted email/calendar product; vendor states it does not plan AI that processes user communications for model training.

Considerations & known limitations: Kolab Now vs Tuta
Considerations & known limitations	Kolab Now	Tuta
Mail not zero-access by default	Medium Unlike Proton/Tuta defaults, ordinary stored mail is provider-accessible for protocol delivery unless users apply PGP or another client E2EE scheme. Material for threat models that assume provider compromise or compelled access to plaintext.	Not listed
2FA blocks non-web clients	Medium Documented behaviour: enabling TOTP 2FA confines the user to the web client and blocks IMAP/ActiveSync/CalDAV and related protocols. Breaks many mobile/Outlook deployments if applied naively.	Not listed
Limited public compliance pack	Medium No public ISO/SOC certs, independent audit, or subprocessor register found. Procurement must rely on vendor FAQs, ToS, and direct questions — slower security review than certified EU SaaS peers.	Not listed
US-linked payment processors	Low Wallet top-ups via PayPal and credit cards introduce US-group payment processors for billing data even when mailboxes stay in Switzerland. Scope is payment metadata, not IMAP content, but still relevant to transfer inventories.	Not listed
Kolab Meet still beta	Low Voice/video rooms are labelled public beta; vendor notes support may be limited. Do not treat as a Zoom/Teams replacement for critical meetings.	Not listed
No IMAP/SMTP third-party clients	Not listed	High Desktop and mobile holdouts cannot stay on Outlook/Thunderbird/Apple Mail. Plan full client migration or pick a standards-based alternative.
Weaker protection to non-Tuta recipients	Not listed	Medium Without a shared password, external mail is ordinary SMTP (TLS in transit). Only Tuta-to-Tuta and password-protected external threads are true E2EE.
Hosted service, not on-prem mail	Not listed	Medium Open-source clients help inspectability, but mailboxes still depend on Tutao's German SaaS backend, uptime, and German legal process.
Data-center ISO vs company ISMS	Not listed	Low ISO 27001 wording refers to data centers. Do not tick 'vendor ISO 27001 certified' on questionnaires without the actual Tutao certificate.
Limited public subprocessor inventory	Not listed	Medium Privacy policy covers payments (e.g. PayPal Europe) but lacks a detailed live subprocessor register. Request the DPA annex for DPIA completeness.
German court orders on accessible data	Not listed	Low Transparency reports show regular German requests. Stored E2EE content stays undecryptable by Tutao; real-time monitoring can expose newly arriving unencrypted SMTP mail. Align expectations with counsel.

Fit

Kolab Now

Best fit when

Small teams and professional practices that need shared mailboxes, calendars, and private domains under Swiss jurisdiction
Buyers who prioritise open standards (IMAP, CalDAV/CardDAV, ActiveSync, WebDAV) and FOSS components over proprietary lock-in
Organisations that will accept provider-accessible mail at rest and apply PGP/S/MIME themselves for sensitive threads
Users leaving Google Workspace who want groupware depth without US Big Tech mail custody
Account owners comfortable with prepaid wallet billing and modular per-user subscriptions

Poor fit when

Requirements for default end-to-end encrypted mail with zero provider access (prefer Proton Mail or Tuta)
Enterprises that need public ISO 27001/SOC 2 packs, signed DPAs, and a published subprocessor list on day one
Fleets that must combine TOTP 2FA with IMAP/ActiveSync clients on the same user (documented mutual exclusion)
Orgs treating video conferencing as a core, production-grade service (Kolab Meet is still beta)
Buyers seeking a permanent free tier or consumer-grade onboarding polish comparable to Gmail

Consider instead when

When: You need default zero-access / E2EE email more than ActiveSync groupware
Consider: Proton Mail or Tuta
Stronger default cryptography story; thinner classical groupware/ActiveSync depth than Kolab Now.
When: You want privacy-focused German email without full suite complexity
Consider: Posteo
Leaner privacy mail; not a Collabora + shared-domain groupware suite.
When: You need Google/Microsoft-class admin scale, apps marketplace, and compliance certifications
Consider: Google Workspace or Microsoft 365
Far larger ecosystems; US-centric custody and CLOUD Act profile differ sharply.
When: You want full self-host control of the same FOSS stack
Consider: Self-hosted Kolab (kolab.org) or Nextcloud plus a mail stack
More operational burden; Apheleia also sells Kolab professional services.

Tuta

Best fit when

Teams that will standardize on Tuta's official web/mobile/desktop clients for default zero-access email
Orgs prioritizing subject-line encryption, encrypted calendar, and post-quantum hybrid crypto under German jurisdiction
SMEs needing custom domains, aliases, shared mailboxes, and multi-admin controls without running their own mail servers
Journalists, NGOs, and privacy-led departments that value F-Droid builds, no Google Push dependency, and ad-free operation
Buyers who want open-source client auditability plus a freemium path for personal trial before business seats

Poor fit when

Hard requirement for IMAP/SMTP in Outlook, Thunderbird, Apple Mail, or third-party automation
On-prem / customer-operated mail server mandates (no productized self-host for the backend)
Workflows that depend on first-class PGP or S/MIME interoperability with external partners
Primary need is full Google Workspace or Microsoft 365 collaboration (Drive, Meet, deep Outlook) rather than encrypted mail first

Consider instead when

When: Users must keep desktop IMAP clients or need Bridge-style Outlook integration
Consider: Proton Mail (Bridge on paid plans) or mailbox.org / Posteo / Soverin
Those options trade Tuta's automatic subject E2EE model for standards-based access
When: You need a broader German digital workplace (Drive, Office, video) with optional PGP
Consider: mailbox.org
Stronger suite breadth; different default encryption depth than Tuta's full zero-access mailbox
When: Swiss jurisdiction and multi-product privacy suite (VPN, drive, pass) matter more than German HQ
Consider: Proton Mail
Compare Bridge, ecosystem lock-in, and published cert posture side by side
When: Belgian OpenPGP-centric suite with browser crypto and classic protocols is preferred
Consider: Mailfence
Different encryption UX (PGP-oriented) versus Tuta's automatic proprietary stack

Open questions for due diligence

Kolab Now

Will Apheleia sign a GDPR Art. 28 DPA and provide a current subprocessor list (including backups, monitoring, and payment processors) under NDA if needed?
What is the current imprint address and governing ToS URL for contract annexes (product footer vs apheleia-it.ch addresses differ)?
Is there any ISO 27001, SOC 2, or independent penetration-test summary available to customers on request?
How are backups and disaster recovery stored (same Bern facility only, or additional sites/providers)?
For regulated workloads: what is the practical process and historical volume of Swiss lawful-access requests affecting customer content?

Tuta

Will Tutao provide a current signed AVV/DPA with a full subprocessor list (DNS, billing, support, CDN if any)?
Is there a current organizational ISO 27001 or SOC 2 report for Tutao GmbH, or only facility-level data-center certification?
What is the documented status of TutaCrypt key rotation for all legacy accounts in your tenant?
Are any US-group cloud services used for backups, DNS, or support tooling beyond payment processors named in the privacy statement?
For business rollout: migration tooling limits (EML/MBOX import on desktop) and dual-running period with legacy IMAP hosts?