Almost every email provider calls itself secure. Almost none of them explain what that word covers, and the gap is where people get a false sense of safety. So let’s take the marketing off and look at what’s actually happening to your mail.
There are three different things “encryption” can mean for email, and they protect against three different threats.
1. Encryption in transit
This protects your mail while it travels between servers. When your message hops from your provider to the recipient’s, a transport layer (TLS) scrambles it so anyone tapping the wire in between sees noise, not text.
Transit encryption is essential and, thankfully, now standard. But it only covers the journey. Once a message arrives and is stored, transit encryption has done its job and stepped away. It says nothing about who can read your mail once it’s sitting in a mailbox.
2. Encryption at rest
This protects your mail while it’s stored on disk. If someone walked off with the physical drive, or a backup file leaked, encryption at rest means they’d find ciphertext instead of your inbox.
Also important, also not the whole story. The provider’s own systems still hold the keys, because they have to — the service has to be able to show you your mail when you log in. At-rest encryption defends against stolen hardware and leaked backups. It does not mean the provider can’t read your messages.
3. End-to-end encryption
This is the strong one, and the one most often implied but not delivered. With true end-to-end encryption (E2E), a message is locked on the sender’s device and can only be unlocked on the recipient’s. The provider in the middle — even acting in good faith, even under a court order — genuinely cannot read the contents, because it never holds the keys.
That sounds like the obvious thing everyone should want. So why doesn’t every provider offer it?
The trade-off nobody mentions
End-to-end encryption has a real cost, and it’s worth understanding before you go looking for it.
If the provider can’t read your mail, then the provider can’t do anything with your mail either. No server-side search across your history. No assistant that can triage, summarise, or draft. No spam filtering that learns from content. And it only works end-to-end when the person you’re writing to uses a compatible system too — email to the rest of the world falls back to ordinary encryption anyway.
For some people — journalists, lawyers handling privileged material, activists — that trade is exactly right, and they should use a dedicated E2E tool. For most people and most businesses, giving up search and every modern convenience, on every message, to close a threat model they don’t actually face, is a poor deal dressed up as a strong one.
This is why we’re careful about the claim. A provider that offers search, filtering, or an assistant and also claims “not even we can read your mail” is describing two things that can’t both be true. Honesty here matters more than the badge.
A sane privacy baseline
If pure end-to-end isn’t the right measure for everyday mail, what is? Here’s a baseline worth holding any provider to. It’s less dramatic than a single magic word, and far more useful.
- Jurisdiction you understand. Where are the servers, and whose laws govern them? Data kept in the EU sits under the GDPR, which is a meaningfully stronger footing than “somewhere in the cloud”.
- Encryption in transit and at rest. The two layers above, as table stakes.
- No ads, no profiling, no training. Your messages should never be scanned to target advertising or used to train a model. If the product is free, this is usually where the money comes from.
- Open standards and a real export. IMAP, SMTP, JMAP, your own domain, and the ability to take everything with you. Privacy isn’t only about who reads your mail today; it’s about not being trapped tomorrow.
- Modern authentication. Strong passwords and two-factor, plus the sending-side standards (SPF, DKIM, DMARC) that stop other people forging mail in your name.
None of those need a court order to matter. They’re the difference between a provider that treats your mailbox as yours and one that treats it as inventory.
Where Lettio stands
We’ll say plainly what we are and aren’t. Lettio is not a zero-access, end-to-end provider — because we built in an assistant and agents that work on your mail, our servers can read it, the same as any provider that offers search or filtering. Pretending otherwise would be the exact dishonesty this article is about.
What we promise instead is the baseline above, and we don’t cut corners on it: your mailbox lives on our own servers in the European Union, encrypted in transit and at rest, never mined for ads and never used to train a model. It runs on open standards you can leave with at any time. And when you connect an assistant, sending stays pinned to your own address — an agent can act on your behalf, but never as someone else.
That’s a strong, defensible kind of secure. It just isn’t a magic word, and we’d rather you know the difference.
If that’s the trade you’d make, see exactly what we protect and how.