Email Providers · Email Provider (privacy-focused) · No confirmed finding (unverified, not clean)
Tutanota (Tuta)
Headline
Nothing confirmed
The finding that matters for Tuta is the same one that defines Proton: a German provider is subject to German court orders, and the relevant question is not whether the company would resist but what it is technically…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
What this pass recorded. Nothing confirmed this pass in the sense of a breach or penalty. The finding that matters for Tuta is the same one that defines Proton: a German provider is subject to German court orders, and the relevant question is not whether the company would resist but what it is technically capable of producing when it cannot. Tuta encrypts subject lines as well as bodies, which is a genuine technical step beyond several competitors, since a subject line often carries the substance. The honest framing for this whole category is that end-to-end encryption protects content and does not protect metadata, and metadata - who, when, how often, from where - is frequently what an investigator actually wants.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected; Tuta is Germany-based and subject to GDPR.
Data sharing
Not independently confirmed this pass with a specific named lawsuit or breach — Tuta is consistently rated among the most privacy-protective providers in independent comparisons, using OPEN-SOURCE client software (published on GitHub, publicly auditable code) and encrypting not just message content but also SUBJECT LINES and CONTACTS/recipients — a more thorough encryption scope than most competitors (ProtonMail, by some comparisons, does not encrypt subject lines by default). Tuta has also adopted post-quantum-resistant encryption methods (e.g., Kyber-1024), positioning it ahead of most other providers in this tab on forward-looking cryptographic security.
Fees and billing
Free tier storage is limited (roughly 1GB per some comparisons) relative to Gmail/Yahoo/AOL's much larger free tiers — a real usability trade-off for the added privacy.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy tuta.com/privacy | Not fetched yet | NO (HTML only) |
| Terms of service tuta.com/terms | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.