What does it mean for your email to be 'encrypted'? Custodial vs. end-to-end, in plain language

Plenty of email services say your information is "encrypted." It sounds reassuring, but they rarely explain what it means, and not all encryption is the same. It's worth understanding, because it decides who can (and can't) read your email.

This post explains the types of encryption in plain language, and tells you exactly which one nanimail uses. No fine print.

Encryption, in one sentence

Encrypting means turning something readable into something unreadable, so that only someone with the key can turn it back. The whole debate about "encrypted email" comes down, in the end, to a single question: who holds the key?

With that in mind, let's look at the three types that matter.

Encryption in transit

This is the protection while your message travels: from your phone to the server, and from one server to another. It's like sending a letter inside an armored tube along the way.

Today it's the minimum standard, and nearly every serious service uses it, nanimail included. It protects against someone trying to snoop on the connection. But once the message reaches its destination and gets stored, encryption in transit has done its job. What happens next is a separate story.

Encryption at rest

This is how your email is stored once it's sitting on the servers. If someone managed to steal the database, they'd find scrambled, unreadable data, not your messages.

That's how your email is stored at nanimail. We use what's called envelope encryption: each business has its own key for its data, and that key is in turn protected by a master key. It's solid protection, built for a company's email.

End-to-end encryption

This is the one you hear about most, and the one most often misunderstood. In end-to-end encryption, the message is encrypted on the sender's device and only decrypted on the recipient's. Not even the provider in the middle sees the readable content.

It sounds ideal, and for certain uses it is. But with email it has two honest catches worth knowing:

• Email is an open standard. If you write to a customer who uses Gmail, their copy of the message sits in readable text on Google's servers, no matter what you do on your end. End-to-end only works when both sides use the same system, which is uncommon in a business's day-to-day email.
• You give up conveniences you take for granted. Since no one but you holds the key, if you forget your password there's no way to recover access. You also can't search inside your mailbox on the server, spam filtering is limited, and syncing your devices gets harder.

End-to-end has its place. It just isn't free: you pay for it in convenience.

So what is "custodial" email?

A custodial service is one where the provider manages the keys for you. That's exactly what lets you recover your account if you forget your password, search your inbox instantly, filter spam, and keep your email in sync across your phone and computer.

Here's the honest deal: because we manage the keys, we can technically access the content when it's needed to operate the service or comply with the law. We don't pretend otherwise.

What nanimail does, plainly

nanimail is a custodial email service. Your email is stored encrypted at rest, with the envelope encryption described above. It is not end-to-end, and we don't present it as if it were.

Holding the keys is a deliberate decision, not a shortcoming. It's what lets us offer what you expect from professional email: account recovery, search, spam filtering, and sync. In return, your email is protected with care both in transit and at rest.

How to choose

If you handle information so sensitive that not even your provider should ever be able to see it (there are legitimate cases: certain journalism, activism, or very sensitive legal workflows), what you want is a dedicated end-to-end tool, and you accept its limits in exchange.

For running a business, custodial email encrypted at rest is usually the right balance: solid protection without giving up the conveniences that make email simply work.

In short

"Encrypted" isn't one single thing. What really matters is who holds the key and what you get in return. nanimail chose the custodial model on purpose, tells you so up front, and gives you professional email that works: encrypted at rest, operated with care, and built for your business.