Docs · Security

Security & privacy

Every mailbox you upload has one of three security levels. You choose one when you upload, and can change it later. This page explains what each level actually does — for the full technical and legal detail, see evermail.ai/security.

Choose per mailbox

The three security levels

Full Service

The default. Evermail can decrypt your archive to power search, AI summaries, and viewing in the browser. Data is still encrypted at rest (AES-256) and in transit (TLS). Best search experience and the fastest to set up — most users choose this.

Confidential Processing

You supply the encryption key (BYOK, via your own Azure Key Vault or AWS KMS). Evermail requests access to decrypt content for search and AI, but you can revoke that access at any time, which cuts off decryption immediately. Evermail never stores your master key.

Zero-Access

Your archive is encrypted in your browser before it's uploaded. Evermail's servers only ever receive ciphertext and never hold the key — search runs against encrypted index tokens instead of plaintext. If you lose your key or recovery bundle, the archive cannot be recovered by Evermail or anyone else.

Setup

Choosing and changing a security level

You pick a security level when you upload each archive, and you can set a default for your account during onboarding. To change the level for an existing mailbox, go to that mailbox's settings.

If you choose Zero-Access, download and store the recovery bundle somewhere safe before you continue — you'll be asked to confirm you understand Evermail cannot recover your data without it.

Where your data lives

Data residency & encryption

  • EU-hosted. All data is stored on Azure infrastructure in the EU (West Europe / North Europe). Evermail is operated by Ludoitte Oy, based in Finland.
  • Encrypted at rest. AES-256 via Azure SQL Transparent Data Encryption and Blob Storage server-side encryption.
  • Encrypted in transit. TLS 1.2 or higher for every connection.
  • Tenant-isolated. Your data is logically separated from every other Evermail account at the database and storage level.
  • GDPR-ready. Audit logging on account activity, and export or deletion of your data on request.

Read the full security overview

Technical detail, certifications in progress, and our data processing agreement.

Go to evermail.ai/security →
FAQ

Common questions

Which security level should I choose?
Full Service if you want the fastest setup and the best in-app search and AI experience. Confidential Processing if you want a customer-controlled key you can revoke. Zero-Access if you need the strongest guarantee that only you can ever read your archive, and you're comfortable that losing your key means losing access permanently.
Can I mix security levels across mailboxes?
Yes. Security level is set per mailbox, so you can use Full Service for one archive and Zero-Access for another in the same account.
What happens if I lose my Zero-Access key?
Your data cannot be recovered — not by you, and not by Evermail. This is by design: Evermail's servers never receive your plaintext key, so there's no way for us to unlock the archive on your behalf. Store your recovery bundle somewhere durable, such as a password manager.
Does AI summarization work with Zero-Access?
No — AI summarization requires readable content, so it isn't available on Zero-Access mailboxes. It works normally on Full Service and Confidential Processing.