Most “encrypted email” isn’t actually encrypted from everyone.
Traditional email providers – Gmail, Outlook, even most “secure” webmail – encrypt your data in transit, and sometimes at rest on their servers – but either way, the provider holds the keys. They can read your email, and in the age of AI they have every incentive to.
Data brokers, Recruiters, Big Tech developing products that increasingly involve AI siphoning every available source of information, governments demanding ever-greater mass access – all of these have a front-row seat to your data. Then there’s the ever-present risk of data breaches, rogue employees, contractors and consultants, auditors, and due diligence demands, frequently handled with a cavalier attitude toward your data.
Client-Side Encryption flips that model entirely. Your message is encrypted on your device, before it ever leaves it – using a key that only you and your intended recipient control. By the time your email reaches Gmail’s servers, it’s already ciphertext. Google stores it. Google routes it. Google cannot read it. Not because they promise not to – because they can’t.
How CSE Actually Works – Three Parties, Working Together
CSE isn’t one piece of software. It’s three independent parties, each holding a different piece of the puzzle, so no single party – including us – ever holds enough to read your data alone.
1. The Data Owner (you)
Your device generates a unique encryption key for every message and encrypts the content locally. The plaintext never leaves your machine.
2. The KACLS – Key Access Control List Service
Endeavour’s KACLS manages the encryption keys independently of Google’s infrastructure. It doesn’t see your email content – only key requests, which it grants or denies based on strict, auditable rules.
3. The Identity Provider
Before any key is ever released, the recipient must prove who they are, live, through your organization’s identity provider. No verified identity, no key, no access – every single time.
This three-way separation is the whole point. Google never has the key. Endeavour never has the plaintext. Your Identity Provider never has the content. Each party has exactly what it needs, and nothing more.
Why This Matters Now, More Than Ever
CSE isn’t a new idea – but it’s a newly urgent one. AI systems are being trained on everything they can reach: scraped web content, breached databases, and – increasingly email sitting unencrypted on a provider’s servers. Client-side encryption means there’s nothing there to scrape. Zero-knowledge isn’t just a privacy feature anymore. It’s a defence against a threat model that didn’t fully exist five years ago.
Who Actually Needs This Level of Control?
CSE sounds like enterprise-grade infrastructure because, often, it is. Here’s who relies on it, and why:
Regulated industries. Financial services, healthcare, legal, insurance, and government contractors operate under compliance frameworks — SOC 2, ISO 27001, GDPR, HIPAA, PCI-DSS — that don’t just recommend audit trails, they require them. CSE gives you the ability to prove your access controls work, not just claim they do.
Security teams who don’t take anyone’s word for it. Independent-minded security and compliance teams don’t want to trust a vendor’s dashboard. With SIEM export via secure syslog, your team sees the raw event stream directly, in your own tooling — full visibility, no intermediary.
Companies managing employee offboarding. When someone leaves — especially under difficult circumstances — the ability to instantly cut off access to their entire historical mailbox, not just tomorrow’s inbox, closes a gap most email systems can’t touch. No forgotten data walking out the door on a personal laptop.
Anyone handling M&A, litigation holds, or sensitive IP. When “who could read this, and when” needs to be provably auditable after the fact — not assumed, not reconstructed from memory — CSE’s key-access logs are the record.
Anyone who’s been burned by “we deleted it” not actually meaning deleted. Traditional email lives forever: forwarded, synced across devices, cached in a dozen places you’ve long forgotten about. CSE’s key-gated model means revoking access actually works — because access was never really about the message. It was always about the key.
Why CSE is NOW a MUST for every organization – Big or Small
Why CSE needs to move from enterprise-grade infrastructure to everyday use. Much like the use of SSL/TLS these days you would not think of using the internet unless the website was secure. Yet your email remains unprotected.
We are now living in the Age of AI and data is the new currency. No business should operate without CSE and really all personal email should be protected at the same level. This is the mission of Endeavour – to bring Encrypted Email within reach of every organization.
Imagine an algorithm constantly stalking you and your business activities, constantly trying to trying profit and monetize your work behind your back – that is the reality of the AI Age.
The Bottom Line
Client-Side Encryption is about putting you back in control of your data, your property, your business and your life. It’s not build on promises – its build on a trusted architecture. And you simply cannot operate without it.