Tuta (Tutanota)
Verified“German-owned, German-hosted: about as sovereign as EU email gets.”
- Users
- 10M+
- Ownership
- 100% founders
- Employees
- ~41
- Hosting
- Own servers, DE
92 = midpoint of Control 94 & Data 90
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 14 sourced facts across 12 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 88% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
93
Incorporated and operated as a German GmbH in Hannover with no foreign parent; EU/German law reaches it directly and GDPR applies natively.
Why 93? 4 sourced facts · click to expand
The operating company Tutao GmbH is registered at the Hannover commercial register under HRB 208014, address Deisterstrasse 17a, 30449 Hannover.
Online-Handelsregister (German commercial register listing) · as of 2026-06-12
Tuta states it has offices located only within Germany and no other countries, and responds only to valid warrants from German courts.
Tuta blog (independence statement) · as of 2026-06-12
Tuta argues German law gives no power to compel a gag order or an encryption backdoor, and German companies cannot share customer data with foreign law enforcement.
Tuta blog (Why Tuta is based in Germany) · as of 2026-06-12
A 2020 Cologne court order required monitoring of a single account's future unencrypted incoming mail, demonstrating Tuta operates under German court jurisdiction.
Wikipedia (Tuta email) · as of 2026-06-12
Control & Ownership
95
Wholly and privately owned by its two German founders with no outside investors, no foreign parent and no public listing; both voting control and economics sit in the EU.
Why 95? 3 sourced facts · click to expand
Tutao GmbH was founded in 2011 by Arne Mohle and Matthias Pfau and is to this day wholly owned by them, not liable to anyone else.
Tuta blog (independence statement) · as of 2026-06-12
Tuta is a private company with no venture funding rounds listed; it is not publicly traded on any exchange.
Crunchbase (Tutanota profile) · as of 2026-06-12
The registered share capital of Tutao GmbH is EUR 25,500, consistent with a small founder-held GmbH rather than an investor cap table.
Online-Handelsregister (German commercial register listing) · as of 2026-06-12
Data →
Where your data lives and who can reach it
Data & Infrastructure
88
Runs its own servers in ISO 27001-certified German data centers rather than on a US hyperscaler, with end-to-end encryption; only caveat is the specific colocation provider is not publicly named.
Why 88? 4 sourced facts · click to expand
All data is stored on Tuta's own servers in ISO 27001-certified data centers based in Germany, fully compliant with the GDPR.
Tuta (business / security pages) · as of 2026-06-12
Tuta builds its clients itself and operates its own server infrastructure rather than relying on third-party cloud providers like Amazon, Google or Microsoft.
Tuta security page · as of 2026-06-12
User data is automatically end-to-end encrypted so that not even Tuta can read it, with private keys encrypted under the user's password before reaching the servers.
Tuta encryption page · as of 2026-06-12
Tuta says its own servers are powered with 100% renewable energy.
Tuta Drive page · as of 2026-06-12
Operations & People
92
Headquartered in Hannover with a second German office in Munich, German founders and workforce, and German/EU funding; operations are fully EU-centered.
Why 92? 3 sourced facts · click to expand
Tuta is headquartered in Hannover, Germany, and opened a second office in Munich in 2024.
Tuta blog (2024 year in review) · as of 2026-06-12
Tuta's team continued growing in 2025 with new hires across its Hannover and Munich offices; third-party profiles put headcount around 41.
Tuta blog (team grows) / PitchBook · as of 2026-06-12
Tuta runs the PQDrive post-quantum project with a ~EUR 1.5M KMU-innovativ grant from Germany's Federal Ministry of Education and Research, partnering with the University of Wuppertal.
Tuta blog (PQDrive project) · as of 2026-06-12
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
Which specific colocation provider(s) and city host Tuta's servers?
Tuta confirms own servers in ISO 27001 German data centers but does not publicly name the facility operator, so independent CLOUD Act / jurisdictional verification of the hosting partner is not possible.
- ?
What is Tuta's revenue and current exact user/paid-subscriber count?
As a private GmbH it discloses no audited financials; the 10M+ users figure dates to 2023, so scale and financial sustainability cannot be precisely verified.
- ?
Does any part of the stack (e.g. CDN, captcha, app-store delivery, payment processing) touch non-EU providers?
Core storage is EU-owned and EU-hosted, but ancillary edge/payment services are not detailed publicly, a common gap that adversarial reviewers probe.
EU Cloud Sovereignty Framework lens
The EU Cloud Sovereignty Framework (SEAL) is a procurement scheme for cloud service providers; Tuta is an email/storage application, so the rows below are an analogous sovereignty mapping, not a certification or formal SEAL assessment.
Strategic
Founder-owned German SME with an explicit EU-sovereignty and privacy mission; no foreign strategic dependence.
Legal & jurisdictional
Incorporated and operated solely in Germany (Tutao GmbH, HRB 208014); fully within EU/German jurisdiction and GDPR.
Data & AI
Data stored end-to-end encrypted on own servers in Germany; provider cannot read content; no reliance on US hyperscalers.
Operational
HQ Hannover plus Munich office; German leadership and workforce; reporting and operations EU-centered.
Supply chain
Owns its servers and builds clients in-house, but the colocation provider is unnamed and ancillary services (payments, app stores) are undisclosed.
Technological
Open-source clients, self-built apps, and post-quantum encryption developed with a German federal (BMBF) grant and University of Wuppertal.
Security & compliance
ISO 27001-certified data centers and GDPR compliance asserted; default E2E encryption; subject to German court oversight.
Environmental sustainability
Tuta states servers run on 100% renewable energy, but no published PUE or independent environmental audit was found.
EU alternatives
Tuta is itself a strong EU-sovereign choice: German-owned, German-hosted, E2E-encrypted email/calendar/storage.
Privacy-first peer with own infrastructure, but based in Switzerland (EEA-adjacent, not an EU member state).
German-owned (Heinlein Group) encrypted email and groupware hosted in Germany; a comparable EU-sovereign peer.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology