Security & privacy · 2026-10-17
How does encryption protect your email evidence?
A plain-English guide to HTTPS, encrypted credentials, access permissions and why encryption is not automatically zero-knowledge privacy.
Think of encryption as locking information
Imagine sending a letter in a locked box. Encryption transforms readable information into a form that cannot be understood without the appropriate key. That makes intercepted or stolen copies harder to read.
But the key matters as much as the lock. A system that needs to search or summarise emails may need to decrypt relevant content as part of an authorised operation.
Encryption in transit and encryption at rest
Encryption in transit protects information as it moves between your browser and a service. HTTPS is a familiar example. Encryption at rest protects information while stored, though it can operate at different layers and does not replace access permissions.
MailTrace's published policy describes HTTPS for production connections, encryption of saved OAuth tokens and user-supplied AI provider keys, and authenticated access to private workspaces. Those controls have distinct jobs.
What encryption does not automatically mean
End-to-end encryption generally means only the intended endpoints can decrypt data. Zero-knowledge claims go further and require carefully defined key custody and service access. Neither follows automatically from 'uses encryption'.
An application can use strong encryption and still need authorised server-side access to process selected content. Avoid any claim that absolutely nobody else can ever read data unless the architecture and key management support it.
A fictional security example
Suppose a fictional inbox connection token is encrypted before being stored. If someone copied the database without the key, that token would be much harder to use. That benefit is meaningful.
It would not prove that every email body, every attachment and every backup uses the same encryption design. Each data type and processing path must be verified individually.
How to evaluate a privacy promise
Look for clear answers about HTTPS, stored credentials, access control, key custody, deletion and approved third-party processing. Those details are more informative than broad words such as 'military-grade'.
MailTrace's public privacy policy at /privacy is the reference for currently documented protections. More specific cryptographic claims should be supported by a technical security review.