Compare Swissnode and Tuta on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Google Workspace, Microsoft 365
Switzerland· Email Services
Needs review
Shortlist Swissnode for lean European cPanel domain email plus shared web or KVM VPS when Spain/EU residency is acceptable and you do not need enterprise compliance packs. Skip when you require live Swiss territorial hosting, E2EE mail, or published DPA/subprocessor inventories—consider Hostpoint, Infomaniak, or Proton Mail instead.
Germany· Email Services
Needs review
Shortlist when you need default end-to-end encrypted mail, calendar, and contacts under German law with post-quantum TutaCrypt and official multi-platform apps. Skip when teams must keep Outlook/Thunderbird via IMAP or need a full M365/Workspace suite—consider Proton Mail (Bridge) or mailbox.org instead.
Highlighted rows differ between the two products.
| Feature | Swissnode | Tuta |
|---|---|---|
| Country of origin | Switzerland | Germany |
| Category | Email Services | Email Services |
| Open source | No | Yes |
| Self-hosted | No | No |
| Headquarters | Switzerland | Germany |
| Legal entity | Swissnode (legal form/registry name not clearly published on marketing site) | Tutao GmbH (HRB 208014, Hanover) |
| Governing law | Not clearly stated on marketing pages; confirm in contract (CH contact vs ES ops) | German law / GDPR |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Low |
| Hosting / residency | Vendor states primary hosting moved to a Spain data center after Swiss DC closure; homepage cites Spanish privacy laws. Site IP geolocates to Spain (Ipcore Datacenters). Optional Cloudflare CDN on web plans (US-group). Off-site backup provider not named. No public subprocessor inventory. | Vendor states mailbox data is stored end-to-end encrypted on Tutao-operated servers in ISO 27001-certified data centers in Germany. No AWS/GCP/Azure primary hosting named on official security/privacy pages. Privacy statement discloses payment processing via PayPal (Europe) and banks for card/SEPA; no comprehensive public subprocessor list found for ops tools. |
| Summary | European cPanel email, shared web hosting, and KVM VPS under the Swissnode brand—vendor-stated Spain data center after Swiss DC closure, with optional Cloudflare CDN on web plans. | German end-to-end encrypted email, calendar, and contacts from Tutao GmbH in Hanover—with post-quantum TutaCrypt, open-source clients, and freemium personal plus business plans. |
| Tags |
| At a glance | Swissnode | Tuta |
|---|---|---|
| Contact address | Binzallee 6, 8055 Zurich, CH (public contact page) | Not listed |
| Footer / ops address | Mutilva Baja, Navarra, Spain | Not listed |
| Primary hosting (vendor) | Spain data center after Swiss DC closure | Not listed |
| Core products | Domain email, cPanel web hosting, KVM VPS | Not listed |
| Control panels | cPanel (shared); Virtualizor (VPS) | Not listed |
| Open source | No | Clients GPLv3 on GitHub; no productized self-host |
| Self-hosted product | No (provider-hosted; VPS gives root on rented VM) | Not listed |
| Commercial model | Package tiers (monthly/yearly); optional antispam add-on | Freemium personal + paid personal/business (no ads) |
| HQ | Not listed | Hanover, Germany (Tutao GmbH) |
| Product | Not listed | Encrypted email, calendar, contacts (SaaS) |
| Hosting | Not listed | Own servers in ISO 27001 data centers in Germany (vendor claim) |
| Protocols | Not listed | No IMAP/SMTP client access; official apps only |
| Crypto | Not listed | TutaCrypt hybrid (Kyber-1024 + X25519 + AES-256) for new accounts |
| Key capabilities | Swissnode | Tuta |
|---|---|---|
| cPanel domain email | Yes | Not listed |
| KVM VPS | Yes | Not listed |
| Spain data center (vendor) | Yes | Not listed |
| Optional Cloudflare CDN | Yes | Not listed |
| SMB hosting packages | Yes | Not listed |
| Default mailbox E2EE | Not listed | Yes |
| TutaCrypt post-quantum | Not listed | Yes |
| EU-operated (Germany) | Not listed | Yes |
| Open-source clients | Not listed | Yes |
| DE data centers (claimed) | Not listed | Yes |
| No IMAP (by design) | Not listed | Yes |
Domain email on cPanel (IMAP/POP/SMTP)
Business mailboxes on your domain with secure webmail, SpamAssassin-style spam control, virus filtering, DKIM, calendars/contacts, autoresponders, forwarders, filters, and mailing lists on mid-tier plans—protocol-compatible with Outlook, Apple Mail, and mobile clients.
cPanel web hosting with Softaculous and LiteSpeed PHP
Shared and reseller web plans with datacenter SSDs, free panel SSL, multi-PHP, SSH above entry tiers, and Softaculous one-click apps—aimed at brochure sites, WordPress, and small PHP apps rather than container platforms.
KVM VPS with RAID-10 enterprise SSDs
Root-level Linux VPS via KVM, enterprise SSDs, RAID-10 arrays, fixed per-VPS network allotments, and Virtualizor-style management for teams that outgrow shared hosting but still want package SKUs.
Optional Cloudflare CDN from the control panel
Web plans advertise easy Cloudflare integration to cache static assets near visitors—useful for performance, with the tradeoff that enabled CDN traffic can traverse a US-group network path.
Backup cadence for VPS (vendor-stated)
Marketing states daily on-site and weekly off-site VPS backups with rebuilds measured in minutes to an hour after failure—restore SLAs and off-site provider identity should be confirmed in the contract.
Default E2EE for mail, subjects, and attachments
Between Tuta users, messages encrypt automatically including subject lines, bodies, and attachments. External recipients can use a shared password for end-to-end threads without installing software. Contacts and calendars use the same zero-access model; only delivery metadata (addresses, timestamps) stays readable by design.
TutaCrypt post-quantum hybrid cryptography
New accounts use TutaCrypt: Kyber-1024 KEM plus X25519 ECDH with AES-256, targeting harvest-now-decrypt-later risks. Protocol details are published; existing accounts migrate as key rotation rolls out. Tuta intentionally avoids PGP so subjects and non-mail features can stay encrypted and algorithms can be upgraded in-product.
Zero-knowledge calendar with private reminders
Calendar events—including times, titles, locations, and attendees—are end-to-end encrypted. Reminders are pushed as encrypted payloads and fired locally so servers are not told when an event starts. Sharing stays encrypted; invites can go out via mail, optionally password-protected for externals.
Open-source multi-platform clients (no IMAP)
Web, Android (Play and F-Droid), iOS, Windows, macOS, and Linux clients are published under GPLv3 on GitHub. Desktop builds are signed for verification. There is no IMAP/SMTP bridge: third-party mail apps cannot connect, which preserves encryption at rest but forces a client switch for Outlook/Thunderbird holdouts.
Business domains, admin console, and whitelabel
Paid business plans add custom domains, aliases, shared mailboxes, multi-admin roles, password/2FA resets, catch-all, templates, and optional branding/login on your own site. Vendor-stated uptime SLA and a GDPR order-processing agreement support B2B procurement—confirm current plan matrix on tuta.com.
| Assurance & compliance | Swissnode | Tuta |
|---|---|---|
| Independent security / no-logs audit | Not found No public independent audit report found on swissnode.ch. | Vendor claimed Vendor states SySS GmbH penetration testing before public release; not a continuously published annual no-logs audit PDF on the marketing site. |
| ISO 27001 | Not found No ISO 27001 claim located on official product/security pages. | Partial Official pages claim data centers are ISO 27001 certified; does not clearly establish a public Tutao GmbH organizational ISO 27001 certificate. |
| SOC 2 / SOC 3 | Not found No SOC 2/3 claim found. | Not found No SOC 2/3 report located on security, business, or privacy pages. |
| GDPR / EU data protection | Partial Spain/EU hosting supports EU data-protection analysis, and homepage references Spanish privacy laws; usable privacy policy/DPA text not published on site. Customer remains controller for lawful basis. | Vendor claimed German controller Tutao GmbH; privacy statement cites GDPR; DPO published; DE storage claimed. |
| US CLOUD Act exposure (indicative) | Partial No known US parent; primary host Spain/EU. Optional Cloudflare CDN is a US-group subprocessor for web static delivery; off-site backups and other SaaS paths not published. Not a clean low-exposure bill; not legal advice. | Partial EU entity, no known US parent, primary mailbox hosting claimed as own DE servers—not AWS/GCP/Azure. Payment may use PayPal (Europe). Assessment is low exposure for content with residual billing/processor unknowns; not a vendor 'safe' claim. Not legal advice. |
| Data processing agreement (B2B) | Not found No public DPA download or B2B processing terms found; request in writing. | Vendor claimed Security/business materials state an Order Processing Agreement (Auftragsverarbeitung) is provided for GDPR; obtain signed version via sales—no public self-serve DPA URL confirmed. |
| EU AI Act | Not applicable Commodity hosting/email/VPS, not an AI product. | Not applicable Encrypted email/calendar product; vendor states it does not plan AI that processes user communications for model training. |
| Swiss territorial hosting | Partial Vendor discloses Swiss DC closed; operations from Spain DC. Contact still Zurich. Do not treat as CH-only residency. | Not listed |
| Considerations & known limitations | Swissnode | Tuta |
|---|---|---|
| Swiss brand vs Spain hosting | High Product pages state the Swiss data center closed and services run in Spain; homepage cites Spanish privacy laws. Buyers assuming Zurich colocation from the brand or older materials will mis-classify risk and contractual residency. | Not listed |
| Empty privacy pages / no public DPA or certs | High Privacy and cookie URLs do not present substantive policy text; ISO/SOC and DPA artifacts were not found. Regulated or enterprise buyers face a heavy offline diligence burden. | Not listed |
| Optional Cloudflare CDN (US-group) | Medium Web hosting markets Cloudflare integration from cPanel. Enabling CDN can place static content on a US-group network path even when origin is Spain—document this in transfer assessments. | Not listed |
| Off-site backup provider not named | Medium Daily on-site and weekly off-site backups are claimed for VPS, but the off-site location/provider is not published—ask before trusting disaster-recovery or residency narratives. | Not listed |
| Aging marketing surface | Low Public site still shows 2013–2018 copyright and sparse modern trust pages; may signal limited investment in public assurance UX even if infrastructure remains operational. | Not listed |
| No IMAP/SMTP third-party clients | Not listed | High Desktop and mobile holdouts cannot stay on Outlook/Thunderbird/Apple Mail. Plan full client migration or pick a standards-based alternative. |
| Weaker protection to non-Tuta recipients | Not listed | Medium Without a shared password, external mail is ordinary SMTP (TLS in transit). Only Tuta-to-Tuta and password-protected external threads are true E2EE. |
| Hosted service, not on-prem mail | Not listed | Medium Open-source clients help inspectability, but mailboxes still depend on Tutao's German SaaS backend, uptime, and German legal process. |
| Data-center ISO vs company ISMS | Not listed | Low ISO 27001 wording refers to data centers. Do not tick 'vendor ISO 27001 certified' on questionnaires without the actual Tutao certificate. |
| Limited public subprocessor inventory | Not listed | Medium Privacy policy covers payments (e.g. PayPal Europe) but lacks a detailed live subprocessor register. Request the DPA annex for DPIA completeness. |
| German court orders on accessible data | Not listed | Low Transparency reports show regular German requests. Stored E2EE content stays undecryptable by Tutao; real-time monitoring can expose newly arriving unencrypted SMTP mail. Align expectations with counsel. |
When: You need Swiss-resident email/office with a broader product catalog and clearer CH hosting claims
Consider: Hostpoint E-Mail & Cloud Office or Infomaniak kMail
Fuller Swiss platforms; better when territorial Switzerland is non-negotiable.
When: You need end-to-end encrypted mail and open-source clients rather than cPanel hosting
Consider: Proton Mail
Different product class: E2EE vs classic hosted IMAP.
When: You need full collaboration suites, admin compliance tooling, and ecosystem apps
Consider: Microsoft 365 or Google Workspace (US-group control planes)
Richer features; different jurisdiction/CLOUD Act profile.
When: You want a larger EU hosting group with broader cloud SKUs
Consider: IONOS or OVHcloud
Scale and catalog depth over niche Swissnode packaging.
When: Users must keep desktop IMAP clients or need Bridge-style Outlook integration
Consider: Proton Mail (Bridge on paid plans) or mailbox.org / Posteo / Soverin
Those options trade Tuta's automatic subject E2EE model for standards-based access
When: You need a broader German digital workplace (Drive, Office, video) with optional PGP
Consider: mailbox.org
Stronger suite breadth; different default encryption depth than Tuta's full zero-access mailbox
When: Swiss jurisdiction and multi-product privacy suite (VPN, drive, pass) matter more than German HQ
Consider: Proton Mail
Compare Bridge, ecosystem lock-in, and published cert posture side by side
When: Belgian OpenPGP-centric suite with browser crypto and classic protocols is preferred
Consider: Mailfence
Different encryption UX (PGP-oriented) versus Tuta's automatic proprietary stack