ProtonMail offers nearly the same level of end-to-end encryption, though it does NOT encrypt email subject lines. Tutanota also differs from ProtonMail by strengthening 2FA with U2F that gives an additional layer of security. Tutanota also makes it impossible to trace messages back to the user at least by using their IP. No one at Tutanota can see what you search for within your emails. Tutanota encrypts more sections of your email and inbox than ProtonMail (your calendar and address book) while also giving you a zero-knowledge text search. Passwords are hashed using bcrypt and SHA256, with connections to the Tutanota servers secured using TLS. Emails to non-Tutanota users are encrypted using AES-128-bit. Their stronger key schedule arguably makes it more secure than AES 256-bit. It combines AES 128-bit and RSA 2048-bit protocols to give you end-to-end protection. The bonus is an end-to-end encrypted address book and calendar, ensuring that your contacts and meetings are kept top secret. Tutanota encrypts the email subject, body, and all attachments. However, it also stated that the law cannot force it to compromise encryption. The next day ProtonMail stated in their privacy policy statement that it can be legally compelled to log one’s IP address as part of a Swiss criminal investigation. In this case, French authorities asked the Swiss government for assistance. However, on 5 September of 2021 the Swiss government forced ProtonMail to hand over IP addresses of French activists charged with theft and destruction of property. Offering some of the strongest privacy protection in the world, their 1993 Federal Act on Data protection strictly prohibits any processing of personal data without explicit consent. Switzerland is renowned for being neutral territory – being outside of US and EU jurisdiction. ProtonMail uses its Swiss location to take advantage of the DPA and DPO acts. Essentially, it prohibits the collection and use of personal data unless the law specifically permits it or you have given your informed consent. Germany may be one of the Fourteen Eyes, but it is protected by The German Federal Data Protection Act – a modification of the general EU GDPR law. Tutanota is based in Germany (one of the Fourteen Eyes).

Let's talk about the data laws under which these companies operate.

Proton email secure