---
title: "Email encryption at rest"
description: "Nextmail seals message bodies, attachments and what you write before storing them, under a key the server holds, so a copy of the database is ciphertext."
url: "https://nextmail.sh/features/at-rest"
---

[Privacy & ownership](https://nextmail.sh/features.md#trust)

# Encryption at rest Sealed before it is stored.

Bodies, attachments and what you write are sealed on the way into storage, so a copy of the database is ciphertext rather than mail.

[Open mail](https://nextmail.sh/mail/inbox) [Get Started](https://nextmail.sh/signup.md)[All features](https://nextmail.sh/features.md)

In short

## What is encryption at rest?

Encryption at rest seals stored data, so a copy taken without the key is unreadable. Whoever holds the key can still read it.

How it works

## Sealed against a copy, not the server

The server holds the key, so a stolen database dump or file copy is ciphertext, while threading, search and summaries still work.

## One rule for what is sealed

Seal what a person wrote or chose, leave what the machine chose. Timestamps and your domain stay readable.

## Search runs on what stays readable

Search reads each thread's sender, subject and the first 4,000 characters of its newest message. Those stay readable for now, so any fragment still matches.

What you get

## In the product today

What is sealed now

Message bodies and attachments, plus notes, summaries, assistant chats, calendar details, rules and the secrets you hand us.

Keys kept apart

Every value is sealed under its own derived key and bound to its field, so one moved elsewhere will not open.

Disk encryption underneath

The storage provider's disk encryption still sits below our own layer.

Good practice

## Getting the most out of it

1. 01
   
   Use end-to-end for secrets
   
   It works between Nextmail addresses with published keys, and seals the body from us.
2. 02
   
   Keep secrets out of subjects
   
   End-to-end encryption leaves subjects readable, and so does the mailbox list, which search runs on.
3. 03
   
   Read the privacy page
   
   It says plainly what the server can read today.

Questions

## Asked often

Keep going

## Works well with

End-to-end encryption

OpenPGP keys made in your browser. Mail you send to another Nextmail address can be sealed before it leaves the tab, and sealed mail addressed to you opens in the reading pane, decrypted on your machine. The keys are never ours to hand over.

Transport encryption

Mail moves over TLS on the hops we run, and transport alone never turns the padlock green, because nothing on this backend can read the transport off a delivery.

Search by words or meaning

Forgiving words, operators like from: and has:, and search by meaning, inside the folder you are reading.

Start

## Your domain, your mail.

Point a domain at Nextmail and read it in a mailbox built around it. The free plan covers one domain.

[Open mail](https://nextmail.sh/mail/inbox) [Get Started](https://nextmail.sh/signup.md)[Read the reference](https://nextmail.sh/docs/knowledge/trust/at-rest.md)