Engineering capabilities
- Custom domain and mailbox setup
- Bridge configuration for desktop clients
- SPF, DKIM and DMARC alignment
- Migration planning from existing providers
Backup & Email
Proton Mail
End-to-end encrypted mail used where message confidentiality and jurisdiction are explicit requirements rather than preferences.
Security & hardening
- Zero-access encryption at rest
- MFA and recovery-phrase handling procedure
- Documented limits of encryption when mailing external parties
Proton Mail reference architecture
Encrypted mail with realistic boundaries: internal messages stay end-to-end encrypted, external mail relies on transport security and correct domain authentication.
-
01
DNS & authentication
Custom domain verification precedes any mailbox rollout.
-
02
Organisation
- Custom domain
- User accounts
- Addresses & aliases
Administrative accounts are separated from day-to-day mailboxes.
-
03
Access
- Web app
- Mobile apps
- Proton Bridge
Bridge is used where Outlook or Thunderbird must remain the client.
-
04
Key handling
- Zero-access encryption
- Recovery phrase custody
- MFA
Recovery material is documented and stored offline; losing it means losing the mailbox.
Frequently asked questions
Is all our mail encrypted end to end?
Between Proton accounts, yes. Mail to external providers is encrypted in transit and at rest, but the recipient's provider can read it unless you use password-protected messages or PGP.
Can we keep using Outlook?
Yes, through Proton Bridge on each desktop. It decrypts locally and presents a standard IMAP/SMTP endpoint to the client.
What is the main operational risk?
Recovery. Zero-access encryption means the provider cannot restore an account for you, so recovery phrases must be held securely and tested.
Scope the work before you commit budget
Send the environment details and get an engineered proposal with assumptions, risks and a rollback path.