Tumbleweed Validation Authority Receives IdenTrust Compliant Certification

Tumbleweed and IdenTrust continue their commitment to working together to deliver next generation identity authentication solutions

Redwood City, CA – April 18, 2006 – Tumbleweed® Communications Corp. (NASDAQ:TMWD), a leading provider of email security, managed file transfer, and identity validation appliance and software products, today announced that IdenTrust, Inc., has certified the Tumbleweed Validation Authority™ Server 4.8 as IdenTrust™ Compliant for use by all IdenTrust participants.

IdenTrust, the leader in globally interoperable trusted identity solutions, has deployed the latest version of Validation Authority Server™ to power the IdenTrust Root Responder, the lynchpin of the IdenTrust network. Accepted by financial institutions, government agencies, and commercial organizations spanning five continents, the IdenTrust network provides a worldwide network for the use of trusted credentials based on global standards. The Root Responder at the heart of this network services millions of real-time identity validation requests to verify the identities of IdenTrust participants and assure the integrity of IdenTrust-based transactions.

Tumbleweed Validation Authority enables the IdenTrust Root Responder to operate securely and efficiently, and is the most widely deployed identity validation solution among participating IdenTrust member institutions. IdenTrust participants rely on Validation Authority Server to implement the IdenTrust “four-corner model” whereby their Responders, powered by Validation Authority Server, communicate with each other and the Root Responder to validate the identity of the transacting parties.

“The Root Responder is a critical part of the IdenTrust network, and we have relied on Tumbleweed Validation Authority since we first launched the IdenTrust network,” said Don Johnson, Vice President of Operations at IdenTrust. “Tumbleweed Validation Authority is an extremely stable and robust product that has allowed us to scale to meet the needs of our customers with virtually zero downtime. We were pleased with the new capabilities in the 4.8 release, especially the new certificate authority key rollover and request authorization features. We are encouraging all IdenTrust participants to upgrade to this new release.”

IdenTrust is a leader in trusted identity solutions endorsed by financial institutions, government agencies, and commercial entities. To ensure the integrity of the IdenTrust platform and interoperability among IdenTrust participants, products must be certified to be IdenTrust Compliant by tests demonstrating compliance with IdenTrust specifications and interoperability requirements. IdenTrust Compliant products such as Tumbleweed Validation Authority, enable institutions, government agencies, and commercial organizations to effectively manage the risks associated with identity authentication.

“As business transactions continue to move online, secure business communication over the Internet is critical,” said Joe Fisher, VP Product Management at Tumbleweed. “The IdenTrust Compliant certification assures our customers that our identity validation solutions meet the most rigorous testing and highest industry standards. We are pleased to have earned this most recent IdenTrust Compliant certification, and look forward to our continued relationship with IdenTrust to provide the most effective identity validation solutions available.”

IdenTrust Compliant certification is part of Tumbleweed’s ongoing commitment to obtaining and maintaining independent third-party certification of the Validation Authority product suite. A complete overview of the Tumbleweed Validation Authority product suite certifications can be found at:
http://www.tumbleweed.com/products/validationauthority/compliance.html

About the Tumbleweed Validation Authority
Tumbleweed Validation Authority (VA), the leading identity validation solution, enables banks, governments, and businesses worldwide to secure highly valued and trusted transactions, ranging from corporate network access to multi-million dollar electronic transactions to physical access of military facilities. VA is a fourth-generation product line, offering a comprehensive, scalable, and reliable framework for real-time validation of digital certificates, based on numerous well-accepted international security standards and open technologies. VA is Certificate Authority neutral, compliant with FIPS 140-1, DOD JITC, IdenTrust, and Common Criteria standards, as well as part of the IdenTrust, SWIFT Trust Act, BACS and Global Trust Authority financial trust infrastructures. VA has been deployed by hundreds of customers worldwide for over ten years, including the U.S. Department of Defense and all branches of the U.S. military which utilize VA to check the status of more than 3.5 million Common Access Cards used to secure system and network access, email, and other mission-critical resources.

SAFE HARBOR STATEMENT
Tumbleweed cautions that forward-looking statements contained in this press release are based on current plans and expectations as of the date of this press release, and that a number of factors could cause the actual results to differ materially from the guidance given at this time. These factors are described in the Safe Harbor statement below.

Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to Tumbleweed’s IdenTrust Compliant certification and relationship with IdenTrust, as well as the performance and functionality of Tumbleweed’s products. In some cases, forward-looking statements can be identified by terminology such as “may,” “will,” “should,” “potential,” “continue,” “expects,” “anticipates,” “intends,” “plans,” “believes,” “estimates,” and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed’s Form 10-K filed March 16, 2006.

Tumbleweed assumes no obligation to update information contained in this press release. Although this release may remain available on Tumbleweed’s website or elsewhere, its continued availability does not indicate that Tumbleweed is reaffirming or confirming any of the information contained herein.

About IdenTrust
IdenTrust is the global leader in trusted identity solutions relied upon by global financial institutions, government agencies, and commercial organizations spanning five continents. As the only bank-built identity company that is interoperable with the requirements of global regulatory bodies, IdenTrust provides a worldwide network for the use of trusted credentials based on global standards. IdenTrust not only addresses the technical aspects of trusted identity management, but also provides a legally and globally interoperable environment for authenticating and using identities. The IdenTrust™ Trust Network solution suite consists of a trusted identity blueprint, proven network, delivery and execution capabilities based on a unique understanding of the best combination of technology and unmatched expertise in establishing and managing a trusted identity infrastructure. The IdenTrust platform enables financial institutions, government agencies, and commercial organizations to effectively manage the risks associated with identity authentication; minimize investment in creating their own legal frameworks; and deploy a trusted identity infrastructure smarter, faster and more cost effectively. Additional information about the company may be found at www.IdenTrust.com .

About Tumbleweed Communications Corp.
Tumbleweed provides security solutions for email protection, file transfers, and identity validation that allow organizations to safely conduct business over the Internet. Tumbleweed offers these solutions in three comprehensive product suites: MailGate®, SecureTransport™, and Validation Authority™. MailGate provides protection against spam, viruses, and attacks, and enables policy-based message filtering, encryption, and routing. SecureTransport enables business to safely exchange large files and transactions without proprietary software. Validation Authority is the world-leading solution for determining the validity of digital certificates. Tumbleweed’s enterprise and government customers include ABN Amro, Bank of America Securities, Catholic Healthcare West, JP Morgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St. Luke’s Episcopal Healthcare System, the U.S. Food and Drug Administration, the U.S. Department of Defense, and all four branches of the U.S. Armed Forces. Tumbleweed was founded in 1993 and is headquartered in Redwood City, Calif. For additional information about Tumbleweed go to www.tumbleweed.com or call 650-216-2000.

Tumbleweed, the Arrows logo, MailGate, MailGate Edge, MailGate Email Firewall, SecureTransport, Validation Authority and Validation Authority Server are either registered trademarks or trademarks of Tumbleweed Communications Corp. in the United States and/or other countries. All other trademarks are the property of their respective owners.

###