Tuta

Key Findings

• Political: No public evidence identified of an official Tuta statement on Israel, Palestine, Gaza, the IDF, settlements, or the current conflict in the bounded review. Under the Political neutrality floor, the contrast with Tuta’s documented Ukraine advocacy and aid supports a low double-standard score; this is not a finding of Israeli operational involvement.^{1, 2}
• Digital: Tuta states that encrypted user data are stored on its own servers in ISO 27001-certified German data centres; no public evidence identified of Israeli cloud-region use, Project Nimbus participation, or Israeli government or military cloud contracting.^{3, 4}
• Economic: Tutao GmbH is a German company behind Tuta; the reviewed materials identified no Israeli office, subsidiary, reseller, procurement relationship, settlement operation, or Israeli state contract.^{5, 6}
• Not found: No public evidence identified of Israeli defence procurement, security-sector deployments, weapons-related activity, or supply to Israeli defence primes.^{7, 8}

Target Profile

Key Facts:

• Tutao GmbH was founded by Möhle and Pfau in 2011; its GmbH registration is dated 10 January 2012.^{5, 6}
• Tuta describes itself as operating from Germany and reports offices in Hanover and Munich.^{5, 9}
• The available materials do not establish a parent company, subsidiary, franchise network, or Israeli legal entity.^{5, 6}

Executive Summary

Tuta is the consumer-facing encrypted-email, calendar, and cloud-service brand operated by German private company Tutao GmbH. Its reviewed product materials describe end-to-end encrypted email, calendar, and contact services, internally developed clients, and German-hosted infrastructure rather than physical goods, defence products, or a public-sector technology programme.^{3, 5, 10}

The strongest documented Israel/Palestine-related finding is negative: across the bounded audits, no public evidence was identified of a contract, tender award, framework agreement, deployment, partnership, reseller, or other disclosed relationship between Tuta and the Israeli Ministry of Defense, IDF, intelligence agencies, other Israeli state bodies, settlement municipalities, or Israeli defence primes.^{4, 7, 8} No public evidence was identified of Tuta-operated infrastructure in Israel, Project Nimbus participation, an Israeli office or subsidiary, Israeli market operations, settlement-related sales, or an Israeli supply-chain relationship.^{4, 12}

The political audit identified a defined March 2022 Ukraine humanitarian initiative and later company communications concerning Russia-linked cyber activity. It found no public evidence of an official company statement on Israel, Palestine, Gaza, the IDF, settlements, or the current conflict, nor of lobbying, donations, sponsorships, fundraising, or in-kind support connected to Israeli military, settlement, or comparable political organisations.^{1, 2, 13} Under the Political neutrality floor, the documented contrast between vocal alignment and material aid on Ukraine and no identified comparable Israel–Palestine statement supports the low double-standard score. This is a rubric-based assessment of public corporate communications, not evidence of an Israeli operational relationship or a claim about private views.^{1, 2} The absence findings are limited to the reviewed materials and targeted checks; they do not establish absence from every possible database, supplier relationship, customer relationship, or upstream dependency.^{4, 14}

The resulting fixed, human-vetted V6 assessment records zero scores for Military, Digital, and Economic domains. The sole non-zero domain is Political, with a Political score of 0.93. The final BRS is 78, placing Tuta in Tier E (Minimal/No Complicity).

Timeline of Relevant Events

Corporate Overview

Tutao GmbH is the operating entity behind Tuta and is registered in Hanover, Germany under HRB 208014. The historic registry-purpose text describes development, operation, and distribution of secure, flexible, and easy-to-use software products.^{5, 6}

Tuta states that its founders are Arne Möhle and Matthias Pfau and that the company remained founder-owned as of November 2023. Accessible registry-data presentations show financial-statement publications through financial year 2024, but do not disclose current shareholder percentages, beneficial ownership, or changes after the August 2023 shareholder-list filing. The claimed 100% founder ownership therefore remains unverified beyond the company statement.^{5, 6}

The reviewed materials describe German offices in Hanover and Munich and German-hosted infrastructure. No parent company, subsidiary, franchise network, Israeli entity, Israeli office, local distributor, or authorised reseller was identified in the supplied research.^{4, 5, 9}

Domain Summaries

Military: Military

Mechanism of Involvement

No public evidence identified of Tuta contracts, tender awards, procurement records, framework agreements, memoranda, or official defence cooperation with the Israeli Ministry of Defense, IDF, Israel Prison Service, Border Police, or other Israeli security bodies in the reviewed Israeli Ministry of Defense and SIBAT materials.^{7, 8}

No public evidence identified that Tuta supplies tactical, ruggedised, military-specification, targeting, weapons-effect, munitions, or defence-grade products; its reviewed materials instead describe encrypted email, calendar, and cloud services.¹⁰ No public evidence identified of supply-chain integration, co-development, technology transfer, licensed manufacturing, or purpose-built kinetic software involving Israeli defence primes.^{8, 10}

No public evidence identified of equipment or services supporting settlements, checkpoints, the separation barrier, military installations, demolition activity, or other occupied-territory infrastructure.¹⁰

Counter-Arguments and Evidence Limits

Tuta’s strongest defence is its civilian product character: reviewed materials describe general encrypted communications and cloud services, not defence procurement or weapons-related offerings.¹⁰ Ordinary availability of a general-purpose communications service, if any, would not itself establish supply to an Israeli state body.¹⁰

The negative findings are bounded. They do not prove that no individual Israeli user could access a public service, and they do not establish absence beyond the reviewed procurement, directory, company, and document sources.^{7, 8, 14}

Named Entities and Evidence Map

Digital: Digital

Mechanism of Involvement

Tuta states that it develops web, Android, iOS, and desktop clients internally, uses reviewed open-source code, and develops components including its CAPTCHA, Android push-notification alternative, and blob storage.^{3, 17} It states that user data are stored end-to-end encrypted on its own servers in ISO 27001-certified data centres in Germany, while sender and recipient email-address metadata are an exception required for delivery; search indices are stored locally on the user’s device or browser.³

No public evidence identified of Israeli cloud-region use, Tuta-operated or co-located Israeli data-centre infrastructure, Project Nimbus participation, Israeli government-cloud contracting, or data-sovereignty services for Israeli state or military bodies.⁴ No public evidence identified of contracts, partnerships, deployments, offensive cyber products, AI services, autonomous systems, surveillance technologies, or security-sector technology relationships involving Tuta and Israeli state or security actors.⁴

Counter-Arguments and Evidence Limits

Tuta publicly characterises itself as independent and not connected to intelligence agencies, but this is a company statement rather than an independently verified account of all customer, supplier, or government relationships.⁵ The service’s stated German infrastructure and internal-development model weigh against a documented Israeli digital nexus in the reviewed materials.^{3, 16}

However, the materials do not identify all German data-centre operators, transit providers, backup locations, payment processors, or non-core subprocessors. They therefore cannot establish or exclude Israeli ownership or control across every upstream infrastructure dependency.⁴

Named Entities and Evidence Map

Economic: Economic

Mechanism of Involvement

No public evidence identified of Tutao/Tuta procurement from Israeli exporters, Israeli-origin products, importers of record, third-party suppliers, or settlement-linked supply chains.¹² Tuta is described as a provider of digital encrypted email and calendar services rather than a seller or manufacturer of physical goods.^{10, 18}

No public evidence identified of Israeli acquisitions, subsidiaries, factories, R&D centres, data centres, real estate, sovereign-bond holdings, Israel-focused funds, or portfolio holdings by Tuta/Tutao or its named founders.¹² No public evidence identified of an Israeli office, workforce, tax registration, distributor, reseller, warehouse, government deployment, IDF contract, Ministry of Defense contract, settlement-municipality relationship, or settlement-related sales or revenue.¹²

Counter-Arguments and Evidence Limits

The available record supports a German operating entity, German offices, and German-hosted infrastructure, while Tuta has stated that it did not take venture-capital investment and was funded through loans later repaid and through service sales.^{5, 12} These facts support the conclusion that no Israeli economic nexus was documented in the reviewed evidence.

The sources do not provide a public customer list, reseller list, geography-by-revenue disclosure, audited consolidated group chart, or underlying shareholder list. Accordingly, they cannot establish or exclude every possible commercial customer or revenue relationship.^{6, 12}

Named Entities and Evidence Map

Political: Political

Mechanism of Involvement

No public evidence identified of official Tuta statements on Israel, Palestine, Gaza, the IDF, Israeli settlements, or the current conflict in the bounded review.¹ No public evidence identified of lobbying, advocacy on anti-BDS legislation or regional trade policy, political donations, sponsorships, fundraising, or in-kind support for the IDF, Friends of the IDF, JNF/KKL, settlement organisations, reservist funds, or comparable bodies.¹

No public evidence identified of Tuta operations, contracts, resellers, subsidiaries, sales channels, or service agreements in settlements, occupied East Jerusalem, the West Bank, Gaza, or the occupied Syrian Golan.¹⁴ Tuta was not named in the supplied document-scoped pre-scan of the referenced 2023 OHCHR settlement-business report or the 2025 UN Special Rapporteur report.¹⁴

The political audit did identify Tuta’s time-limited 2022 Ukraine initiative and Russia-related corporate communications. Read alongside the bounded finding of no identified official Israel–Palestine statement, the Political neutrality floor treats that contrast as a low double-standard framing. It does not establish an Israeli operational nexus or infer a private political view.^{1, 2, 13}

Counter-Arguments and Evidence Limits

Tuta’s strongest defence is that the audit found no documented Israel/Palestine political activity, occupied-territory operation, state partnership, political financing, or conflict-related mobilisation of company assets.^{1, 14} The company presents itself around privacy, security, encryption, and open-source software rather than geopolitical or state-partnership branding.^{3, 5}

The non-zero Political result therefore rests narrowly on the rubric’s prescribed comparison of Tuta’s own public communications across conflicts, not on a documented Israeli state, military, settlement, or commercial relationship.^{1, 2}

The document-scoped absence from the cited UN materials does not prove database-wide absence or rule out relationships not captured in those documents. Similarly, the lack of identified public statements does not prove that no private views or unreported activity exist.¹⁴

Named Entities and Evidence Map

BDS-1000 Score

Method: V6.

• V_MAX: 0.93 Avg_OTHERS: 0.00
• BRS Score: 78 Tier: E (Minimal/No Complicity)

V_MAX is driven solely by the fixed Political score of 0.93; the Military, Digital, and Economic domain scores are zero. The Tier E result reflects the evidence-only, human-vetted V6 record, including negative and unresolved findings rather than assumptions of transitive responsibility.

Methodology Note

• This dossier relies only on the four supplied domain audits and their cited source record.
• Findings are evidence-only: claims not supported in the bounded review are recorded as “No public evidence identified,” rather than inferred.
• V6 assesses Impact as activity type, M as scale, and P as directness; it is scale-free and does not convert general product availability into a state relationship.
• Divested or exited activity is mitigating where documented; no underlying relevant Israel- or settlement-related activity was verified here.
• Entity attribution is specific: no transitive guilt is assigned through unspecified customers, upstream providers, founders, or general-purpose technology.
• Where verified settlement operations exist, they may bear on both Economic and Political; no such operation was identified for Tuta. Document-scoped absence findings do not establish universal absence.¹⁴