Tutanota

Tutanota provides end‑to‑end encrypted email services that also include a secure calendar and contact manager. The platform is designed for individuals who require confidential communication as well as for businesses seeking to protect corporate correspondence. All messages are encrypted locally before they leave the user’s device, and decryption keys never leave the endpoint, ensuring that even the service provider cannot read the content. Access is available through web browsers, desktop clients, and mobile applications for iOS and Android. The service offers a free tier with basic storage and paid subscription plans that provide additional storage, custom domain support, and advanced features such as multiple user accounts. Tutanota markets itself globally, emphasizing compliance with European data protection regulations such as GDPR and highlighting its strong privacy stance despite being based in Germany. The company’s user interface is available in several languages, facilitating adoption across different regions. By focusing on encryption at rest and in transit, Tutanota positions itself as a privacy‑first alternative to conventional email providers.

Tutanota’s distinguishing attributes lie in its strong focus on privacy and security, offering open‑source client code that allows independent verification of its cryptographic implementations. The company has invested in developing proprietary defenses against distributed denial‑of‑service attacks, as demonstrated by its response to the sustained DDoS campaign on 13 September 2020, during which it mitigated the traffic while correcting an overactive IP‑blocking rule that had unintentionally locked out legitimate users. Following the incident, Tutanota accelerated infrastructure improvements, expanded its development roadmap to include quantum‑resistant cryptography prototypes, and added offline functionality to its email and calendar clients. The organization remained committed to maintaining encryption standards without compromising them for operational convenience, and no ransom demands were acknowledged during the attack. Resources were allocated to strengthening resilience against future threats, including investments in network capacity and automated mitigation systems. Structurally, Tutanota is operated by Tutao GmbH, a privately held company headquartered in Hanover, Germany, and it does not disclose a parent‑subsidiary relationship with any larger entity. The firm’s ownership remains with its founders and employees, reinforcing its independence from external investors. This governance model supports its long‑term commitment to user privacy and security.