---
title: "Email encryption at rest"
description: "Encryption at rest is planned for OpenEmail, not built: every message field sealed before storage. Today only webhook, DNS and DKIM secrets are sealed."
url: "https://openemail.uk/features/at-rest"
---

[Privacy & ownership](https://openemail.uk/features.md#trust) Soon

# Encryption at rest Planned, not built yet.

The plan: seal every field of a message before it is stored. Today, mail is stored as it arrived.

[Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[All features](https://openemail.uk/features.md)

In short

## What is encryption at rest?

Encryption at rest seals stored data, so a copy taken without the key is unreadable. Whoever holds the key can still read it.

How it works

## Sealed against a copy, not the server

The server would derive the key, so a stolen database dump would be ciphertext and search would still work.

## One rule for what would be sealed

Seal what a person wrote or chose, leave what the machine chose. Timestamps and your domain would stay readable.

## Search would still match fragments

Today it reads up to 4,000 characters of each thread's newest message. Sealed, that text would be scanned where the key is held, with no word index on disk.

What you get

## In the product today

What is sealed now

Webhook signing secrets, DNS provider tokens and DKIM keys, before they are stored.

Keys kept apart

Each kind of secret has its own derived key, so none opens another.

What protects mail today

The storage provider encrypts its disks. We add no layer of our own.

Good practice

## Getting the most out of it

1. 01
   
   Use end-to-end for secrets
   
   It works between OpenEmail addresses with published keys, and seals the body from us.
2. 02
   
   Keep secrets out of subjects
   
   End-to-end encryption leaves subjects readable, and so does storage today.
3. 03
   
   Read the privacy page
   
   It says plainly what the server can read today.

Where it stands

## What is not built yet

Questions

## Asked often

Keep going

## Works well with

End-to-end encryption

OpenPGP keys made in your browser. Mail you send to another OpenEmail address can be sealed before it leaves the tab, and sealed mail addressed to you opens in the reading pane, decrypted on your machine. The keys are never ours to hand over.

Transport encryption

Mail moves over TLS on the hops we run, and transport alone never turns the padlock green, because nothing on this backend can read the transport off a delivery.

Full-text search

Forgiving words and operators like from: and has:, inside the folder you are reading.

Start

## Your domain, your mail.

Point a domain at OpenEmail and read it in a mailbox built around it. The free plan covers one domain.

[Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[Read the reference](https://openemail.uk/docs/knowledge/trust/at-rest.md)