Is email encrypted? Yes, but probably not in the way the word suggests. Mail between reputable providers is encrypted in transit and usually encrypted at rest, which protects it from interception and from disk theft. Neither stops your provider reading it. That requires end-to-end encryption, which is rarer and carries real trade-offs.
“Secure email” is sold as one thing and is actually three, and the gap between them is where most confusion about email privacy sits. Understanding the difference takes a few minutes and makes it much easier to judge what a provider is actually offering.
The three kinds of encryption
In transit
When a message moves from your provider’s server to the recipient’s, TLS encrypts the connection. Anyone intercepting the traffic in between sees nothing useful. This is now standard between all reputable providers and happens automatically.
The limitation is structural: each server decrypts the message on arrival in order to process and store it. Transit encryption protects the journey, not the destination.
At rest
Most providers also encrypt stored mail, so that someone removing a disk from a data center gets nothing readable. Useful, and again largely automatic.
The limitation is the same one: the provider holds the keys, because they need to decrypt your mail to show it to you, index it for search, and filter spam. Encryption at rest protects against physical theft, not against the provider.
End to end
Here the message is encrypted before it leaves the sender and can only be decrypted by the recipient. No server in between can read it, including your own provider, and including under legal compulsion, because they do not hold the key.
This is what most people picture when they hear “encrypted email”, and it is the least common of the three because the trade-offs are significant.
Why end-to-end is not the default answer
It sounds strictly better, so it is worth being clear about what it costs:
- Both sides need compatible tools. If your recipient is not set up for it, the message either falls back to ordinary email or arrives as something they cannot open.
- Server-side search stops working. The provider cannot index what it cannot read, so finding an old message becomes considerably harder.
- Shared and delegated mailboxes get complicated. Encryption is tied to keys rather than accounts, so info@ handled by three people is an awkward fit.
- Losing the key means losing the mail. There is no provider-side recovery, by design. That is the point, and it is also the risk.
- Metadata is still visible. Who emailed whom, when, and the subject line in many implementations. The content is protected; the pattern is not.
For a narrow set of genuinely high-risk communications this is all worth it. For ordinary business mail it usually is not, and a provider with strong transit encryption and honest terms is the better practical answer.
The question that actually matters
For most businesses the real concern is not whether a sophisticated attacker could intercept mail in transit. It is what the provider does with the content routinely, as a matter of business model.
That is a policy question rather than a technical one, and it is answered in the terms of service rather than the security page. Worth checking specifically:
| Question | Why it matters |
|---|---|
| Is content scanned for advertising? | The commonest commercial use of mailbox content |
| Is content used to train models? | Increasingly common, often added by terms update |
| Is any data shared with brokers? | Including metadata rather than message content |
| Can you export everything and leave? | Determines whether the other answers are negotiable |
| Is there a long-term contract? | Determines how quickly you could act on a terms change |
LiberationTek Email does not scan messages for advertising, model training or data brokers, runs on standard IMAP, SMTP, CalDAV and CardDAV so nothing is locked in, exports in full whenever you want, and has no long-term contract. That combination is the practical answer for most businesses: not a promise that the provider is technically incapable of reading mail, but a commitment about what is done with it, plus the ability to leave immediately if that ever changes.
What actually compromises business email
Worth keeping in proportion. When a business loses control of its email, the cause is almost never that encryption was broken somewhere in transit. It is one of a small number of much more ordinary failures:
- A password reused from a service that was breached. Credentials from unrelated breaches are tested against mail providers constantly, and a reused password makes that trivially successful.
- No two-factor authentication on the account, which turns a correct password into complete access.
- A convincing phishing page that captures the login, often imitating the provider’s own sign-in screen.
- A forwarding rule quietly added by an attacker, which copies mail out for months without anyone noticing. This is worth checking periodically even when nothing seems wrong.
- An old account belonging to someone who has left, still active and still receiving.
None of these are solved by stronger encryption, because none of them involve intercepting anything. They are solved by unique passwords, two-factor authentication on every account, periodic review of forwarding rules and account lists, and removing access promptly when people leave.
This is not an argument against caring about encryption. It is an argument for spending your attention proportionally: the encryption is largely handled for you by any reputable provider, while account hygiene is entirely yours and is where the realistic risk lives.
Sending something genuinely sensitive
When the content really is confidential, the most practical approach is often to not put it in the email at all.
- Share it through a system with access controls and send a notification by email rather than the content itself.
- Use a password-protected file with the password sent by a different channel, such as a phone call. Crude, but widely compatible and effective.
- Use end-to-end encryption where both sides are already equipped for it and the sensitivity justifies the friction.
- Consider whether it needs sending at all. The most secure message is the one that was never transmitted.
For teams that regularly share sensitive files, keeping them in a system with real permissions is better than mailing them around. Hub For Teams combines email, calendar, files, chat and video from $7.49 per user per month on US-owned hardware.
Regulated data
If you handle protected health information, encryption is an addressable specification under HIPAA, meaning you implement it or document why a reasonable alternative is equivalent. In practice that means encrypted transmission and a Business Associate Agreement with your provider. LiberationTek signs a Business Associate Agreement.
Two things worth stating plainly, because a lot of marketing implies otherwise: no vendor can make your organization compliant by itself, and HIPAA certification does not exist. Any provider claiming to sell you either is describing something that is not real.
Frequently asked questions
Is email encrypted?
Partly, and it depends which kind of encryption you mean. Mail between reputable providers is almost always encrypted in transit using TLS, so it cannot easily be intercepted. It is usually also encrypted at rest on the provider storage. Neither prevents the provider itself from reading the message, which requires end-to-end encryption and is much rarer.
What is the difference between encryption in transit and end-to-end encryption?
Encryption in transit protects the message while it moves between servers, but each server decrypts it on arrival, so the providers can read it. End-to-end encryption means the message is encrypted before it leaves the sender and can only be decrypted by the recipient, so no provider in the chain can read it, even under legal compulsion.
Can my email provider read my email?
Technically yes, with standard email, because the message is stored in a form they can decrypt. What matters is what their terms permit them to do with it. LiberationTek does not scan messages for advertising, model training or data brokers, which is a policy commitment rather than a technical impossibility, and the distinction is worth understanding.
Do I need end-to-end encrypted email for my business?
For most businesses, no. End-to-end encryption requires compatible tools at both ends, breaks server-side search, and complicates shared mailboxes and delegated access. It is genuinely necessary for a narrow set of high-risk communications. For ordinary business mail, a provider with strong transit encryption and honest privacy terms is the practical answer.
Is Gmail secure?
It is technically secure in the sense that it uses strong encryption in transit and at rest, and its account protection is excellent. Whether it is private is a different question and depends on what the terms permit the provider to do with your content. Security and privacy are separate properties and a service can be strong on one and weak on the other.
Does HIPAA require encrypted email?
HIPAA requires appropriate safeguards for protected health information and treats encryption as an addressable specification, meaning you must implement it or document why an equivalent alternative is reasonable. In practice, encrypted transmission plus a Business Associate Agreement with your provider is the workable route. LiberationTek signs a Business Associate Agreement. No vendor can make an organization HIPAA compliant on its own, and HIPAA certification does not exist.
What is the most practical way to send something sensitive by email?
Often, not to send it in the body at all. Put it behind a link requiring authentication, or share it through a file system with access controls, and use email only to notify. This sidesteps the compatibility problems of end-to-end encryption while keeping the sensitive content out of mailboxes you do not control.