Private Mailbox (end-to-end encryption at rest)

Private Mailbox is an optional upgrade for customers with strict confidentiality needs. When enabled, incoming mail to your mailbox is encrypted with your own certificate the moment it arrives, so that even MyPandos administrators cannot read your stored messages. It is off by default and enabled per mailbox on request.

What it does

• Every new message is encrypted to your S/MIME certificate before it is written to disk. Only someone holding your matching private key can read it — and that key never leaves your control.
• Your mail apps (Outlook, Apple Mail, Thunderbird) decrypt it automatically once your certificate is installed on your device.

What it does not do — please read before enabling

• If you lose your private key, your encrypted mail is gone permanently. Nobody — including MyPandos — can recover it. You are responsible for backing up your key.
• It protects stored message contents. While a message is being delivered, and in the compliance archive (if your plan includes one), it is still processed in readable form. It is not a guarantee that a message is never seen in transit.
• Message subjects, senders, and recipients are not encrypted — only the body and attachments. This is what lets mail still be delivered and filtered.
• Webmail will show encrypted messages as an attachment unless you import your certificate into webmail (which would place a copy of your key on the server and weaken the guarantee). Most Private Mailbox customers read encrypted mail in a desktop or phone app instead.
• Server-side search of message contents stops working for encrypted mail.
• Only mail delivered after you enable it is encrypted; older mail stays as it was.

How to enable it

Contact your MyPandos administrator. You'll provide your public S/MIME certificate (never your private key), confirm you understand the points above, and we enable it on your mailbox. You can get an S/MIME certificate from a provider such as Actalis or Sectigo, or generate one — we can guide you.

Is regular MyPandos mail encrypted?

Yes, at other layers (see “Email security and privacy”). Private Mailbox is the specific option that makes stored mail unreadable even to us.