Although I am a long time Proton Mail user (and still am), the recent moves by the Swiss government to dramatically expand state surveillance powers (potentially requiring email providers to log metadata and decrypt user data on demand) have prompted a rethink.
Not only is Tuta based in Germany (and are therefore not bound by this change in legislation), their environmental credentials look stronger too.: Tuta’s servers run entirely on renewable electricity, hosted in German data centres.
Tuta encrypts everything by default too. Not just the message body, but subject lines, attachments, and metadata too. This goes further than most encrypted email providers, including Proton Mail.
As well as that, Tuta’s code (both client and server) is publicly published. Anyone can inspect it. For a project that champions transparency, this matters.
Although we’ll be paying for a business plan (so we can use our domains for email) it’s useful to note that Tuta also offer a genuinely free account with no advertising and no data harvesting. Free really does mean free.
The one downside so far worth noting is that Tuta does not support IMAP or POP3, meaning email must be accessed through their own apps or webmail. This is a deliberate architectural decision to maintain end-to-end encryption, but one we are comfortable with at the moment.
We’ll let you know how we get on.
References