Tuta (formerly Tutanota) is an end-to-end encrypted email, calendar, and contacts service from Tutao GmbH, a founder-led company in Hanover, Germany. Registration requires no phone number, IP addresses are stored only anonymized, and mailbox content — subject lines, attachments, calendar entries, contacts — is end-to-end encrypted, since March 2024 under the hybrid post-quantum TutaCrypt protocol (CRYSTALS-Kyber plus X25519). Sender and recipient addresses and message dates stay unencrypted for routing. Clients are open source (GPL-3.0); data sits in ISO 27001 certified German data centers. As a German provider Tuta must comply with valid German court orders: a 2020 Cologne ruling compelled it to release future unencrypted mail from one targeted mailbox, and its transparency report documents ongoing releases of inventory data, traffic data, and unencrypted content under such orders.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
19 ON FILE
COLLECTION
The service's policy indicates this service claims that your personal data is not being sold.
Tuta's encryption documentation states that emails including subject lines and attachments, calendar entries, and contacts are stored end-to-end encrypted, while the email addresses of senders and recipients and the date of an email remain unencrypted because other mail servers need this routing information.
As assessed by PrivacySpy on 2024-09-09 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
Tuta's privacy policy, effective November 13, 2025, lists only the newly registered email address as inventory data collected when an account is created — no phone number is required — and states that IP addresses are only stored anonymized and that mail server logs contain sender and recipient addresses and connection times but no customer IP addresses.
Tuta's imprint identifies the operator as Tutao GmbH, Deisterstr. 17a, 30449 Hanover, Germany, registered at the district court Hanover under HRB 208014, with managing directors Arne Möhle, Hanna Bozakov and Matthias Pfau.
Tuta publishes its web, desktop, Android, and iOS clients as open-source software under the GPL-3.0 license in the public tutao/tutanota repository on GitHub.
In a March 11, 2024 announcement, Tuta publicly documented its TutaCrypt post-quantum encryption protocol, describing a hybrid of the post-quantum key encapsulation mechanism CRYSTALS-Kyber and an X25519 elliptic-curve Diffie-Hellman key exchange, enabled by default for newly created accounts.
As assessed by PrivacySpy on 2024-09-09 (see PrivacySpy's rubric entry for this product for the per-claim citation): Is the policy's history made available? — Only the date it was last modified.
Tuta's transparency report states that between July 1 and December 31, 2025 it received 165 requests for inventory data and released inventory data in 19 cases, and released real-time traffic data under German court orders in 19 of 25 cases; the report's warrant canary affirms Tuta has never received National Security Letters or FISA court orders and has never placed backdoors in its encryption.
As assessed by PrivacySpy on 2024-09-09 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service allow third-party access to private personal data? — Yes, all parties specified (only to critical service providers).
Tuta's privacy policy, effective November 13, 2025, states that payment details for paid accounts (banking details, credit card data, or PayPal user name) are processed with payment providers, and that all data is stored in ISO 27001 certified data centers in Germany, placing the service under German and EU jurisdiction.
Tuta publishes a vulnerability-disclosure policy in the SECURITY.md file of its public tutao/tutanota repository, stating that the policy covers all Tuta Mail clients, the backend services and the tuta.com website, directing reporters to GitHub's private security-advisory feature (with an email route for reporters without a GitHub account), and committing to issue a public disclosure on Tuta's blog within 7 days of disabling vulnerable clients. The document describes no monetary reward.
Tuta's open-source page states that before Tuta's public release all its apps were audited by independent security experts and that, in an extensive penetration test, experts from SySS GmbH were not able to hack into Tuta's system or retrieve encrypted data. This is a first-party assertion about a pre-release test: Tuta publishes no report, no summary of findings, no date, and no stated audit cadence for it, and no other published third-party audit of Tuta was located.
In November 2020 the Cologne Regional Court ordered Tutanota, under German telecommunications law, to implement a monitoring function releasing unencrypted incoming and outgoing emails from one specific mailbox linked to a blackmail case; Tutanota said it would develop the function by the end of 2020 while preparing an appeal to Germany's Federal Court of Justice, and emails already end-to-end encrypted in Tutanota could not be decrypted by the company even after the order.
CyberScoop reported on 2021-05-24 that Tutanota (now Tuta) had asked Germany's Federal Court of Justice (BGH) to re-examine the Cologne Regional Court's monitoring order, arguing it is not a telecommunications service and so should not be compelled to monitor accounts under German law; the BGH held the application admissible but unfounded, dismissing the appeal and requiring Tutanota to supply unencrypted incoming and outgoing mail for two accounts for three months. Tutanota stated that data already end-to-end encrypted could not be decrypted by the company.
In its March 11, 2025 one-year review of the TutaCrypt rollout, Tuta stated that a formal security proof of the protocol, developed with the IT Security and Cryptography department of Bergische Universität Wuppertal, was still in progress rather than completed, and that it had addressed side-channel attack vulnerabilities found in certain Kyber implementations by updating its encryption libraries.
Tuta's transparency report, first published 2016-01-01 and updated every six months (last updated 2026-01-01), publishes per-period counts of German legal demands and how many Tuta complied with — for 1 July to 31 December 2025: 165 requests for inventory data with 19 releases, 25 requests for real-time traffic data with 19 releases, 16 requests for stored content data with 8 releases, and 14 requests for real-time content data with 12 releases — alongside comparable figures for every half-year back to 2020 and a warrant canary. The report's headline states Tuta rejected 75% of all requests from authorities in 2025.
Tuta's security page states that the service does not track users, does not send targeted advertisements to mailboxes, and does not log IP addresses when users log in or send an email by default.
Tuta's privacy policy, effective November 13, 2025, states the service uses no cookies and no third-party analysis tools such as Google Analytics; it also discloses first-party marketing campaign tracking under GDPR Art. 6(1)(f) legitimate interest that processes campaign IDs together with cryptographic hashes of connection data (IP address, user agent), deleted at the latest after 30 days.