Compare Tuta and web.de on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Gmail, Outlook.com
Germany· Email Services
Needs review
Shortlist when you need default end-to-end encrypted mail, calendar, and contacts under German law with post-quantum TutaCrypt and official multi-platform apps. Skip when teams must keep Outlook/Thunderbird via IMAP or need a full M365/Workspace suite—consider Proton Mail (Bridge) or mailbox.org instead.
Germany· Email Services
Needs review
Shortlist web.de when you need mass-market German freemail with DE-sited mail/cloud, E-Mail made in Germany TLS alliance markers, optional PGP/2FA, and a familiar DACH portal. Skip when you need default E2EE, no advertising data path, self-host, or enterprise admin—consider Posteo, mailbox.org, Tuta, or Proton Mail instead.
Highlighted rows differ between the two products.
| Feature | Tuta | |
|---|---|---|
| Country of origin | Germany | Germany |
| Category | Email Services | Email Services |
| Open source | Yes | No |
| Self-hosted | No | No |
| Headquarters | Germany | Germany |
| Legal entity | Tutao GmbH (HRB 208014, Hanover) | 1&1 Mail & Media GmbH (United Internet AG group) |
| Governing law | German law / GDPR | Germany / EU GDPR |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Low |
| Hosting / residency | Vendor states mailbox data is stored end-to-end encrypted on Tutao-operated servers in ISO 27001-certified data centers in Germany. No AWS/GCP/Azure primary hosting named on official security/privacy pages. Privacy statement discloses payment processing via PayPal (Europe) and banks for card/SEPA; no comprehensive public subprocessor list found for ops tools. | Vendor claims email and Online-Speicher stored exclusively in Germany in company-owned data centers (E-Mail/Cloud made in Germany). FreeMail monetized via advertising and IAB TCF consent partners; privacy notice allows EEA third-country transfers with Chapter V safeguards. Portal/optional features use additional processors (e.g. search partners, embeds, homepage builder DUDA Inc., ID vendors). No exhaustive public mail-stack subprocessor list found. |
| Summary | German end-to-end encrypted email, calendar, and contacts from Tutao GmbH in Hanover—with post-quantum TutaCrypt, open-source clients, and freemium personal plus business plans. | German freemail and portal from United Internet’s 1&1 Mail & Media GmbH: FreeMail with DE-sited mail and cloud, E-Mail made in Germany TLS alliance, optional PGP—consumer SaaS, not default-E2EE privacy mail. |
| Tags |
| At a glance | Tuta | |
|---|---|---|
| HQ | Hanover, Germany (Tutao GmbH) | Not listed |
| Product | Encrypted email, calendar, contacts (SaaS) | Not listed |
| Hosting | Own servers in ISO 27001 data centers in Germany (vendor claim) | Not listed |
| Open source | Clients GPLv3 on GitHub; no productized self-host | No |
| Protocols | No IMAP/SMTP client access; official apps only | Not listed |
| Crypto | TutaCrypt hybrid (Kyber-1024 + X25519 + AES-256) for new accounts | Not listed |
| Commercial model | Freemium personal + paid personal/business (no ads) | Ad-supported FreeMail; paid mailbox/cloud upgrades; Consent or Pay |
| HQ / operator | Not listed | 1&1 Mail & Media GmbH, Montabaur/Karlsruhe, Germany |
| Parent group | Not listed | United Internet AG (Germany) |
| Product type | Not listed | Consumer freemail + portal + cloud (SaaS) |
| Hosting (vendor claim) | Not listed | Company-owned data centers in Germany |
| Self-host | Not listed | No |
| Key capabilities | Tuta | |
|---|---|---|
| Default mailbox E2EE | Yes | Not listed |
| TutaCrypt post-quantum | Yes | Not listed |
| EU-operated (Germany) | Yes | Yes |
| Open-source clients | Yes | Not listed |
| DE data centers (claimed) | Yes | Yes |
| No IMAP (by design) | Yes | Not listed |
| E-Mail made in Germany | Not listed | Yes |
| Optional PGP | Not listed | Yes |
| FreeMail + paid upgrades | Not listed | Yes |
| SaaS only | Not listed | Yes |
Default E2EE for mail, subjects, and attachments
Between Tuta users, messages encrypt automatically including subject lines, bodies, and attachments. External recipients can use a shared password for end-to-end threads without installing software. Contacts and calendars use the same zero-access model; only delivery metadata (addresses, timestamps) stays readable by design.
TutaCrypt post-quantum hybrid cryptography
New accounts use TutaCrypt: Kyber-1024 KEM plus X25519 ECDH with AES-256, targeting harvest-now-decrypt-later risks. Protocol details are published; existing accounts migrate as key rotation rolls out. Tuta intentionally avoids PGP so subjects and non-mail features can stay encrypted and algorithms can be upgraded in-product.
Zero-knowledge calendar with private reminders
Calendar events—including times, titles, locations, and attendees—are end-to-end encrypted. Reminders are pushed as encrypted payloads and fired locally so servers are not told when an event starts. Sharing stays encrypted; invites can go out via mail, optionally password-protected for externals.
Open-source multi-platform clients (no IMAP)
Web, Android (Play and F-Droid), iOS, Windows, macOS, and Linux clients are published under GPLv3 on GitHub. Desktop builds are signed for verification. There is no IMAP/SMTP bridge: third-party mail apps cannot connect, which preserves encryption at rest but forces a client switch for Outlook/Thunderbird holdouts.
Business domains, admin console, and whitelabel
Paid business plans add custom domains, aliases, shared mailboxes, multi-admin roles, password/2FA resets, catch-all, templates, and optional branding/login on your own site. Vendor-stated uptime SLA and a GDPR order-processing agreement support B2B procurement—confirm current plan matrix on tuta.com.
E-Mail made in Germany alliance transport
Founding member of the German provider alliance (WEB.DE, GMX, 1&1, STRATO, T-Online, freenet). TLS on paths inside the alliance, mail stored in Germany, and green checkmarks on alliance addresses in the compose UI. Does not encrypt content to non-alliance or non-PGP recipients end-to-end by default.
FreeMail + paid upgrades with intelligent inbox
Ad-supported FreeMail with integrated calendar, contacts, and Online-Speicher. Intelligent inbox categorizes newsletters, orders, social, and contracts/subscriptions without duplicating messages; optional package tracking via DHL, DPD, and GLS when consented. Paid tiers expand quotas and reduce ad/tracking friction under Consent or Pay.
Optional PGP and free 2FA
Optional PGP end-to-end encryption for sensitive mail (both parties need keys/compatible clients). Optional free two-factor authentication for account login. Baseline mailbox protection relies on account credentials, spam/virus filters, and TLS—not default E2EE for every message.
Cloud made in Germany Online-Speicher
Mailbox-integrated cloud with browser, app, and desktop access; link sharing and Online Office for documents. Vendor claims exclusive German data-center storage and TLS in transit under Cloud made in Germany. Free tier includes a starter cloud quota; larger capacities are paid add-ons. Not a full Google Drive/OneDrive collab suite.
German consumer portal on the same identity
News, services, WEB.Cent cashback, and optional Deutsche Post letter preview sit beside mail. Useful for personal DACH users; increases advertising and partner surface versus a pure mailbox product. Portal embeds and partners are consent-gated where required.
| Assurance & compliance | Tuta | |
|---|---|---|
| Independent security / no-logs audit | Vendor claimed Vendor states SySS GmbH penetration testing before public release; not a continuously published annual no-logs audit PDF on the marketing site. | Not found No public independent no-logs or full security audit package found for FreeMail; alliance pages claim oversight by data-protection function and independent Prüfstellen at a high level only. |
| ISO 27001 | Partial Official pages claim data centers are ISO 27001 certified; does not clearly establish a public Tutao GmbH organizational ISO 27001 certificate. | Not found No public ISO 27001 certificate page located for the web.de freemail product during research. |
| SOC 2 / SOC 3 | Not found No SOC 2/3 report located on security, business, or privacy pages. | Not found No public SOC 2/3 report found for web.de FreeMail. |
| GDPR / EU data protection | Vendor claimed German controller Tutao GmbH; privacy statement cites GDPR; DPO published; DE storage claimed. | Vendor claimed German controller (1&1 Mail & Media GmbH); detailed GDPR privacy notice; DE storage claims for mail/cloud. Not a legal certification. |
| US CLOUD Act exposure (indicative) | Partial EU entity, no known US parent, primary mailbox hosting claimed as own DE servers—not AWS/GCP/Azure. Payment may use PayPal (Europe). Assessment is low exposure for content with residual billing/processor unknowns; not a vendor 'safe' claim. Not legal advice. | Partial EU/German entity and parent; no known US parent; mail/cloud claimed on company-owned DE data centers. Partial because privacy notice allows third-country transfers with safeguards, FreeMail uses ad/TCF partners, and no exhaustive public subprocessor inventory. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Security/business materials state an Order Processing Agreement (Auftragsverarbeitung) is provided for GDPR; obtain signed version via sales—no public self-serve DPA URL confirmed. | Not found Consumer freemail focus; no clear self-serve public B2B DPA for FreeMail found. Request under contract if treating as processor for an organization. |
| EU AI Act | Not applicable Encrypted email/calendar product; vendor states it does not plan AI that processes user communications for model training. | Not applicable Consumer mail/portal with limited in-product assistants; not an AI-centric product for this checklist. |
| Considerations & known limitations | Tuta | |
|---|---|---|
| No IMAP/SMTP third-party clients | High Desktop and mobile holdouts cannot stay on Outlook/Thunderbird/Apple Mail. Plan full client migration or pick a standards-based alternative. | Not listed |
| Weaker protection to non-Tuta recipients | Medium Without a shared password, external mail is ordinary SMTP (TLS in transit). Only Tuta-to-Tuta and password-protected external threads are true E2EE. | Not listed |
| Hosted service, not on-prem mail | Medium Open-source clients help inspectability, but mailboxes still depend on Tutao's German SaaS backend, uptime, and German legal process. | Not listed |
| Data-center ISO vs company ISMS | Low ISO 27001 wording refers to data centers. Do not tick 'vendor ISO 27001 certified' on questionnaires without the actual Tutao certificate. | Not listed |
| Limited public subprocessor inventory | Medium Privacy policy covers payments (e.g. PayPal Europe) but lacks a detailed live subprocessor register. Request the DPA annex for DPIA completeness. | Not listed |
| German court orders on accessible data | Low Transparency reports show regular German requests. Stored E2EE content stays undecryptable by Tutao; real-time monitoring can expose newly arriving unencrypted SMTP mail. Align expectations with counsel. | Not listed |
| Ad-financed FreeMail and consent surface | Not listed | Medium FreeMail uses advertising and Consent or Pay. With consent, content may feed interest profiles; FreeMail users cannot drop WEB.DE informiert like paid tiers. Unsuitable where ad-tech processors are banned. |
| No default end-to-end encryption | Not listed | Medium TLS and alliance transport protection are not content E2EE. Optional PGP only covers willing counterparties. Operator can process plaintext for spam, intelligent inbox, and consented ad analysis. |
| Limited public audit/cert artifacts | Not listed | Medium ISO 27001, SOC 2, and independent no-logs audits not found on public product pages. Trust rests on German entity, DE hosting claims, and first-party security copy. |
| Third-country transfers and portal partners | Not listed | Low Privacy notice contemplates non-EEA recipients under Chapter V safeguards. Portal/search/ID/ad features introduce extra processors beyond the mailbox DC story—review consent layer and purpose before sensitive use. |
| FreeMail inactivity content deletion | Not listed | Low Privacy notice: FreeMail email content may be deleted after more than 180 days without login. Not a durable archive without activity or export. |
When: Users must keep desktop IMAP clients or need Bridge-style Outlook integration
Consider: Proton Mail (Bridge on paid plans) or mailbox.org / Posteo / Soverin
Those options trade Tuta's automatic subject E2EE model for standards-based access
When: You need a broader German digital workplace (Drive, Office, video) with optional PGP
Consider: mailbox.org
Stronger suite breadth; different default encryption depth than Tuta's full zero-access mailbox
When: Swiss jurisdiction and multi-product privacy suite (VPN, drive, pass) matter more than German HQ
Consider: Proton Mail
Compare Bridge, ecosystem lock-in, and published cert posture side by side
When: Belgian OpenPGP-centric suite with browser crypto and classic protocols is preferred
Consider: Mailfence
Different encryption UX (PGP-oriented) versus Tuta's automatic proprietary stack
When: You need default E2EE and a privacy-first paid mailbox
Consider: Tuta or Proton Mail
web.de PGP is optional and counterpart-dependent; FreeMail is ad-financed.
When: You want ad-free German/EU mail with strong consumer privacy posture and paid model only
Consider: Posteo or mailbox.org
Less portal monetization; clearer privacy-first product framing than mass freemail.
When: You prefer the same United Internet Mail & Media stack under another brand
Consider: GMX Mail
Nearly aligned trust and capability story; brand and portal mix differ.
When: You need Google/Microsoft-class workspace collab and enterprise compliance packs
Consider: Gmail (Google Workspace) or Outlook.com / Microsoft 365
Trade DE freemail residency story for US-group platforms and deeper admin tooling.