Compare Soverin and Tuta on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Microsoft 365, Outlook.com
Netherlands· Email Services
Needs review
Shortlist Soverin when you want Dutch-operated, paid IMAP email with custom domains, unlimited aliases, and strong mail-auth standards without Google/Microsoft ads. Skip when you need zero-knowledge E2EE—consider Proton Mail or Tuta instead—or a full productivity suite (mailbox.org / Microsoft 365).
Germany· Email Services
Needs review
Shortlist when you need default end-to-end encrypted mail, calendar, and contacts under German law with post-quantum TutaCrypt and official multi-platform apps. Skip when teams must keep Outlook/Thunderbird via IMAP or need a full M365/Workspace suite—consider Proton Mail (Bridge) or mailbox.org instead.
Highlighted rows differ between the two products.
| Feature | Soverin | Tuta |
|---|---|---|
| Country of origin | Netherlands | Germany |
| Category | Email Services | Email Services |
| Open source | No | Yes |
| Self-hosted | No | No |
| Headquarters | Netherlands | Germany |
| Legal entity | Soverin B.V. (Amsterdam); owned by The Sharing Group / TSG Online (Dutch) as of September 2025 acquisition announcement | Tutao GmbH (HRB 208014, Hanover) |
| Governing law | Not listed | German law / GDPR |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Low |
| Hosting / residency | Vendor: EU-only processing; data in NL; self-operated Dutch DCs, no hyperscaler. TechRadar: 3 NL DCs. Core mail hosts on Soverin B.V. AS211993. External first-line support partner under DPA/NDA (country unpublished). HIBP k-anon password checks; Let’s Encrypt; domain DNSSEC partner. No AWS/GCP/Azure as primary mailbox hosts in public materials. | Vendor states mailbox data is stored end-to-end encrypted on Tutao-operated servers in ISO 27001-certified data centers in Germany. No AWS/GCP/Azure primary hosting named on official security/privacy pages. Privacy statement discloses payment processing via PayPal (Europe) and banks for card/SEPA; no comprehensive public subprocessor list found for ops tools. |
| Summary | Dutch privacy-first email hosting: custom domains, open IMAP/SMTP/CalDAV, 25 GB mailboxes, no ads or content scanning, servers operated in the Netherlands. | German end-to-end encrypted email, calendar, and contacts from Tutao GmbH in Hanover—with post-quantum TutaCrypt, open-source clients, and freemium personal plus business plans. |
| Tags |
| At a glance | Soverin | Tuta |
|---|---|---|
| HQ | Amsterdam, Netherlands (Soverin B.V.) | Hanover, Germany (Tutao GmbH) |
| Group | The Sharing Group / TSG Online (acq. Sep 2025) | Not listed |
| Hosting | Dutch data centres; vendor claims self-operated, no hyperscaler | Own servers in ISO 27001 data centers in Germany (vendor claim) |
| Protocols | IMAP, SMTP, CalDAV, CardDAV | No IMAP/SMTP client access; official apps only |
| Storage | 25 GB per mailbox (vendor-stated) | Not listed |
| Self-host / OSS | No / No | Not listed |
| Commercial model | Annual prepaid; 30-day mailbox money-back; no free tier | Freemium personal + paid personal/business (no ads) |
| Product | Not listed | Encrypted email, calendar, contacts (SaaS) |
| Open source | Not listed | Clients GPLv3 on GitHub; no productized self-host |
| Crypto | Not listed | TutaCrypt hybrid (Kyber-1024 + X25519 + AES-256) for new accounts |
| Key capabilities | Soverin | Tuta |
|---|---|---|
| NL / EU operated | Yes | Yes |
| Custom domains | Yes | Not listed |
| IMAP / CalDAV | Yes | Not listed |
| No ads / no tracking | Yes | Not listed |
| ISO 27001 (claimed) | Yes | Not listed |
| DANE / DNSSEC | Yes | Not listed |
| Default mailbox E2EE | Not listed | Yes |
| TutaCrypt post-quantum | Not listed | Yes |
| Open-source clients | Not listed | Yes |
| DE data centers (claimed) | Not listed | Yes |
| No IMAP (by design) | Not listed | Yes |
Custom domains with unlimited aliases
Host mail on your own domain (bring existing or register through Soverin). Unlimited aliases—plus-addressing or domain names—deliver into one mailbox, plus optional random @sinenomine.email private aliases that hide the real address. Suits freelancers and SMEs who need brandable addresses without per-alias fees.
Open IMAP/SMTP plus CalDAV/CardDAV
Use any standards-based client or device for mail, calendar, and contacts—no proprietary app required. Dashboard import helps migrate from other providers. Ideal when IT wants Thunderbird, Apple Mail, or Outlook without locking into a closed webmail ecosystem; not a zero-knowledge E2EE product by default.
Mail-path security: DANE, DKIM, DMARC, IP stripping
Outbound and inbound paths use TLS; Soverin publishes and honours DANE/TLSA, signs with DKIM, publishes SPF/DMARC, enables DNSSEC on managed domains, and strips personal IP addresses from outbound headers. 2FA is available and can be admin-mandated. Buyers still need their own OpenPGP setup for end-to-end content secrecy with external parties.
25 GB mailboxes with per-user encrypted backups
Each mailbox includes a stated 25 GB quota covering mail, calendar, and contacts. Nightly backups use individually generated keys; Soverin states that emptying trash permanently deletes data and that leaving the service removes backups when the key is destroyed. Extra mailboxes can share storage for small teams.
Multi-mailbox and channel-friendly business use
Purchase and assign additional mailboxes on a domain, with admin tooling for teams. Soverin markets to hosters, ISPs, MSPs, and independent professionals for multi-mailbox and white-label scenarios—useful when you want Dutch-operated email without building your own mail stack.
Default E2EE for mail, subjects, and attachments
Between Tuta users, messages encrypt automatically including subject lines, bodies, and attachments. External recipients can use a shared password for end-to-end threads without installing software. Contacts and calendars use the same zero-access model; only delivery metadata (addresses, timestamps) stays readable by design.
TutaCrypt post-quantum hybrid cryptography
New accounts use TutaCrypt: Kyber-1024 KEM plus X25519 ECDH with AES-256, targeting harvest-now-decrypt-later risks. Protocol details are published; existing accounts migrate as key rotation rolls out. Tuta intentionally avoids PGP so subjects and non-mail features can stay encrypted and algorithms can be upgraded in-product.
Zero-knowledge calendar with private reminders
Calendar events—including times, titles, locations, and attendees—are end-to-end encrypted. Reminders are pushed as encrypted payloads and fired locally so servers are not told when an event starts. Sharing stays encrypted; invites can go out via mail, optionally password-protected for externals.
Open-source multi-platform clients (no IMAP)
Web, Android (Play and F-Droid), iOS, Windows, macOS, and Linux clients are published under GPLv3 on GitHub. Desktop builds are signed for verification. There is no IMAP/SMTP bridge: third-party mail apps cannot connect, which preserves encryption at rest but forces a client switch for Outlook/Thunderbird holdouts.
Business domains, admin console, and whitelabel
Paid business plans add custom domains, aliases, shared mailboxes, multi-admin roles, password/2FA resets, catch-all, templates, and optional branding/login on your own site. Vendor-stated uptime SLA and a GDPR order-processing agreement support B2B procurement—confirm current plan matrix on tuta.com.
| Assurance & compliance | Soverin | Tuta |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party no-logs or full security audit PDF located; privacy claims are first-party. | Vendor claimed Vendor states SySS GmbH penetration testing before public release; not a continuously published annual no-logs audit PDF on the marketing site. |
| ISO 27001 | Vendor claimed Vendor states independently audited ISO 27001; certificates available on request via support@soverin.net. Not re-verified against a public registry entry in this pass. | Partial Official pages claim data centers are ISO 27001 certified; does not clearly establish a public Tutao GmbH organizational ISO 27001 certificate. |
| SOC 2 / SOC 3 | Not found No SOC 2/3 claim found on primary pages reviewed. | Not found No SOC 2/3 report located on security, business, or privacy pages. |
| GDPR / EU data protection | Vendor claimed NL entity; AVG-framed privacy statement; EU-only processing claimed; GDPR Proof messaging on recognitions page. | Vendor claimed German controller Tutao GmbH; privacy statement cites GDPR; DPO published; DE storage claimed. |
| US CLOUD Act exposure (indicative) | Partial EuropeanStack assessment: low exposure path—Dutch Soverin B.V., Dutch The Sharing Group owner, claimed self-operated NL hosting without public AWS/GCP/Azure mailbox hosts. Partial because residual subprocessors (support partner jurisdiction, domain partners, HIBP hash checks) need buyer confirmation. Not legal advice. | Partial EU entity, no known US parent, primary mailbox hosting claimed as own DE servers—not AWS/GCP/Azure. Payment may use PayPal (Europe). Assessment is low exposure for content with residual billing/processor unknowns; not a vendor 'safe' claim. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Privacy statement states it qualifies as an Article 28 AVG processing agreement; other DPAs expressly rejected. Confirm signed annex for enterprise use. | Vendor claimed Security/business materials state an Order Processing Agreement (Auftragsverarbeitung) is provided for GDPR; obtain signed version via sales—no public self-serve DPA URL confirmed. |
| EU AI Act | Not applicable Email hosting product; vendor emphasises no AI scanning/mining of mailbox content for ads. | Not applicable Encrypted email/calendar product; vendor states it does not plan AI that processes user communications for model training. |
| ISO 9001 / ISO 14001 | Vendor claimed Vendor-claimed quality and environmental certifications; certificates on request. | Not listed |
| NIS2 readiness | Vendor claimed Vendor markets NIS2 Ready; buyer press also asserts NIS2 compliance—confirm evidence package. | Not listed |
| NEN 7510 (healthcare NL) | Partial Vendor states NEN 7510 certification is in progress, not completed. | Not listed |
| Considerations & known limitations | Soverin | Tuta |
|---|---|---|
| Not zero-knowledge E2EE by default | Medium Unlike Proton/Tuta, Soverin is a classic IMAP host. Provider infrastructure can process content for delivery and spam filtering. Practical impact: unsuitable as a drop-in for policies that require provider-blind encryption without extra client crypto. | Not listed |
| Unnamed external support partner | Medium Privacy statement discloses a first-line support partner with limited account data under DPA/NDA, but does not publish the partner name or country. Practical impact: add an open diligence item for any regulated workload. | Not listed |
| ISO certificates not self-serve public | Low ISO 27001/9001/14001 are claimed with certificates via support rather than a public PDF registry link found in research. Practical impact: procurement should request current attestations before treating certs as verified. | Not listed |
| 2025 group acquisition | Low The Sharing Group acquisition may change subprocessors, tooling, or brand packaging over time even if continuity is promised. Practical impact: re-check DPA and hosting annex annually. | Not listed |
| Email-centric support | Low Public materials emphasise human Dutch-team email support; TechRadar notes no live chat or phone. Practical impact: large orgs needing 24/7 phone SLAs may find coverage thin. | Not listed |
| No IMAP/SMTP third-party clients | Not listed | High Desktop and mobile holdouts cannot stay on Outlook/Thunderbird/Apple Mail. Plan full client migration or pick a standards-based alternative. |
| Weaker protection to non-Tuta recipients | Not listed | Medium Without a shared password, external mail is ordinary SMTP (TLS in transit). Only Tuta-to-Tuta and password-protected external threads are true E2EE. |
| Hosted service, not on-prem mail | Not listed | Medium Open-source clients help inspectability, but mailboxes still depend on Tutao's German SaaS backend, uptime, and German legal process. |
| Data-center ISO vs company ISMS | Not listed | Low ISO 27001 wording refers to data centers. Do not tick 'vendor ISO 27001 certified' on questionnaires without the actual Tutao certificate. |
| Limited public subprocessor inventory | Not listed | Medium Privacy policy covers payments (e.g. PayPal Europe) but lacks a detailed live subprocessor register. Request the DPA annex for DPIA completeness. |
| German court orders on accessible data | Not listed | Low Transparency reports show regular German requests. Stored E2EE content stays undecryptable by Tutao; real-time monitoring can expose newly arriving unencrypted SMTP mail. Align expectations with counsel. |
When: You need zero-knowledge E2EE and a privacy-first mobile/web ecosystem
Consider: Proton Mail or Tuta
Trade open IMAP convenience for stronger default content secrecy vs the provider.
When: You want German-hosted paid mail with broader office-style add-ons
Consider: mailbox.org or Posteo
Compare storage, admin features, and payment anonymity (Posteo) against Soverin’s domain/alias model.
When: You need Google- or Microsoft-class collaboration and global free consumer mail
Consider: Gmail or Microsoft 365 / Outlook.com
Different risk and advertising model; not EU-sovereignty substitutes.
When: Users must keep desktop IMAP clients or need Bridge-style Outlook integration
Consider: Proton Mail (Bridge on paid plans) or mailbox.org / Posteo / Soverin
Those options trade Tuta's automatic subject E2EE model for standards-based access
When: You need a broader German digital workplace (Drive, Office, video) with optional PGP
Consider: mailbox.org
Stronger suite breadth; different default encryption depth than Tuta's full zero-access mailbox
When: Swiss jurisdiction and multi-product privacy suite (VPN, drive, pass) matter more than German HQ
Consider: Proton Mail
Compare Bridge, ecosystem lock-in, and published cert posture side by side
When: Belgian OpenPGP-centric suite with browser crypto and classic protocols is preferred
Consider: Mailfence
Different encryption UX (PGP-oriented) versus Tuta's automatic proprietary stack