Tuta Mail

Tutao GmbH is registered at Deisterstr. 17a, 30449 Hannover, under HRB 208014 at Amtsgericht Hannover. The three Geschäftsführer (managing directors) are co-founder Arne Möhle, co-founder Matthias Pfau and Hanna Bozakov. Möhle and Pfau are the sole shareholders -- Tuta stated verbatim on its company blog: 'the company is wholly owned by Matthias and Arne, and is not liable to anyone else.' Mailboxes are stored on Tutao's own infrastructure in Germany: Tutao GmbH is a RIPE Local Internet Registry that operates AS210909 and announces 185.205.69.0/24 and 2a10:e000:1::/48 directly. Tuta states the data centres are 'ISO 27001 certified data centers in Germany'; the certification covers the data-centre operators, not Tutao GmbH as an entity. The Tuta Terms of Service make German law and Hanover the place of jurisdiction.

No, not directly. Tutao GmbH has no US-incorporated parent, no US subsidiary and no offices outside Germany; the founders, the headquarters and the production infrastructure are German. Tuta stated verbatim that 'Tutao GmbH only responds to valid warrants issued by German courts' and 'German companies are not allowed to share customer's information with foreign law enforcement.' Indirect exposure exists through a small set of subprocessors that are US-domiciled: authoritative DNS for tuta.com and tutanota.com is hosted on AWS Route 53; iOS subscription billing flows through Apple (in-app purchase since 2024-07-12); Android subscription billing flows through Google Play; PayPal and an unnamed credit-card processor handle subscription payments. None of those processors can decrypt encrypted mailbox content.

Mail bodies, subject lines and attachments; entire calendars including event metadata such as titles, notifications and reminders; contacts (birthday, comment, company, first name, last name, nickname, role, title, addresses, mail addresses, phone numbers, social IDs); inbox rules and filters; and the full search index, which is built and stored on the client device. The only data that remains unencrypted is sender / recipient mail addresses and timestamps, because email protocol standards require routing metadata to remain in clear text. Push notifications are delivered through Tuta's own open-source notification service hidden from Apple and Google. The cryptographic primitives are AES-256 / HMAC-SHA-256 symmetric, Argon2 / HKDF-SHA-256 key derivation, and from 2024-03-11 the post-quantum TutaCrypt hybrid Kyber-1024 + x25519 exchange for new accounts (RSA-2048 retained for backward compatibility with legacy accounts).

The Tuta web, iOS, Android, desktop (Windows / macOS / Linux) clients and the backend infrastructure code are open source under GPL-3.0 at github.com/tutao/tutanota (7,580 stars, 619 forks, 938 tagged releases). The Android app is published on Google Play and as a Google-Play-Services-free build on F-Droid (Tuta is, per Wikipedia, the first email provider to publish on F-Droid). Tuta is a member of the Open Invention Network (joined 2017). The Tutao trademark is held by the company. There is no documented self-hosting flow for the server side -- running your own Tuta mailbox cluster is technically possible from the public source tree but is not a productised path. Most procurement-grade buyers will use the hosted Business plans (Essential, Advanced or Unlimited) under an Auftragsverarbeitungsvertrag.

The transparency report is updated every six months and includes a warrant canary. The H2 2025 (1 July - 31 December 2025) report shows 165 inventory-data requests with 19 disclosed (~88% rejection), 25 real-time-traffic-data requests with 19 disclosed, 16 stored-content-data requests with 8 disclosed and 14 real-time-content-data requests with 12 disclosed. Tuta stated that across calendar year 2025 it 'rejected 75% of all requests from authorities.' Even with a valid German court order, Tuta cannot decrypt mailbox content -- only inventory data (banking / PayPal / card metadata) and routing metadata (sender / recipient / timestamps) can be turned over. The canary states verbatim: 'Tuta (formerly Tutanota) has never received any National Security Letters or FISA court orders, and we have not been subject to any gag order by a FISA court.'

Tuta does not publish a single subprocessor URL the way most B2B SaaS vendors do. The vendors that touch customer data are enumerated inline across the privacy policy, the iOS-payment blog post and the imprint. The list is small by design: AWS Route 53 for authoritative DNS, PayPal Europe S.à r.l. et Cie S.C.A. for PayPal payments, an unnamed credit-card processor for card payments, German credit institutions for SEPA direct debit, Apple Inc. for iOS in-app subscriptions (since 2024-07-12), Google LLC for Android billing via Google Play, INWX GmbH as the domain registrar and BGP transit via Arelion (AS1299, Sweden) and kyberio GmbH (AS24679, Germany). The Business plans include an Order Processing Agreement on request through the sales channel.