Encrypted email for law firms compared. Proton, Tuta, and Microsoft 365.

The threat model for firm email

Law firm email faces three distinct adversaries, and they break different products. The first is the criminal intruder: phished credentials, a quiet mailbox rule forwarding everything out, discovered months later. The second is legal process directed at the provider rather than at you: a subpoena or warrant served on the company hosting the mailbox, sometimes with a gag order, producing whatever the provider can read. The third is the opposing party in litigation, reaching mail through discovery.

Encryption architecture decides adversary two. If the provider holds readable copies, the provider can be compelled to produce them. If the provider holds ciphertext it cannot decrypt, compelled production yields ciphertext. What each channel surrenders under each instrument is mapped in what law enforcement actually gets from client communications; this comparison is about choosing the mailbox itself.

The three contenders

Proton Mail

Swiss provider, zero-access storage: mail at rest is encrypted with keys derived from your password, so Proton cannot read stored messages and cannot produce their content under Swiss legal process. Mail between Proton accounts is end-to-end encrypted automatically. Mail to outside addresses can be sent as a password-protected message the recipient opens in a browser, with expiration.

The honest limits. A message arriving from Gmail exists in plaintext at Gmail before Proton encrypts its copy, so the protection covers storage and intra-Proton exchange, not the open internet. And Swiss jurisdiction is not immunity: in a documented 2021 case, Proton was compelled by a Swiss order to begin logging the IP address of a specific account. Metadata, recipient addresses, timestamps, remains the compellable layer everywhere. For a solo practice or small firm, Proton with custom domain is the lowest-friction zero-access option, and its calendar and storage products keep the rest of the practice inside the same boundary.

Tuta

German provider, formerly Tutanota, and architecturally the most aggressive of the three: it encrypts message bodies, subject lines and calendar entries, where Proton leaves subjects readable, and since 2024 it layers post-quantum algorithms onto its protocol. Pricing undercuts Proton at every tier.

Germany is the catch. German courts have ordered the company to give authorities access to future unencrypted incoming mail on specific monitored accounts, a documented 2018 precedent. Stored encrypted mail stayed unreadable, which is the architecture doing its job, but the case is a reminder that a provider obeys its courts, whatever the marketing says. Tuta also has no IMAP, so it does not coexist with Outlook-based workflows: it replaces them.

Microsoft 365 with Purview

The platform most firms already run, and the only one of the three built for the compliance half of legal practice: litigation hold, retention policies, eDiscovery, audit logs, data loss prevention rules that stop a paralegal from mailing a settlement sheet to the wrong domain. Purview Message Encryption wraps outbound mail in rights management that controls forwarding and supports expiration.

None of it is zero-access. Microsoft operates the encryption and holds the keys, including under Customer Key, which customers manage but Microsoft uses on their behalf. Microsoft can be compelled, and its own transparency reports document thousands of legal demands answered every year, with content produced under warrant. The CLOUD Act extends US process to data Microsoft holds abroad. M365 is the right tool for governing mail. It is not a tool for making mail unreadable to anyone but the client.

What email cannot do

Email is a 1980s protocol with encryption bolted on, and three failures are structural. Metadata, who wrote to whom and when, stays visible to providers on both ends no matter what you buy. The counterparty problem is absolute: your zero-access mailbox does nothing once the message lands in opposing counsel’s ordinary inbox, and most privilege accidents happen at the recipient. And both Proton and Tuta protect a mailbox, not a matter: documents that need structured access control belong in a client portal or secure file exchange, not in attachments.

For the conversations where privilege exposure is existential, the practical pattern in 2026 is shrinking email to logistics and moving substance to Signal with disappearing messages or a portal the firm controls. The same logic applies to drafting tools: feeding client matter into consumer AI services creates its own privilege problem, documented in your law firm uses ChatGPT, the privilege you are losing.

Verdict by profile

Solo practitioner or small firm building fresh: Proton Mail on a custom domain. Zero-access at rest, password-protected messages for client delivery, and the 2FA and recovery settings locked down on day one.

Privacy-maximalist practice, or one with EU data residency obligations: Tuta, accepting the workflow break and the German jurisdiction trade. The GDPR side of that posture is covered in GDPR compliance for solo lawyers.

Mid-size firm already on Microsoft: stay, and actually deploy Purview: sensitivity labels, DLP on client domains, mandatory encryption rules for matter mail. Accept that Microsoft can read it, document that acceptance in the risk register, and route the exchanges that cannot tolerate it to a separate zero-access channel.

Every profile: encrypted email for law firms is one control in a stack. The rest of the stack, devices, backups, breach response, is the subject of our pillar on digital security for lawyers and law firms.

Frequently asked questions

Does encrypted email preserve attorney-client privilege?

Privilege turns on confidentiality being maintained and reasonable precautions being taken, and encryption is strong evidence of reasonable precautions. It does not cure waiver: forwarding privileged mail to the wrong party breaks privilege identically on every platform. Encryption protects against interception, not against conduct.

Can a US subpoena reach a Proton or Tuta mailbox?

Not directly. US process reaches Swiss or German providers through mutual legal assistance, which takes months and requires the request to satisfy local law. What arrives at the provider then hits the architecture: zero-access stored content yields ciphertext. Metadata and anything the provider can read remains producible.

Is S/MIME or PGP on regular email a serious alternative?

Cryptographically yes, operationally no for most firms. Key management falls on every lawyer and every client, one mishandled key breaks the chain, and subject lines plus metadata stay exposed anyway. Firms that tried it tend to end up at a portal or a zero-access provider.

What about the encrypt button in ordinary Outlook?

That is Purview Message Encryption: real protection in transit and against casual forwarding, with Microsoft holding the keys. Against a compelled provider or a compromised tenant it is not in the same category as zero-access architecture. Useful control, wrong label for what it does.

Should client intake forms run through email at all?

No. Intake is the highest-sensitivity moment with the least-established channel, and unencrypted web forms that email submissions to the firm are a recurring breach pattern. Use an encrypted form tool or portal, and keep the resulting record inside the same boundary as the matter file.

---

There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.