What's sealed and what isn't

Forward by email seals your mail the moment it reaches us, so only your devices can open it. But email itself isn’t private on the way in. Here is the honest picture.

What it is

When a message arrives at your Paperwise address, our mail handler:

checks the address and, if you use it, your approved-senders list;
seals every attachment, the message text, and the sender, the subject and the file names to your Inbox key;
stores only the sealed result;
drops the readable copy from memory.

“Sealed” means encrypted with a public key whose private half exists only on your devices. Our server can lock the box, but has no key to open it. One of your devices downloads it, opens it, files the items in your vault and then deletes the sealed copy from our server.

When to use it

Read this before you forward something very private, such as a medical result or an ID scan, so you can decide whether email is the right way to bring it in. For the most private papers, scanning them yourself straight into Hidden keeps them on your iPhone from the start.

What isn’t sealed

Email in transit. Email is not end-to-end encrypted. The sender, their email provider, and our mail server at the moment of arrival all see the message. Our promise starts after arrival: from then on, only your devices can open it.

What our server can still see about your mail, even after sealing:

We can see	We can’t see
That a message arrived for your address, when it arrived, its size and its number of parts	The sender, the subject, the file names
Your approved-senders list, in readable form, so we can check incoming mail	The contents and attachments
Your current and past Paperwise addresses
A daily count of mails per account (kept 35 days)

Past addresses are kept, marked retired, so they’re never given to anyone else, also after you delete your account.

Notifications say “New item in your Inbox” unless you turn on Show the sender. Then the sender’s name or address passes through Apple’s notification service. The subject never does. See Email notifications.

Senders can learn a little. Some failures still bounce back to the sender: when your Inbox is full (1 GB waiting), when a message can’t be read, or on a temporary storage error. Someone who triggers one of those can tell your address exists. Messages over 25 MB bounce for every address alike.

Attachments we don’t keep

Some attachments are never stored, because they’re a common way to get malware onto a device:

programs and scripts (for example .exe, .bat, .js, .sh, .apk)
disk images (for example .dmg, .iso)
OneNote files
shortcuts
web pages (.html)
SVG images

Archives (zip, rar, 7z and the like) are kept as they are. Nothing checks what’s inside them, and Paperwise doesn’t warn you about them, so only open an archive if you trust the sender.

Images placed inside the message itself (logos, signatures) aren’t kept either: they’re decoration, not documents.

Senders are checked too: a message that fails the sender checks is marked Unverified sender. See Approved senders.

Free and Pro

Forward by email is part of Pro. If Pro ends, mail sent to your address is discarded as it arrives, not kept for later.

Privacy

To sum up, in order:

On the way to us: readable to the sender’s side and to our mail server, like any email.
On arrival: sealed to your devices’ key straight away; the readable copy is dropped from memory and never written anywhere.
Waiting on our server: only the sealed copy, until one of your devices downloads it, or for at most 30 days.
On your devices: opened and filed into your vault, and encrypted there with Paperwise’s own key, kept in this iPhone’s Keychain, like everything Paperwise stores. If Pro’s Name and sort new scans is on, its text is sent to our AI provider to be named, like anything else you add.

Changes to your Inbox (a new or turned-off address, its settings, the approved senders, removing delivered mail) must be signed with your account key, so someone who only has your Apple sign-in can’t redirect or change it.

The full technical description is in the security whitepaper.

Tips

Turn off Show the sender if your Lock Screen is visible to others.
Turn on Only approved senders if your address starts getting spam.
Forward the email, not a screenshot of it: attachments arrive as the original files.
If your address leaks, Change address in Account → Forward by email. The old one stops working at once.

What if…

What if I forwarded something and an attachment is missing?

It was probably one of the file types we never store, listed above. Save it another way, for example to Files, and import it with + → From Files, if you’re sure it’s safe.

What if I want nothing about my mail on your server at all?

Then don’t use Forward by email. Instead, save attachments from your mail app straight into Paperwise with Save to Paperwise in the share sheet; that never touches our mail server. See Save to Paperwise from any app.

What if I delete my account?

Your account and your waiting (undownloaded) mail are deleted, and your address is retired: it stops working and is never given to anyone else. See Delete your account.