Secure email for business: why and how to choose

Secure email for business

Secure email for business is a mailbox with zero-access encryption: messages and attachments are encrypted on the user's device, and the server stores only ciphertext it cannot read. The key is derived from your password and never leaves the browser. This protects your correspondence even if the server is breached and helps you meet data-protection requirements. Let's cover the threat model, selection criteria, and how it works in YourTrend.

What zero-access means, and why it isn't "TLS"

People often confuse "email encryption" with TLS. TLS protects the channel in transit, but on the provider's server the messages sit in the clear — visible to admins, backups and anyone who reaches the disk. Zero-access (client-side encryption at rest) means only ciphertext ever reaches the server. Even the operator cannot decrypt it. That is a categorically different level: a database leak does not expose message content.

Threat model: what you defend against

Threat	Ordinary email	Zero-access email
Network interception	TLS protects	TLS + client-side encryption
Server breach / leak	Messages readable	Ciphertext only, no key
Insider at the provider	Access to content	No access to content
Legal data request	Plaintext handed over	Only ciphertext can be produced

Be honest about the limits: metadata (who, to whom, when, subject — unless separately encrypted) and trust in the in-browser code remain part of the model. Zero-access sharply narrows the attack surface but does not replace password hygiene and 2FA.

How YourTrend does it

YourTrend secure mail lives at i.yourtrend.online and is built on proven primitives:

SRP-6a — login without sending the password to the server: the server verifies knowledge of the password without receiving it.
Argon2id / PBKDF2 — a strong key derivation from your password, in the browser.
WebCrypto: RSA-OAEP + AES-GCM — hybrid content encryption; your private key is stored encrypted under your password.
Zero-access storage — the server holds only encrypted bodies, keys and attachments.

To reach the outside world, a message to a regular address goes out as a normal DKIM-signed email through the same sending engine, while inbound external mail is clearly marked as unencrypted — so you keep compatibility with Gmail and corporate mailboxes.

How to choose secure email

Real zero-access. The key is derived on the client; the server stores no password and cannot decrypt messages.
Open primitives. Standards (OpenPGP, AES-GCM, Argon2id), not home-grown "military-grade" crypto.
Honesty about metadata. The provider states plainly what is and isn't encrypted.
2FA and recovery. TOTP two-factor and a thought-out lost-password path (a recovery code, not "we reset and read it all").
Compliance. Data-protection clauses in the contract (DPA), access control, logging.
Your own domain. The ability to run secure mailboxes on your corporate domain, not just a shared one.

Compliance and rollout in practice

For business, encryption alone isn't enough — you also need provable controls: restricted access, audit logs, encryption at rest, a data-processing agreement. Zero-access simplifies the regulator conversation, because data minimisation is built into the architecture: the service physically does not hold plaintext content. A practical rollout plan:

Set up secure mailboxes for teams with sensitive correspondence (legal, finance, HR, leadership).
Enable TOTP 2FA and store recovery codes in your corporate secrets manager.
Train the team: strong unique passwords, phishing signs, and that metadata is not encrypted.
Keep ordinary domain email for marketing and notifications, and secure mail for the confidential.

Bottom line: secure email for business is about zero-access and an honest threat model, not marketing "encryption". YourTrend pairs a private perimeter at i.yourtrend.online with ordinary mail and campaigns on your domain — see the features and pricing. Standing up corporate mailboxes on a domain is covered in business email on your own domain.

Limits worth stating honestly

Zero-access is a strong model but not a cure-all, and an honest provider names its boundaries plainly. First, the content is encrypted, not all metadata: sender and recipient addresses, timestamps and (usually) the subject are needed for routing and remain visible to the server. Second, mail to ordinary addresses (Gmail, corporate boxes) goes out as normal — end-to-end encryption works only between users of compatible systems or via the recipient's OpenPGP key. Third, the security of browser cryptography rests on trust in the code the server ships and on the strength of your password: a weak password nullifies the protection, and losing the password without a recovery code means irreversible loss of access to your encrypted mail. So zero-access is a foundation, not a substitute for discipline: strong unique passwords, 2FA enabled and phishing caution remain mandatory. Ordinary corporate mail, meanwhile, is convenient to keep on your own domain — see the domain email guide.