Vivien: Hi Andreas, thank you so much for joining us today to talk about secure communication for businesses. I’m really looking forward to it! What exactly is CareTeam, and what do you offer?

Andreas Saladin: The CareTeam Practice, based in Basel, Switzerland, was founded in 2023 and was one of the first organizations specializing in psychological psychotherapy, a category that had only recently been established. The practice was founded at a time when a change in Swiss law was taking place - from the delegation model to the referral model. One major change was that psychotherapists in training were no longer allowed to work as employees of psychiatrists. This created a gap and a real problem for these individuals, who are required to gain professional experience within an institution under the supervision of a specialist.

Although psychological psychotherapy has not yet been fully recognized within the Swiss healthcare system, it represents a major step toward autonomy and recognition for the professions of psychology and psychological psychotherapy. What is still lacking today is parity with medical institutions; this is an important step regarding the recognition of years of professional experience, and professional associations are currently working to achieve it.

CareTeam Logo. Image: CareTeam

Vivien: What sets the CareTeam apart?

Andreas Saladin: CareTeam – our name embodies our philosophy. We are a company that thrives on our employees and on our sense of community. Psychotherapy is a demanding profession that requires a great deal of personal commitment. Our organization is not only a framework that enables individuals in continuing education to practice their profession, but also provides administrative support for everyone involved. Lean management – not large investors seeking returns, but an organization led by its founder and operating on the principles of a cooperative. As an organization, we benefit from collective solutions – both economically and in terms of our processes. We are an organization dedicated to serving our employees.

Secure communication in the healthcare sector

Vivien: Why is confidential, secure communication - such as that provided by end-to-end encryption - so important, especially in the healthcare sector?

Andreas Saladin: Data protection is an essential issue in the field of psychotherapy. Under the new General Data Protection Regulation, a data processing agreement is always required. Even though this agreement assigns responsibility, it is, above all, a symbol of trust. In my view, security stems from the approach and the philosophy. Open source and security by design are the key factors here.

Vivien: Why did you choose Tuta instead of, for example, other email providers that are also based in Switzerland?

Andreas Saladin: As the founder of the practice, I faced many challenges - you have to get up to speed on so many different topics. I remember how user-friendly Tuta was; it seemed easy to navigate right away and made my decision simple. I also didn’t want to deal with hosting, updates, troubleshooting, and so on. Outsourcing these tasks to a service provider just makes the most sense.

“I found that Tuta implemented data protection most consistently.”

I deliberately looked for a solution that doesn’t require its own mail servers and isn’t reliant on third-party software. Everything should be consistently designed with data security in mind. In Switzerland, there’s the well-known HIN network - a monopoly in Switzerland that offers additional transport encryption. How security is handled is a trade secret - which means the “security by design” criterion isn’t met because it’s unclear.

Compared to other providers, such as Proton, I was impressed by their consistency -the entire suite of features is built in-house, even the encryption protocol. The quantum-secure encryption fascinated me. Android clients can function without Google Services - I don’t have a complete overview of the market, but Tuta seems to have a unique selling point here.

CareTeam Homepage. Screenshot: CareTeam Hopepage.

How Tuta is used within the organization

Vivien: How did the implementation of Tuta go for you?

Andreas Saladin: All you have to do is create an account, and that’s it - you’re all set. Of course, it takes some getting used to, but Tuta’s client is well-organized and has a logical structure. It’s not cluttered; I got along with it very well.

Vivien: What do you like best about Tuta, or what is its biggest advantage?

Andreas Saladin: Security - that’s Tuta’s biggest advantage. But security in communication remains a very important issue - and one where there’s always more to learn.

Andreas’s Perspective on Security

Andreas Saladin: In my view, “man-in-the-middle” attacks on emails are unlikely, because email servers connect directly to one another without any random intermediate servers. The route is determined via DNS - a directory service that provides the appropriate mail server for each domain. A sender queries the DNS for the recipient’s mail server and connects directly to it. Although the encrypted connection passes through ISPs, Internet nodes, and undersea cables, TLS uses certificates to verify the identity of the destination server. An attacker would have to either manipulate DNS (DNS poisoning) or reroute Internet traffic (BGP hijacking) to intercept traffic. Both methods are extremely complex, are monitored, and usually fail due to the certificate verification process, which exposes fake servers.

In my opinion, one of the biggest security risks is the following:

The email provider can read your messages. Most email providers, such as Gmail, Outlook, GMX, etc., store messages in plain text on their servers, which makes it easier to process, search, and filter spam. As a result, the provider has full technical access to all stored emails. Only providers with zero-knowledge architecture - such as Tuta - encrypt emails in such a way that even they themselves do not have access to the content; such services are the exception.

Another security risk is compromised devices. Spyware, keyloggers, or Trojans on the sender’s or recipient’s computer can intercept emails before they are encrypted or after they have been decrypted. Malware like this often finds its way onto devices through phishing attacks. Even the strongest transport encryption is useless if the end device has already been compromised. In this regard, I trust Tuta’s software the most to make such attacks more difficult. For this reason, we consistently use Linux rather than an American operating system.

In my view, a good email service already provides a higher level of security even without the encrypted version. This is important because a significant portion of everyday communication that doesn’t involve sensitive content takes place without end-to-end encryption. Transport encryption is standard everywhere these days - thankfully.

Vivien: Wow, you’ve really delved deeply into the topic of online security – that’s truly impressive. Thank you so much for this great interview! I hope that our encrypted email solution for your business continues to serve you well, and I look forward to receiving regular feedback on our updates and any missing features you still need.