Tuta: the Gmail exit with every tracked dimension inside the EU

Tuta is a German company, registered in Hannover as Tutao GmbH under commercial register entry HRB 208014 at the Amtsgericht Hannover. Every dimension FindInEurope tracks for it, home jurisdiction, governing law, data location, technology, security practice, environmental record, lands inside the EU and EEA. That single-jurisdiction profile is rarer among “European” email providers than the label implies, which makes Tuta a useful test case for anyone leaving Gmail specifically to get out from under US law.

It does not mean every claim about Tuta is independently confirmed at the same strength. The company’s home jurisdiction is verified against the Hannover register. Its legal footing, German law and GDPR, is verified against its published privacy policy. But the register entry that proves Tuta exists and where it is filed does not prove who ultimately controls it, so Tuta’s claim of founder-led ownership with no disclosed non-EU parent sits one notch down, marked claimed rather than verified, sourced to the company’s own imprint page.

Data location is another claimed entry. Tuta says customer data lives in ISO 27001 certified data centres in Germany. That is a specific, checkable-sounding claim, and it comes from Tuta’s own privacy policy rather than from an external audit of the centres themselves, so it is marked claimed. The environmental line, entirely renewable electricity across servers and offices since March 2019, carries the same self-declared status.

Where Tuta’s record gets stronger is the technical layer, and this is the part that matters most for someone actually planning a move off Gmail. The mail clients are open source under the GPLv3 licence, covering web, Android, iOS, Windows, macOS, and Linux, and account data can be exported rather than locked in. Security practice carries the same verified weight: encryption runs on AES-256 with the post-quantum algorithm Kyber-1024 already in place, and an independent penetration test was run by the German firm SySS GmbH. Both entries are verified.

That combination, open clients across six platforms plus a named external security test, is a concrete answer to the lock-in worry that usually accompanies a Gmail migration. You are trading a closed ecosystem for one where the client code is published and the data can leave with you if Tuta ever stops being the right choice.

What the record does not do is collapse the distinction between register fact and company statement. Tuta’s home jurisdiction and legal status are backed by public filings. Its ownership structure, its data-centre location, and its environmental record rest on what the company itself publishes. Both categories matter for someone leaving Gmail, but they are not the same kind of evidence, and FindInEurope keeps them separate on purpose. The full dossier at /listings/tuta/ shows the current score with the source behind each rating.