Are your emails and attachments safe from prying eyes?
Unless you are using a secure email service that respects your privacy, the answer is probably no. Most large email providers, such as Gmail and Yahoo, do not respect the privacy of your inbox. For example,
- Gmail was caught giving third parties full access to user emails and also tracking all of your purchases.
- Advertisers have been allowed to scan Yahoo and AOL accounts to “identify and segment potential customers by picking up on contextual buying signals, and past purchases.”
- Yahoo has been caught scanning emails in real-time for US surveillance agencies.
While Gmail does allow users to opt out of some invasive features, the basic business model of these services revolves around data collection.
Big-name email services put lots of money into security, but they are also large targets and not invulnerable. In March, the big news was the ease with which hackers were able to compromise thousands of Microsoft Exchange email servers. You might well be safer using a smaller, less well-known email service.
Another concern is where your email service is located and how this may affect your data and privacy. Some jurisdictions have laws to protect data privacy (Switzerland), while others have laws in place to erode it (the US and Australia). We’ll cover this in more detail below.
On a positive note, there is a relatively simple solution for keeping your inbox more secure: switch to a secure email provider that respects your privacy.
What is the best secure email service in 2022?
With so many different types of users, there is no single “best secure email” service that will be the top choice for everyone.
While some may prioritize maximum security and strong encryption, others may want convenience and simplicity with user-friendly apps for all devices.
Here are just a few factors to consider when switching to a secure email provider:
- Jurisdiction – Where is the service located and how does this affect user privacy? Where is your data physically stored?
- PGP support – Some secure email providers support PGP, while others do not use PGP due to its vulnerabilities and weaknesses.
- Import feature – Can you import your existing emails and contacts?
- Email apps – Due to encryption, many secure email services cannot be used with third-party email clients, but some also offer dedicated apps.
- Encryption – Are the emails end-to-end encrypted in transit? Are emails and attachments encrypted at rest?
- Features – Some features you may want to consider are contacts, calendars, file storage, inbox search, collaboration tools, and support for DAV services.
- Security – What are the provider’s security standards and policies?
- Privacy – How does the email service protect your privacy? What data is being collected, for how long, and why?
- Threat model – How much privacy and security do you need and which service best fits those needs?
The goal of this guide is to help you find the best secure email solution for your unique needs.
This list is not in rank order. (Choose the best secure email service for you based on your own unique needs!)
Here are the most secure email providers that protect your privacy.
1. Mailfence – Fully-featured secure email in Belgium
| Based in | Belgium |
| Storage | 5-50 GB |
| Price | €3.25/mo. |
| Free Tier | Up to 500 MB |
| Website | Mailfence.com |
Mailfence is a fully-featured secure email provider offering calendar and contacts functionality, file storage, and PGP encryption support. It is based in Belgium, which is a good privacy jurisdiction with strict data protection laws.
For those wanting full PGP control and interoperability, without plugins or add-ons, Mailfence is a solid choice. Whether you are a personal user or you need a secure email solution for your business or team, Mailfence likely has all the features and options you’d want.
While many secure email services sacrifice features and functionality for security, you can have it all with Mailfence. This makes Mailfence a great alternative to full email and productivity suites, such as G Suite or Office 365.
In testing everything out for the Mailfence review, I found it to work very well with an intuitive design, slick layout, and tons of features. Mailfence also offers email and phone support, in addition to cryptocurrency payment options.
+ Pros
- Offers end-to-end encryption and digital signatures
- Mobile and web apps
- Data is stored on Belgian servers
- Offers OpenPGP encryption
- Messages, Documents, Calendar, Contacts, and Groups
- SMTP, POP, and IMAP support
- Can synchronize with other email clients
- Supports password-protected messages with expiration time
- Removes IP addresses from mail headers
- Two-Factor Authentication (2FA) support
- OpenPGP user keystore
- Great user interface (recently updated)
- Cryptocurrency payment options
– Cons
- Logging of IP address and some other data
- Code is not open source
- Risk of EU banning encryption
Website: https://Mailfence.com
See our Mailfence review for more info.
2. Tutanota – Private and secure email in Germany
| Based in | Germany |
| Storage | 1 – 1,000 GB |
| Price | €1.00/mo. |
| Free Tier | Up to 1 GB |
| Website | Tutanota.com |
Tutanota is a Germany-based secure email service run by a small team of privacy enthusiasts, with no outside investors or owners. Although it is not as widely known as ProtonMail, Tutanota is a serious player among secure email providers. Its hybrid encryption system overcomes some of the drawbacks of PGP, and your privacy rights are protected by the GDPR and other pro-privacy EU regulations.
Note: Tutanota claims that their encryption can be updated/strengthened if necessary against quantum-computer attacks.
All messages in your inbox, contacts, and calendar are encrypted at rest on servers in Germany. For sending encrypted emails with Tutanota, you have two options:
- Emailing another Tutanota user, which encrypts everything automatically (asymmetric encryption)
- Emailing an external (non-Tutanota) user with a link to the message and sharing a password key for encrypting/decrypting messages (symmetric encryption).
While Tutanota uses high encryption standards and is arguably one of the most secure email providers anywhere, it also comes with some tradeoffs. This includes no support for PGP, IMAP, POP, or SMTP. Additionally, you cannot import existing emails into your encrypted Tutanota inbox.
To explain why Tutanota does not rely on PGP standards, Tutanota cofounder Matthias Pfau wrote this piece for Restore Privacy readers, Let PGP Die: Why We Need a New Standard for Email Encryption.
If you are looking for a transparent, high-security email provider run by a team of privacy enthusiasts, Tutanota is a solid choice.
+ Pros
- Encrypted messages (including Subject lines) Address Book, Inbox Rules and Filters, Search Index, encrypted at rest and stored on German servers
- Can search body of encrypted messages
- Can send encrypted messages to non-users
- Strips IP address from emails
- Desktop, mobile, and web apps
- Open source code (including mobile apps)
- Great apps for mobile devices
- Free accounts with 1 GB of storage
- Encrypted calendar with iCard support
- Encrypted contacts
- Inbox rules with Spam filter
- Multiple email addresses (aliases)
- Support for custom domains and other price+ features
- Discounts and additional support for non-profits
- Two factor authentication (2FA) support
- Publishes regular Transparency Reports
– Cons
- Does not work with PGP
- Potential delays with account approval
- Currently no way to import existing emails
- Based in a 14 eyes country (Germany)
- Can be affected by EU’s schizophrenic stance on encryption
- Only accepts credit card or PayPal; no cryptocurrency payments
Website: https://Tutanota.com
See our Tutanota review for more info.
3. ProtonMail – Secure email in Switzerland
| Based in | Switzerland |
| Storage | 5-20 GB |
| Price | $4.00/mo. |
| Free Tier | Up to 500 MB |
| Website | ProtonMail.com |
UPDATE: ProtonMail was forced by a Swiss court to log user IP addresses for a specific criminal complaint. Get more info in our article on the ProtonMail logging case here.
ProtonMail is a Switzerland-based email service that enjoys a great reputation in the privacy community. It was started by a team of academics working at MIT and CERN in 2014. Shortly thereafter, it was promoted in American media as “the only email system the NSA can’t access” – which was around the time Lavabit was shut down for not cooperating with the US government.
Looking at the service itself, ProtonMail does a lot of things right. It utilizes PGP encryption standards for email and stores all messages and attachments encrypted at rest on Swiss servers. ProtonMail has a unique feature for “self-destructing messages” and they have also added address verification and full PGP support.
Regarding encryption, however, it’s important to note that ProtonMail does not encrypt subject lines of emails or certain metadata, inherent limitations of the PGP standard. Most of the email services we discuss here use PGP, but I wouldn’t count on any of them to keep me safe from the NSA or their counterparts in other major countries.
Additionally, the ProtonMail search function can only search subject lines within your inbox, but not the actual content of your emails. This is another functional limitation that comes from integrating more encryption and security into the service.
ProtonMail does offer some great apps for mobile devices (Android and iOS). You can also use ProtonMail with third-party apps through the ProtonMail Bridge feature (restricted to paid users).
Overall ProtonMail is a well-regarded email provider and should be a great secure email option for most users. Switzerland remains a strong privacy jurisdiction that is not a member of any surveillance alliances.
In addition to email, the same team also offers a VPN service, which we have tested for the ProtonVPN review.
+ Pros
- End-to-end (E2E) and zero-access encryption for Email, Calendar, and Contact information
- Operates under Swiss jurisdiction
- All data stored on servers in Switzerland
- Apps for Android and iOS mobile devices
- Web client, encryption algorithms, Android and iOS code are all open source
- Support for custom domains
- Strips IP address from emails
- Can be used with third-party email clients through the ProtonMail Bridge feature
- Can import contacts and emails
– Cons
- ProtonMail does not encrypt email subject lines
- Sometimes requires personal information for verification of new accounts
- Above-average pricing
- Incredibly long beta test cycles
- May be forced to log user IP addresses by court order
Website: https://ProtonMail.com/
See our ProtonMail review for more info.
4. Mailbox.org – Private email in Germany
| Based in | Germany |
| Storage | 2 – 100 GB |
| Price | €1.00/mo. |
| Free Tier | None |
| Website | Mailbox.org |
Another Germany-based secure email provider worth considering is Mailbox.org. Not only does it protect your email with top-end security protocols, Mailbox.org is a full-featured email and productivity suite, similar to Office 365. It offers a huge lineup of features: Mail, Calendar, Address Book, Drive (cloud storage), Tasks, Portal, Text, Spreadsheet, Presentation, and Webchat. Despite all the features, the layout and design of Mailbox.org still manages to be user-friendly.
When choosing a secure email provider, you often have to choose between features and security. With Mailbox.org, you can arguably get the best of both worlds. From the security and encryption side, Mailbox.org offers full PGP support and options to easily encrypt all your data at rest on their secure servers in Germany. You can also use Mailbox.org with mobile apps and third-party email clients.
Lastly, Mailbox.org is very affordable, with basic plans starting at only €1 per month and going up for more storage and features. You can pick up a free 30-day trial if you want to test-drive this privacy-focused email provider.
+ Pros
- PGP support (server-side or E2E through Mailvelope app)
- Company and servers located in Germany with strong privacy protections
- HSTS and PFS for messages in transit
- Protected against man-in-the-middle attacks
- Message and spam filters
- Virus protection
- Full text search
- POP, IMAP, SMTP, ActiveSync support
- vCard, CardDAV, CalDav support
- Messages are encrypted at rest
- Supports custom domains
- Mobile apps for some of the Office features
- Open source
– Cons
- No mobile email clients (but can be used with third-party email clients)
- Some tracking during registration
- PGP encryption leaves message subject and metadata exposed
Website: https://Mailbox.org/
Check out our Mailbox.org review for more details.
5. Posteo – Privacy-focused email in Germany
| Based in | Germany |
| Storage | 2 – 20 GB |
| Price | €1.00/mo. |
| Free Tier | None |
| Website | Posteo.de |
Posteo is yet another German email provider that offers a high level of privacy and security for its users. In some respects, it has much in common with Mailbox.org. Both are fully-featured email providers that utilize PGP encryption standards, with similar prices. But in a few key areas, Posteo is a bit different:
- Custom domains are not supported.
- There is no spam folder (all emails are either delivered to your inbox or rejected).
- There’s no trial or free tier (but still quite affordable).
In terms of privacy, Posteo really makes an effort to protect the privacy of its users. IP addresses are automatically stripped from emails, no logs are kept, and they offer strong encryption standards. In short, this email takes security and privacy very seriously.
Posteo also supports completely anonymous registration and anonymous payments – even allowing you to send cash in the mail for no digital trail. (We see this trend with VPN services as well.) And if you pay with a credit card, PayPal, or some other digital method, they manually separate account details from payment info.
+ Pros
- Mail, Calendar, Contacts, and Notes are encrypted at rest with OpenPGP on secure servers in Germany
- Configurable spam filter
- Migration service for moving from another email service to Posteo
- Subject, headers, body, metadata, and attachments are encrypted
- Includes Messages, Calendar, Contacts (Address Book), and Notes
- Completely Open Source
- Strong commitment to privacy, sustainable energy, and other social initiatives
- Self-financed; good track record (operating since 2009)
- No logs, IP address stripping, secure email storage with daily backups
- Allows anonymous (cash) payments
- Supports SMTP, POP, and IMAP protocol + Two-Factor Authentication
– Cons
- Custom domains not supported; no “.com” options available
- No spam folder (spam emails are either rejected or delivered to regular inbox)
- Germany is a 14 Eyes country
- No trial or free version
- Cryptocurrency payments not supported
Website: https://Posteo.de/
See the Posteo review for more info.
6. Runbox – Private and sustainable email in Norway
| Based in | Norway |
| Storage | 1 – 25 GB |
| Price | $1.66/mo. |
| Free Tier | 30 day trial |
| Website | Runbox.com |
Runbox is a long-running private email service in Norway that has been operating for over 20 years. Norway is also a good jurisdiction with a strong legal framework for privacy. All Runbox servers are located in secure Norwegian data centers, running on clean, renewable, hydropower energy.
One unique feature of Runbox is that it gives you 100 aliases to use with your account. Secure file storage is also included, with different pricing tiers. Runbox fully supports SMTP, POP, and IMAP protocols and can be used with third-party email clients. This year they released Runbox 7, which is a webmail client, but they do not offer custom mobile or desktop clients.
Unlike some other secure email providers, Runbox does not have a built-in option for encrypting your entire mailbox. And while you can use PGP with Runbox, it is not yet built into the platform. Another drawback is that Runbox does not offer a built-in calendar, but this feature may be included in Version 7 (when released).
Runbox offers 30 day free trials and makes importing your existing emails simple with the guides on their site.
+ Pros
- IP addresses stripped from messages
- Includes Webmail, Contacts, and Files
- Servers run on renewable energy
- Supports SMTP, POP, and IMAP protocols
- Synchronizes with other email clients
- GDPR compliant
- Norway has strong data protection laws
- 100 email aliases per mailbox
- Custom domain names on some paid accounts
- Numerous payment methods accepted (including cash and cryptocurrencies)
– Cons
- Browser-based; no desktop or mobile apps
- Not open source (but version 7 should have open source client)
- Data not encrypted within the Runbox system or at rest
- No business-specific features
Website: https://Runbox.com
Check out our Runbox review here.
7. CounterMail – Private and secure Swedish email service
| Based in | Sweden |
| Storage | 4 GB+ |
| Price | $4.83/mo. |
| Free Tier | 7 day free trial |
| Website | CounterMail.com |
Next up on our list is CounterMail, a secure email provider based in Sweden. CounterMail has been operating for over 10 years with a philosophy to “offer the most secure online email service on the Internet, with excellent free support.” CounterMail uses OpenPGP encryption with 4,096-bit encryption keys. CounterMail also protects users from identity leaks and Man-In-The-Middle attacks with RSA and AES-CBC encryption on top of SSL.
They also keep no logs and store your mail on diskless servers to protect user privacy. Countermail anonymizes email headers and also strips the sender’s IP address. All emails and attachments are stored encrypted at rest using OpenPGP on servers in Sweden.
While CounterMail is a bit more expensive than some other secure email providers, they explain this price difference comes from using only high-quality servers and implementing strong security measures. It may not have all the frills, but CounterMail is a serious security-focused email provider with a 10+ year track record.
+ Pros
- Supports cryptocurrency payments
- Secure, built-in password manager
- All emails and attachments stored encrypted on no-logs, secure servers in Sweden
- Custom domain support
- Message filter and autoresponder features
- Uses RSA, AES-CBC, and SSL encryption to protect against leaks and MITM attacks
– Cons
- Design and UI feels outdated
- More expensive than other secure email options
https://CounterMail.com
8. CTemplar – An “armored email” service in Iceland
| Based in | Iceland |
| Storage | 1-50 GB |
| Price | $6.00/mo. |
| Free Tier | Up to 1 GB |
| Website | CTemplar.com |
CTemplar is a secure email service based in Iceland, a country with excellent privacy laws. They are worth a test drive, particularly if you can find yourself a free version invitation code. That free version, with its 1 GB of storage, may be all you need. If not, a paid plan should get the job done.
Note that CTemplar is still a relatively young service, with some features still under development. In particular, they are still working on encrypting your metadata and don’t yet have IMAP/SMTP support for third-party clients working.
+ Pros
- Strong encryption standards (4096-bit RSA) with built-in support for end-to-end encrypted emails (using OpenPGPjs)
- 100% open source code
- Based in Iceland, with some of the strongest privacy laws in the world
- Passwords protected by “Zero Knowledge Password” technology
- Zero logs; IP address stripped from emails
- Anonymous signup options (no phone verification)
- Anonymous payment option using Monero
- Self-destructing emails and Dead Man’s Timer
- Can send encrypted emails to non-CTemplar users
- Custom email domains
- Desktop, mobile, and browser apps
- 2FA and anti-phishing support
- 14 day money-back guarantee
– Cons
- Email Subject line only encrypted in paid plans
- Above-average prices
- Metadata not encrypted (work in progress)
- No support for IMAP/SMTP and third-party email clients (work in progress)
Website: https://CTemplar.com
Check out the CTemplar review to see how this service did in our tests.
9. Kolab Now – Fully-featured Swiss email
| Based in | Switzerland |
| Storage | 2 GB+ |
| Price | $5.47/mo. |
| Free Tier | 30 day trial |
| Website | KolabNow.com |
Based in Switzerland, Kolab Now is a private email service offering lots of features and full email suite functionality. A Kolab Now subscription includes email, contacts, calendar, scheduling, collaboration/sharing tools, and cloud file storage. Right now they are running a public beta of their voice and videoconferencing system. All of the features and options make Kolab Now an excellent choice for business users, teams, and privacy-focused individuals.
While Kolab now does offer numerous features and support for all major operating systems and devices, it also does not offer as much encryption for those who want the highest levels of security. End-to-end encryption for emails is not built-in and emails are not stored encrypted at rest.
The price is also on the higher end, especially if you want access to all features and more storage. However, for those wanting a feature-rich email suite hosted in Switzerland, Kolab Now may be a good fit.
+ Pros
- Accepts cryptocurrency payments
- Full support for POP, SMTP, and IMAP
- Switzerland jurisdiction with strong privacy protection
- Full email suite with numerous features to replace Gmail, Office365, etc.
- Support for custom domains, teams, and business users
- End-to-end (E2E) encryption is available, but not built in
– Cons
- Email not encrypted at rest (but stored in high-security Swiss data center)
- Higher price
Website: https://KolabNow.com
10. StartMail – Private email hosted in The Netherlands
| Based in | The Netherlands |
| Storage | 10-20 GB |
| Price | $5.00/mo. |
| Free Tier | 7 day trial |
| Website | StartMail.com |
StartMail is a secure email service brought to you by the team behind Startpage, a private search engine based in the Netherlands. While there was surprising news about System1 investing in Startpage, StartMail is its own unique entity under StartMail B.V. – a company operating under Dutch law in The Netherlands.
The Netherlands is a good jurisdiction for privacy and StartMail aims to keep as little data as possible to run their operations (see privacy policy). Unlike most secure email providers, StartMail handles encryption server-side, rather than in the browser – see their white paper explaining why.
StartMail allows users to utilize PGP encryption with emails also being encrypted at rest on their Dutch servers. One cool feature with StartMail is they give you the ability to create temporary, disposable email addresses “on the fly” to use with different services. IMAP and SMTP are also supported if you want to use StartMail with third-party apps such as Thunderbird.
+ Pros
- Can create temporary, disposable email addresses
- Accepts cryptocurrency payment
- IMAP and SMTP support; can use custom domains
- Headers and IP address stripped from all emails
- Accounts come with 10 GB file storage
– Cons
- No custom mobile apps
- Not open source
- Higher prices
Website: https://www.StartMail.com
11. Soverin – Basic private email in Netherlands
| Based in | The Netherlands |
| Storage | 25 GB |
| Price | €3.25/mo. |
| Free Tier | No |
| Website | Soverin.net |
Soverin provides a basic and private email service at a reasonable price. Plans come with 25 GB of storage and custom domains are supported. All data is stored on servers in Germany. Soverin strips IP addresses from headers while also using strong encryption standards, although email is not stored encrypted at rest by default.
For those wanting a basic private email with lots of storage that is protected by European privacy laws, Soverin may be a good choice. It can also be used with third-party email clients and importing old emails is relatively simple.
+ Pros
- 25 GB of data storage for all plans
- Data protected under Dutch privacy laws and GDPR
- Can be used with third-party email clients
– Cons
- No custom mobile apps
- Not open source
- No built-in encryption options
Website: https://Soverin.net
12. Thexyz – A fully-featured private email service in Canada
| Based in | Canada |
| Storage | 25-100 GB |
| Price | $2.95/mo. |
| Free Tier | No |
| Website | www.Thexyz.com |
Another privacy-focused email service worth noting is Thexyz. It is a secure email and web hosting business based in Canada that offers solutions for businesses and private users. The email arm of Thexyz has been operating since 2009, as explained on the about page. While Canada may not be the best jurisdiction for privacy (Five Eyes), this may not be too concerning depending on your needs and threat model.
Thexyz does offer some great privacy and security features. Accounts come with encrypted cloud storage as well as contacts, calendar, and team collaboration tools. All emails are stored encrypted at rest using AES 256-bit encryption, with double geo-location redundancy. With a basic account, you get unlimited aliases and 25 GB of storage (upgradable to 100 GB). Even with all the perks and features, Thexyz is still very affordable at $2.49/mo with the premium webmail plan.
+ Pros
- Great applications and user interface
- Email encrypted at rest with 256-bit AES
- Subscriptions include calendar, contacts, chat, and encrypted cloud storage
- Unlimited aliases; emails can include up to 50 MB attachments
- Support for custom domains
- Autoresponder, spam filters, and incoming email filtering
- Apps for iOS and Android
- Accounts come with 25 GB of email storage (upgradable to 100 GB)
– Cons
- Based in Canada (not the best privacy jurisdiction)
- Support for end-to-end email encryption is not built-in
Website: https://www.thexyz.com
Worth mentioning
Aside from the secure email services we discussed above, we are also keeping our eye out for new services emerging into this niche.
CyberFear Anonymous Email
CyberFear is an anonymous e-mail service in Poland that has caught our attention. It does not serve ads or log IP addresses, while also offering full encryption on par with our other recommendations. Here is an overview of CyberFear:
- End-to-end encryption of emails and metadata
- At rest, all of the following email elements are encrypted: email body, subject line, attachments, sender address, recipient address
- Anonymous registration with only username and password
- No IP logs
- Offshore servers (Poland)
- Cryptocurrency payments supported
- TOR support (Onion address is cyberfear4hlcsac.onion)
- Disposable aliases
- Custom domains supported
- No external scripts nor captchas
- 2 factor authentication option
- PGP support
- Sending encrypted emails outside (will require password to decrypt)
- Option to host CyberFear frontend on your own computer
- Push notifications
- Open source frontend (and backend coming soon)
So far, CyberFear is looking good. You can learn more on their website here.
Email jurisdiction and data privacy
Where your email service is located (jurisdiction) can seriously impact the security of your data. Depending on your threat model, this could be a major consideration. For an overview of jurisdiction and privacy, you may want to read our article on the Five/9/14 Eyes surveillance alliances.
Here are some reasons to pay attention to jurisdiction.
United States (leading member of the Five Eyes)
Tech companies in the US can be forced to give government agencies direct access to their servers for “extensive, in-depth surveillance on live communications and stored information” – as explained in the PRISM surveillance program. Data requests can also be accompanied by gag orders, which forbids the company from disclosing what’s going on (see also National Security Letters).
There are a few known cases of US email providers being forced to give up data. In one prominent example, Lavabit decided to shut down the business rather than give up user data. Another US email provider, Riseup, was also forced to give up data to authorities.
After exhausting our legal options, Riseup recently chose to comply with two sealed warrants from the FBI, rather than facing contempt of court (which would have resulted in jail time for Riseup birds and/or termination of the Riseup organization).
There was a “gag order” that prevented us from disclosing even the existence of these warrants until now. This was also the reason why we could not update our “Canary” [warrant canary that warns users about these events].
Germany (member of the 14 Eyes)
While Germany has long been a rock-solid jurisdiction for privacy-focused tech companies, I’ve noticed some troubling trends recently:
- In January 2019, a German court ruled that Posteo must log IP addresses if required by a valid court order. Posteo explained they would not change their system to log all users’ IP addresses, but would comply for specific users, if ordered by a German court.
- In November 2019, a German court ruling forced Tutanota to provide real-time access to unencrypted emails for specific users targeted by a court order. As Tutanota explained, only unencrypted messages sent after the court order was received would be affected.
Europe in General
Once again politicians in Europe are trying to find an excuse to limit or ban the use of encryption by their people. This time around, the argument is that encryption must be banned to fight child abuse. Once again it is up to tech companies including Tutanota and Mailfence to protect the privacy rights of the populace. In April, a group of companies sent an open letter to the European Parliament arguing against the mass surveillance that the elimination of encryption would be meant to enable.
How this will turn out is unclear, but the possibility of the EU banning encryption casts doubts on the viability of any secure email service based in the EU.
We’ll let you know what happens with this.
All email providers must comply with the law
While these examples may seem alarming, the truth is that all email providers must comply with legal requirements in the country they are operating in. For example, ProtonMail, a Switzerland email provider, has also been forced to log IP addresses and disable accounts by valid court orders, as they disclose in their transparency report.
(Note: If you are concerned about your email service logging your IP address, then simply use a good VPN service.)
Considering everything, some jurisdictions are much better than others, so choose wisely. As a general rule, I’d still avoid email services in the US, and perhaps other Five Eyes jurisdictions.
Want secure email? Pay for it.
The unlimited “free” email business model is fundamentally flawed. It offers a free service, which is used to collect data and thereby monetize the user and make money on ads. With these privacy-abusing “free” services, you are actually paying for the product with your data.
In contrast, here we recommend privacy-friendly, secure, ad-free email services. While some of these private email services offer limited free subscriptions, you will need to upgrade to a paid plan for more storage and premium features (the freemium business model).
Support good privacy businesses
Fortunately, you can “vote with your dollars” by supporting these privacy-respecting businesses and upgrade to paid accounts. This will help secure email providers to grow, improve, and serve more people with an ethical business model that does not rely on exploiting their users’ data.
Secure email shortcomings and PGP flaws
Most secure email solutions mentioned in this guide utilize PGP for end-to-end encrypted email. PGP, which stands for Pretty Good Privacy and was invented back in 1991 by Phil Zimmermann.
PGP flaws – While PGP is considered a trustworthy, secure encryption method, there have been some flaws in implementing PGP that have made headlines recently – see also the EFAIL vulnerabilities.
While the news did attract lots of attention, the “flaws” were mainly limited to the incorrect implementation of PGP by third parties. To my knowledge, this did not affect the secure email providers mentioned in this guide.
Limited Use – Another fundamental problem with adopting secure email is that few people are willing to go through the hassle of PGP key management, encryption, decryption, etc. There are some solutions, to this, however, and by some measures encrypted email usage continues to grow.
Many providers address this issue by making encryption automatic and seamless. Tutanota, for example, uses built-in AES encryption that automatically encrypts emails between Tutanota users, including headers, subject line, body, and attachments. They also provide a secure, two-way communication contact form called Secure Connect.
Vulnerabilities – Even when using a secure browser, there are still vulnerabilities to consider with browser-based email clients. Phil Zimmermann gave an interview highlighting some of these shortcomings:
“The browser is not a terribly safe place to run code. Browsers have a large attack surface,” he said. Wherever encryption and decryption take place, though, it’s a vast improvement on no encryption. But even encrypting messages may not be enough, depending on the threat model. The very nature of email makes it vulnerable.
“Email has an enormous attack surface,” Zimmermann said. “You’ve not only got cryptographic issues but you’ve got things like spam and phishing and loading images from a server somewhere that might have things embedded inside.”
On a positive note, however, there are many options for securing and hardening your browser – see the secure browser and Firefox privacy guides. Furthermore, most secure email providers offer protection against these attack vectors by blocking email images by default while also utilizing virus filters.
Keep in mind, however, that non-browser email clients can also be problematic – potentially revealing unique information about your operating system (user agent) as well as your IP address and location.
Regardless of these limitations, using a secure email provider will help keep large tech companies from harvesting your email data for third parties.
Secure email vs secure messaging apps
Depending on your threat model, you may also want to consider using secure messaging apps, which do not have all of the vulnerabilities discussed above with email.
We have tested many different encrypted and secure messaging apps and compiled a list of our favorites. Here are a few reviews of some of the best options we’ve tested:
Encrypted messaging apps generally offer a higher level of security over email, plus they are much easier to use than PGP email encryption.
Finally, encrypted messaging apps are also convenient for back-and-forth conversations, document sharing, and collaboration with others. For more information, check out our roundup guide on the best secure messaging apps.
Always use a good VPN with email
One fundamental problem with email is that it can expose your IP address and location to third parties, by design.
While some secure email services strip IP addresses and conceal metadata, many others do not. Even the popular Enigmail encryption plugin, which is used with Thunderbird, was found to be leaking user IP addresses. Some email services may be forced to log user IP addresses by valid court orders, without disclosing any information to the user. We’ve seen this with email providers in the US, Germany, and even Switzerland.
Finally, there’s also the fact that many email services keep logs for security, which may include user IP addresses, connection times, and other metadata. Of course, whenever you have logs, this data could end up with third parties (for various reasons).
To effectively conceal your IP address and location, you can simply use a good VPN service.
A VPN creates a secure tunnel between your device and a VPN server, encrypting your traffic and concealing your real IP address and location. The VPN will encrypt and anonymize your internet traffic, while you carry on with business as usual. Some of the larger providers, such as NordVPN and Surfshark, offer apps for all major devices and large server networks around the world.
Due to the security and privacy benefits a VPN offers, it’s a smart idea to use one whenever you’re online. Internet providers in many countries are recording user browsing history by logging DNS requests. Depending on local laws, this information could then be sold to advertisers or handed to government agencies in countries with mandatory data retention laws. With a VPN, your DNS requests are encrypted and handled by the VPN server and unreadable to your ISP or other parties.
For more info, see these best VPN services.
Conclusion on secure and private email services
Whatever your situation is, using a secure and private email provider is a smart step to protect your data. Gmail, Yahoo, Microsoft, and the other big email players do not place the highest priority on your privacy. Paying for a good email service that values privacy ensures you aren’t paying with your personal data.
Once you switch to one of these email services you will be much more secure. Then all you need to do is avoid non-technical attacks, like the typical email scams that never seem to go away.
See the main privacy tools guide for other privacy and security essentials.
We also have a guide on encrypting email.
And if you want more info on these secure email providers, you could check out the reviews below:
- ProtonMail Review
- Tutanota Review
- Mailfence Review
- Mailbox.org Review
- Hushmail Review
- Posteo Review
- Fastmail Review
- Runbox Review
- CTemplar Review
Have you used one of these secure email providers? Feel free to leave your feedback/review of the service below.
This secure email guide was last updated on January 3, 2022.
Have you guys tested and researched https://www.zoho.com/ ?
Are they privacy friendly as they claim to be?
No, but it looks decent and is outside the US.
Why are there no secure mail options in the US listed here that have servers inside the borders?
Are there any that exist?
If we had a secure email service with servers inside of our country, our privacy rights will be preserved… however the bouncing back and forth between 14+ Eyes Countries (Creepy Uncle Sam and his 13+ weirdo voyeuristic buddies) get to peep on you.
I switched from yahoo mail to using protonmail to avoid account hacks (due to backdoor weaknesses being created for NSA,CIA etc.) and all the data mining from corporate advertisers. However in avoiding the pesky nature of ads popping up from a marketing opportunities skimmed in my personal emails, now my information is subject to the various alphabet agency taxpayer funded creeper programs skimming my emails by bouncing to servers in Switzerland and back into my country.
NSA co-operation
The ‘5-Eyes’: The US, the UK, Canada, New Zealand and Australia
The ‘9-Eyes’: The ‘5-Eyes’ group plus Denmark, Norway, the Netherlands and France
The ’14-Eyes’: The two above groups plus Germany, Sweden, Belgium, Spain, and Italy
https://web.archive.org/web/20131219010450/http://cphpost.dk/news/denmark-is-one-of-the-nsas-9-eyes.7611.html
In 2013, documents leaked by the former NSA contractor Edward Snowden revealed the existence of numerous surveillance programs jointly operated by the Five Eyes. The following list includes several notable examples reported in the media:
PRISM – Operated by the NSA together with GCHQ and the ASD[60][61]
XKeyscore – Operated by the NSA with contributions from the ASD and the GCSB[62]
Tempora – Operated by GCHQ with contributions from the NSA[63][64]
MUSCULAR – Operated by GCHQ and the NSA[65]
STATEROOM – Operated by the ASD, CIA, CSE, GCHQ, and NSA[66]
@Sven,
I know you may be working on updates, but here is some info about CounterMail.
First, they only have room for 20K users. They said they are cycling through old accounts that do not pay but there is a waiting list.
In order to get access you MUST have or know someone who has extra invite codes, or go on a list with no details of when you will get an invite.
They also do not have prices on their website, from what I see.
Their free version is only good for 10 days and you either have to pay for a professional account or lose it completely.
So if you want to use them, they look solid but just be aware you may not be able to unless you know one of the 20K who use it.
https://webmail.countermail.com/register/index.php – Login screen
https://support.countermail.com/kb/faq.php?id=250 – What you can and cannot do with their free account
https://support.countermail.com/kb/faq.php?id=258 – Info on the Invite codes
Interesting, thanks for sharing this info J.M.
You’re welcome.
As an aside, I have been using CTemplar.
They are a diamond in the rough.
Very good but DDOS attacks have hit them a little.
It didn’t break them but I went a few days where my Email was good till about 10:30ish my time to about 3 PM.
After that it was back.
Haven’t had an issue now for about four months until today. But today it was 15 minutes at worst.
No, they are not as polished and I had to piece together cloud storage, email, and a calendar, but it is what it is.
I was asked by Proton what they needed to do and I pointed out they need to run everything on RAM disks and not just not flip the switch to track but not even HAVE a switch to flip.
I am waiting to see what they do. If they fix that, it would be good.
CTemplar said they are working on a Calendar but I have not heard anything back yet.
“ProtonMail has introduced an enhanced email tracking protection system for its web-based email solution that prevents senders from being tracked by recipients who open their messages.”
https://www.bleepingcomputer.com/news/security/protonmail-introduces-a-new-email-tracker-blocking-system/
Very cool, thanks for sharing Mike.
Personally I use SekurMail for sensitive communication. I am really satisfied with it up to now.
Sven, without scouring this website to find exact references, I believe you’ve made negative comments in the past about Fastmail, generally regarding privacy. How is Fastmail any different from ProtonMail, which you have listed here as a recommended email service? And you stated that “All email providers must comply with the law.” So what’s the difference? Thanks.
Hi Vanp, see the Fastmail review for a list of cons. Same goes for the ProtonMail review here.
I’ve tried dozens of “privacy” emails over the years. Right now, I’ve got accounts with about a dozen of them. Some observations:
Elude.in was down for months for some reason. When it came back up, it had deleted my email account. I wrote to them to request reinstatement. They never responded & I lost all my emails. Untrustworthy.
CTemplar.com seems good, but for the premium price, I expect metadata to be completely encrypted. I understand this isn’t the case now. They’ve been planning this for a while but haven’t implemented it… Another strike against CTemplar for me is the limited number of aliases. Yes, you get multiple aliases (like Tutanota), but if they’re spammed and you disable them, they continue to count against your total. Given how fast emails are spammed, this defeats the purpose of aliases for a lot of us. Yes, you can use a burner email service that links to your real email address, but I find this cumbersome and time-wasting after doing it for over a year. I want to manage all my emails addresses from a single login site. And I want receipt/send functions to be seamless–not having to go through a complex set of steps to respond to an email.
I’m trying CyberFear.com. I like what I’ve seen so far, even though their UI is very simplistic. I’m OK with that because the price (for the most basic paid plan) is reasonable, though you don’t get much for it. For example, you get only ONE email alias. I see that you can delete this, so I assume if the address is spammed you can replace it with another (which you can’t do with CTemplar or Tutanota). A big plus is the many formatting options available. You can add links, bullets, numbered lists, alter font and font-size… CyberFear’s support, as others have noted, doesn’t reliably respond to questions–either via email or on their social media pages. They maintain a blog, but I haven’t read anything new in months. Makes you wonder if they’re maintaining the service. Also, it’d be great if they got some reliable third-party audit to verify their claims.
I use both Proton and Tutanota. I’ve been turned off of Proton more and more. I realize lots of people feel their actions are justifiable. I don’t and will be switching ASAP. I trust Tutanota most because it’s been around a long while and I haven’t read much that alarms me about them. They also offer ways to sign up and pay anonymously. I like that, like CyberFear, TN allows you to style your emails. I’ve used TN since they started their service. The only trouble I have with TN is their often slow server access. I’ve even been locked out of my email account several times. Makes me wary of using ONLY TN for email. On the plus side, while TN is based in a 14-Eyes country (Germany), the present German government seems on track for recognizing privacy as a basic right. So maybe this will counter the frightening US-led anti-privacy/anti-encryption legal pushes spreading around the West (and in Australia).
If CyberFear could get an independent security audit, I’d switch over to them as my main email provider and would even invest in a more expensive plan. They seem to check all the security/privacy boxes. Still, trust-but-verify. If they’d responded to their social media communications, people like me would even offer to partially subsidize the cost for an independent audit. Need more research on Poland’s privacy laws. Encouraging that Poland isn’t so far part of the 14 Eyes network–at least that I know of.
Honorable mention: Msg.safe. I MOST like that it’s so easy to create aliases with them. But they’ve admitted they won’t open their code for community review, so you have to trust what they say. I don’t feel comfortable doing that so use them just as a disposable email service. But there are already lots of other options for this out there, so…
Criptext was an excellent option, but then, of course, sketchy folks ruined it for the rest of us. 🙁
I also like what I’ve read about Countermail, but they run an elitist service. You have to be among the rare fortunates to know someone who uses CM already to get an invite. And they admit they have no plans in the near future to open up registration to the rest of us plebes. I wouldn’t support that kind of business. Privacy should be a basic human right, not an entitlement a few lucky people enjoy. Even if CM doesn’t have the human-power to manage a robust email service, they could announce this more tactfully than they do on their website.
High value comment, thanks for sharing.
Great info. Thank you. I have been researching for sometime on these matters for myself and family. Do u have any info on Sekur, i believe they are in Switzerland. Can you recommend a wifi router/ modem?
We have not yet tested out Sekur. We have a guide on VPN routers here, but that’s about it for hardware recommendations.
Hi , what about Elude mail ? (elude.in) . They seem to have great security policies and the data is hosted on Tor servers so that should be even better , am I right ?
.in = India
India has been notoriously suspicious of anyone, even holding a sim card.
Dear Sven, what is your take / opinion on Zoho mail? Is it secure enough to earn a good rating?
We have not tested it yet.
Ok, thank you!
Can/will/are you reviewing Zoho?
Zoho Mail is not end-to-end encrypted but it’s a good option for free and ad-free emails. Another option is Infomaniak.
Good email privacy juristictions:
Iceland
Lichtenstein
Switzerland
Norway
Kaymayan Islands
Company should be headquartered there AND their servers are located there.
Especially the second one. Facilities should be secure and decentralized and or hidden.
if theyre a nonprofit that can also help. should accept monero xmr or cash or giftcard should allow anonymous signup
CTemplar is not an option since it has serious quality issues and poor support. Besides nothing proves what they claim. At least protonmail has years of experience behind them.
And the process to get a ‘free email’ from CTemplar is to send them an email (therefore not anonymous) to require a subscription to their services.
Plus, i have read in many forums the stories about them losing the usernames of their ‘clients’ and not being able to even recognize them…
Ps: Is it Iceland or Seychelles?
Thoughts on icewarp?
I have been following you guys a while and appreciate everything you do. I’m super happy that you make efforts to update previous reviews and content, which I’m sure makes you more hesitant about adding more content/reviews that will then need to be held to the same standards. I wanted to throw another review idea into the ring for consideration when you happen to be in that phase again. The Apple “hide my email” feature seems promising from a completely non IT backgrounded mind, possibly even when combined with other more relatively secure emails? Finding your site helped instill confidence in my own decisions as a casual IT security enthusiast. Since apple dominates a large portion of the mobile phone market and continues to make more and more privacy/security claims it would be extremely helpful to lots of casual visitors to see trustworthy input on how their new features are perceived by you guys who I hold in high regards. I can guess a few of the downsides and cons but I’m curious what you would perceive as true pros if any. Thank you again for all of your hard work, and helping guide us enthusiasts to avoid security pitfalls.
I believe Apple’s Hide My Email only works on iCloud email and is for receiving only. iCloud mail is not end-to-end encrypted as per standard email practice but if you’re invested in Apple’s ecosystem, it’s worth using it for throwaway emails.
What’s ones thoughts on SEKUR ?
Protonmail, Tutanota and Cock.li mentioned on this news article about ongoing case, not told exactly which services have given information, but some have gave:
https://www.is.fi/digitoday/art-2000008363489.html
All it says is that the suspect used these services. It doesn’t state that they gave up information about the user.
DuckDuckGo has a new email protection service that, while in Beta, looks very promising. This is a good step-by-step guide on how to use it and what is involved.
https://www.theverge.com/22609841/duckduckgo-email-spam-prevent-trackers-how-to
Hello, may I ask if your going to do a review on SimpleLogin, an open-source anonymous email provider?
Right now our focus is on getting old content and reviews updated, and also publishing the occasional news story. We are not doing any new reviews at this time.
Greetings Sven. Of the 12, which one is the best overall would you pick?
Have you had a look at Canary Email? I can’t determine if its an app installed on my computer or a web-based/cloud based app….which I don’t want. It’s kind of confusing…in fact they say you can install email accounts (even including ProtonMail…with the bridge) on their app. But how can it be encrypted as a stand alone app? And wouldn’t that conflict with secure email I do use like Startmail and ProtonMail. I’m looking for a good alternative to Apple Mail ON MY COMPUTER so I can separate business and personal into different apps, and thought this might be good….but I’m not so sure. Any thoughts? JC
@john c Unfortunately, I am not familiar with this as I have not used iOS in quite a while. Since you do, the best thing to do would be to contact Canary Mail directly, search the web for forums where people have chatted about a similar issue, ask questions or get assistance from a local Apple Store to at least help you set it up.
Since it involves a Mac computer, I am very certain iCloud is backing up your emails. If so, I would suggest checking your settings and shut this off. One such news source I went to even for troubleshooting issues with my Apple products is 9to5Mac (link below). I suggest you also look there to see if there is an article about your concerns or problems. Good luck!
https://9to5mac.com/
@john c here is a Reddit post on Canary Email from 2 years ago. It doesn’t look good for Canary but, hopefully, things have changed:
https://www.reddit.com/r/privacy/comments/e6mz8m/canary_mail_on_macos_please_read_before_buying/
If not, here’s a list of other clients you can try. Out of all of them, I like Mozilla’s Thunderbird the best. But since Thunderbird is limited to desktop only, YMMV (your mileage may vary).
https://geekflare.com/best-email-clients/
I have been trying several time to open an account with Thunderbird and I always get this message: “Thunderbird failed to find the settings for your email account” so I gave it up
Bit late to the party but does anyone have any thoughts on Novo-Ordo.
I’ve been using them for 2 yrs or so. I’m a bit surprised they haven’t been mentioned.
It is interesting for sure.
The privacy policy doesn’t give a whole lot. It says they keep some info but not what that may be: https://novo-ordo.com/about-us/privacy-policy/
I like the claims to no logs and other details but digging, it seems an aweful lot to send those private emails.
How do you send a self destruction email? Here are the steps:https://novo-ordo.com/email-services/using-sub-rosa-self-destructing-email/
(Under Email Interface).
Then to use the service you can use clients on your computer or web browser.
https://novo-ordo.com/email-services/using-sub-rosa/
There is always questions about security with IMAPs and web browsers.
Outside of these things, there is not a lot of info about the provider.
Hope that helps.
Protonmail sold out to the govt. They lied about privacy and instead of admitting they lied or taking any responsibility, instead they updated their privacy policy because they got caught. What else matters? They don’t deserve voluntary funding.
CTemplar has a great concept and focus, but it’s down all the time. I couldn’t really use the service due to the lack of uptime. Also their mobile app is so bad that it is just unusable. If you’re doing nothing but super duper secure email with their service, well, ok, but the premium cost is nuts for that and I just can’t imagine they will ever make enough money asking those premiums with that kind of downtime. When I looked today during the latest outage, it said their API had 88% uptime.
Mailfence – I signed up, added my domain, validated all the DNS records, but it wouldn’t let me add the domain as an alias even after a few hours. Emailed support, DMed their twitter account (they’re the ones that pointed at their twitter account or I would never have bothered.) Total email outage for me. I finally gave up and added my email to Namecheap for now just to get it flowing again. It took my 3 minutes to get it up and working. Now I’m seeking a refund from Mailfence. Maybe if they can come up with a way to guarantee their service can work I’ll try it again.
So far I’m not so happy with these “secure and private” email service providers.
They all feel like scams.
ProtonMail did not lie or violate their own policies. This is explained in my article on the ProtonMail logging situation here.
As for Mailfence, I have personally found their support, email service (with custom domain), and uptime to be very favorable. You also have many other email provider options for custom domains mentioned in this guide.
Thanks for replying Sven.
I’m still not receiving timely responses from Mailfence. It’s not very encouraging.
I understand your point about Protonmail but the very day the news broke that they had provided IPs to a govt, they updated their privacy policy to not mislead people into thinking they wouldn’t do it. I cannot think of a way to feel better about that to be honest.
I’ve had nothing but problems with Mailfence. 1. There is no way to receive a notification that you have an email. This is a simple thing that should have been put into the software from day one. Their suggestion is to use a third part app that it can synch with. That means you lose all of the security you are paying for to only have one of the other services selling your information and spying on you. 2. I pay for an upgraded account and there is no phone number listed anywhere on their website in spite of them claiming they have phone support. 3. I’ve only been using it a couple of weeks and yesterday I sent an email to someone else and the email I sent was found in my spam folder rather than sent mail? Can’t even begin to understand how that occurred but it did and the person I was emailing never received the email. 4. The turnaround time for assistance through emails is literally days. That’s not acceptable for a service you are paying for and especially when you are unable to send or receive emails due to problems. 5. When I log into the service which I have to do frequently since there is no way to know if you received emails I have to first close a splash screen to get to my emails. Logging in doesn’t take you straight to the emails. Overall I would love to continue using it but I don’t trust it after having emails I sent found in my spam folder. Having no notifications in this day and age was abysmal planning.
Protonmail was also a nightmare. I was in the middle of litigating against an organization and I wasn’t able to open any attachments sent to me by my attorney. I had to keep forwarding them to my gmail account where they opened with no problems. I also have another browser open every time I try to open the email client. Another epic failure. I’ve emailed them for assistance and every 10 days they respond asking me to send screenshots etc. Sorry but I don’t have the luxury of taking 3 years of trying to resolve something that likely could be fixed in 10 minutes if they had phone support.
Tutanota is too wordy. I’m not interested in having to spell out the name of my email address 3 times to people. What a dumb name. As of right now I have yet to find a secure email client that does the basic functions of gmail efficiently.
Any email which requires payment will get to know our identity. I will never use the bitcoin method anyway.
Hence, there is no ideal private email.
What do you think about Regan mail?
I signed up for Cyberfear, paid a yearly fee of $18 USD in crypto-currency. It was a blasted, then next day, website not responded. I wondered what happen to it. I figured maybe they are changing the domain or they are exit-scammed and my $18 is gone. There is no announcement, nothing. I send an email wondering what happening and nothing came up. Hopefully they say anything sooner because I need to access my email account.
@Sven, I respectfully request that you all reconsider your docking ProtonMail for their obeying the court order for turning over the suspect’s metadata to police. ProtonMail has successfully fought off many warrants in the past, but this one was obviously serious enough for the company to comply and aid police.
The suspect in question was under investigation for potential terrorist activities and ProtonMail obviously thought the matter was serious enough to obey the court order. This would fall under their terms of service since they do state they would comply with court orders in certain instances. Plus also ProtonMail’s guarantee of user content privacy was not violated.
Aside from this instance, ProtonMail is a top-notch email service and they should not be penalized for aiding police in what was an investigation into a potentially dangerous suspect. Below is a news report pointing out the suspect in question was apprehended thanks to Proton’s compliance which was issued by a Swiss court. Thank you.
https://www.theverge.com/2021/9/6/22659861/protonmail-swiss-court-order-french-climate-activist-arrest-identification
Hi Mike, I see your points and will take it all into consideration with the next update. However, the article you linked to is actually incorrect in one important aspect. As Proton staff explained to me over the weekend, the suspect in question was already known. In other words, his identity and location were already known to authorities. ProtonMail simply linked his IP address (IP logs) to an email account that had been used by the suspect, which was an important aspect for building a criminal case against this individual for his past activities, which included using a ProtonMail account in alleged criminal endeavors.
And as I pointed out in the article, ProtonMail did not violate their terms or break any promises. The issue I have is that the claims on the website did not seem to line up with the reality of complying with 3,000+ logging requests (so far in 2021 alone!) for various authorities and governments around the world. Anyway, Proton staff has given us more details on the situation and I will consider this going forward with updates and recommendations.
Protonmail is a mess. Can’t open attachments and there is essentially zero support.
This is a good article that I think gives some additional context or details as to what happened with ProtonMail. I admit they handled the P.R. for this incident badly, but what happened would fall under the company’s “extreme cases” circumstances as outlined in ProtonMail’s terms of service. Obviously the suspect was enough of a threat or concern for police to get a warrant for the user’s meta-data.
https://www.cpomagazine.com/data-privacy/request-from-french-police-compelled-protonmail-to-reveal-ip-logs/
Even Telegram will hand over information if the matter is related to terrorism. eg IP address – terrorism as a threshold is getting lower, domestic combatants and terrorists have been even fathers protesting the rape of his daughter at a US school recently. He was labelled as usual by the loony lefty liberals
Very Interesting summary (and enlightening comments. I must admit the rant about google was a delicacy).
However there is one thing that is not clear to me : There seems to be no client where you could opt ‘on the fly’ for encryption…or not. It seems to be either go the full route or leave it altogether. Most of my emails are rather mundane and I do not see the necessity to even bother recipients with it (eg my wife is not particularly tech savvy for one) .
But I might have missed the picture..
Disroot is a nice option too.
Why do you like it?
seems ok – thanks 🙂
Thanks for all this information. I would like to see some human rights criteria added as well. Just being forced to turn over records to government with a court order in the event of a real or suspected crime is not enough. Speaking out against human rights abuses is a crime now in too many countries. When we see the police beating people who are exercising their free human rights, that is not a country I want hosting my email. Germany for one. Which countries respect freedom of speech and freedom of expression? Which servers will not block my subscriptions? Which ones are not serving up censorship?