Optional email encryption
Encryption is optional unless an effective administrator group requires it. Administrator access does not bypass that requirement. Read personal keys and unlock before enabling encryption.
Enable or disable encryption
- Open Settings → Privacy.
- Create a key, or use your existing key.
- Download the private-key backup. Keep it in a secure location.
- Confirm the backup in the application.
- Open Sync Center → Encryption to track conversion.
An existing key enables encryption unless you explicitly opted out. A new key or opt-in starts background conversion of your existing content. An allowed opt-out decrypts the managed content through checked conversion. Required policy prevents opt-out.
| State | Behavior |
|---|---|
| Optional, no key | Mail can work without encryption |
| Required, no key | Work that needs content waits for key setup |
| Enabled | New content is encrypted. Reading needs an active unlock |
| Opt-out in progress | Content that remains encrypted can still need the key |
| Opt-out complete | Converted managed content is readable without the private key |
Progress and recovery
The Encryption tab shows the phase, actual counters, key waits, and retries. An unknown total cannot yield a reliable percentage. Selecting a target state does not complete conversion.
The worker resumes from saved state after restart. Conversion needs neither a reset nor another onboarding run. Missing keys block content work without a plaintext fallback.
Protection limits
This is server-assisted encryption. An authorized backend and selected external language model can receive decrypted content during execution. Search terms in the index remain separate searchable data. This does not make the whole search index secret.
Earlier S3 versions, broker messages, staging copies, and backups have separate retention. Conversion does not erase these copies.