Who can read your email?
Almost every provider encrypts mail on its disks. What matters is who holds the key. Here is each of the 24, grouped by what its own documentation says.
Only you 3
Stored mail is encrypted with keys derived from your password, so the provider can't read it. Mail arriving from Gmail or Outlook is readable on arrival, then encrypted.
Only you, if you switch it on 4
Encrypted storage exists but is off by default. Until you turn it on, the provider holds the keys.
mailbox.orgOptional encrypted mailbox / Guard (PGP-based, keys protected by your password); off by default
MailfenceOnly OpenPGP-encrypted messages (opt-in) are unreadable to Mailfence; other stored mail is encrypted with provider-held keys
PosteoOptional crypto mailbox encrypts the whole mailbox with your password; otherwise encrypted disks (LUKS) with Posteo-held keysPurelymailMail encrypted with your password, unreadable to Purelymail only if password reset is disabled; search indexes may hold partial content (can be turned off)
The provider can 16
Mail is encrypted on disk with keys the provider holds. It can read it, and can be compelled to hand it over.
AOL MailProvider-held keys
FastmailEncrypted at rest with Fastmail-held keys
GmailEncrypted at rest with Google-held keys
GMXProvider-held keys
HEYEncrypted at rest and per-field, but 37signals holds the keys
HushmailEncryption runs server-side; Hushmail can decrypt under a BC court orderiCloud MailEncrypted with Apple-held keys; Advanced Data Protection excludes Mail
Infomaniak MailHybrid model: private keys stay on Infomaniak's infrastructure and are decrypted on the fly in authenticated sessionsKolab NowHardware storage encryption; the optional webmail PGP may keep keys on the server
mail.comProvider-held keys
MigaduAt-rest encryption with Migadu-held keys
Outlook.comEncrypted at rest with Microsoft-held keys (BitLocker plus service encryption)
RunboxFull-disk encryption with Runbox-held keys
Yahoo MailProvider-held keys
Yandex MailProvider-held keys
Zoho MailAES-256 at rest with Zoho-held keys
Not stated 1
The provider's pages don't say clearly how stored mail is encrypted.
The details, provider by provider
Subject lines, mail to people on other services, ads, and where the company is based.
Swipe the table sideways for more columns.
| Provider | Stored mail | Subject lines encrypted | Encrypted mail to outsiders | Mail used for ads | Based in |
|---|---|---|---|---|---|
| Only you | Yes | Yes | No | Estonia | |
| Only you | No | Yes | No | Switzerland | |
| Only you | Yes | Yes | No | Germany | |
| Only you, if you switch it on | Not stated | Not stated | No | Germany | |
| Only you, if you switch it on | No | Yes | No | Belgium | |
| Only you, if you switch it on | Not stated | Not stated | No | Germany | |
| Only you, if you switch it on | Not stated | No | No | United States | |
| The provider can | No | No | Yes | United States | |
| The provider can | No | No | No | Australia | |
| The provider can | No | No | No | United States | |
| The provider can | No | Not stated | Yes | Germany | |
| The provider can | No | No | No | United States | |
| The provider can | No | Yes | No | Canada | |
| The provider can | No | No | No | United States | |
| The provider can | No | Yes | No | Switzerland | |
| The provider can | No | Not stated | No | Switzerland | |
| The provider can | No | Not stated | Not stated | United States | |
| The provider can | Not stated | Not stated | No | Switzerland | |
| The provider can | No | No | No | United States | |
| The provider can | No | No | No | Norway | |
| The provider can | No | Not stated | Yes | United States | |
| The provider can | No | Not stated | Not stated | Russia | |
| The provider can | No | Not stated | No | India | |
| Not stated | No | Yes | No | Netherlands |
Sources (57)
- AOL privacy policyVendor, checked 2026-10-16
- Yahoo privacy hub (covers AOL)Vendor, checked 2026-10-16
- AOL legal FAQVendor, checked 2026-10-16
- Atomic Mail security white paperVendor, checked 2026-10-16
- Atomic Mail privacy policyVendor, checked 2026-10-16
- Fastmail Help: privacyVendor, checked 2026-10-16
- Fastmail transparency reportVendor, checked 2026-10-16
- Google privacy policyVendor, checked 2026-10-16
- Gmail Help: ads in GmailVendor, checked 2026-10-16
- GMX privacy policyVendor, checked 2026-10-16
- GMX data collectionVendor, checked 2026-10-16
- HEY securityVendor, checked 2026-10-16
- 37signals privacy policyVendor, checked 2026-10-16
- Hushmail Help: security analysisVendor, checked 2026-10-16
- Hushmail privacy policyVendor, checked 2026-10-16
- Apple Support: iCloud data security overviewVendor, checked 2026-10-16
- Apple privacy policyVendor, checked 2026-10-16
- Infomaniak news: email encryption (French)Vendor, checked 2026-10-16
- Infomaniak confidentiality policyVendor, checked 2026-10-16
- Kolab Now terms of serviceVendor, checked 2026-10-16
- Kolab Now KB: GDPR complianceVendor, checked 2026-10-16
- Kolab Now FAQ: what does Kolab Now runVendor, checked 2026-10-16
- mail.com privacy policyVendor, checked 2026-10-16
- mail.com data collectionVendor, checked 2026-10-16
- mail.com subpoena informationVendor, checked 2026-10-16
- mailbox.org: about usVendor, checked 2026-10-16
- mailbox.org: legal informationVendor, checked 2026-10-16
- mailbox.org: data protectionVendor, checked 2026-10-16
- Mailfence privacy policyVendor, checked 2026-10-16
- Mailfence KB: who are weVendor, checked 2026-10-16
- Mailfence KB: security analysisVendor, checked 2026-10-16
- Migadu privacyVendor, checked 2026-10-16
- Migadu privacy policyVendor, checked 2026-10-16
- Microsoft Learn: encryption in the Microsoft cloudVendor, checked 2026-10-16
- Microsoft privacy statementVendor, checked 2026-10-16
- Posteo: aboutVendor, checked 2026-10-16
- Posteo privacy policyVendor, checked 2026-10-16
- Posteo transparency reportVendor, checked 2026-10-16
- Proton Mail privacy policyVendor, checked 2026-10-16
- Proton Mail encryption explainedVendor, checked 2026-10-16
- Purelymail docs: securityVendor, checked 2026-10-16
- Purelymail privacy policyVendor, checked 2026-10-16
- Runbox: aboutVendor, checked 2026-10-16
- Runbox privacy policyVendor, checked 2026-10-16
- Runbox transparency reportVendor, checked 2026-10-16
- StartMail: about usVendor, checked 2026-10-16
- StartMail privacy policyVendor, checked 2026-10-16
- StartMail transparency reportVendor, checked 2026-10-16
- Tuta Support: securityVendor, checked 2026-10-16
- Tuta blog: not a honeypotVendor, checked 2026-10-16
- Yahoo privacy policyVendor, checked 2026-10-16
- Yandex privacy policyVendor, checked 2026-10-16
- Yandex Mail terms of useVendor, checked 2026-10-16
- Yandex company: privacyVendor, checked 2026-10-16
- Zoho Mail securityVendor, checked 2026-10-16
- Zoho privacy commitmentVendor, checked 2026-10-16
- Zoho encryptionVendor, checked 2026-10-16