Tuta
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Hannover-based end-to-end encrypted mail (formerly Tutanota); post-quantum crypto, own servers in ISO 27001 certified German data centres.
Tuta is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under Private email.
Assessment notes
Tuta (formerly Tutanota, Hannover DE, founded 2011 by Arne Möhle and Matthias Pfau) operates its own German data centre, ships end-to-end encrypted mail / calendar / drive with post-quantum cryptography, all clients open-source and auditable, with those servers standing in ISO 27001 certified data centres in Germany (a facility certification held by the data centre operator, not a certificate held by Tutao GmbH), GDPR + DSGVO, 10,000+ business organisations and millions of consumer users; EU-owned, no US ties, no CLOUD Act exposure. One gap: the DPA is not publicly accessible and is reachable only inside a customer account after signing up for a business plan; no public sub-processors list.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
End-to-end encryption: Yes
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Tuta
Tuta (Hannover, Germany, founded 2011 by Arne Möhle and Matthias Pfau; Tutanota until 2023 rebrand) is one of the cleanest privacy-first email picks in Europe: own German data centre, end-to-end encryption by default, post-quantum cryptography (forward-looking against future quantum attacks), 100% open-source clients for Android, iOS, Windows, macOS, Linux, and browser. Free tier permanent for personal use; paid Revolutionary tier from €3 per user per month on yearly billing. The ISO 27001 certification cited on the vendor's pages belongs to the German data centres housing those servers rather than to Tutao GmbH itself. Products: Tuta Mail, Tuta Calendar, Tuta Drive. Customer base: 10,000+ organisations including medical, journalism, human-rights, plus millions of consumers. 100% renewable-energy-powered. Founder-owned, no US VC, no PE, no CLOUD Act exposure.
Sub-processor map · none disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Tuta
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Switzerland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
E2E: Yes Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €1/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
E2E: No Public DPA: Not assessed Sub-processors: Yes Open source: No -
-
Germany · €1/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
E2E: No Public DPA: Not assessed Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Proton Mail
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
E2E: Yes
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
Mailbox.org
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
E2E: No
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
€1/mo |
Posteo
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
E2E: No
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
€1/mo |