I would certainly hope that no one stores unencrypted mail on their servers, but that&#x27;s just a &quot;promise not to look&quot; situation, not an &quot;impossible to look&quot; situation.<p>As for the &quot;encrypted mailbox&quot;, what you are describing sounds to me like the decryption is done client-side using javascript (unless the recipient needs to download something in order to decrypt the mail), in which case I would consider that to be essentially insecure anyway, as that is also a &quot;promise not to look&quot;. It&#x27;s the same situation as Protonmail, which I personally consider to be crypto snakeoil.