I am evaluating a service provider that performs the following functions with email:
- A user logs in to a web based application over an SSL connection.
- Email is composed in a web browser over the SSL connection.
- The email is then sent to the recipient's account with the same service provider.
- The original email stays on the service provider's systems, and a notification email is sent to an email address that is associated with the recipient's account.
- Recipient logs into their account and reads the email over an SSL connection in their web browser.
- All encryption keys (one-way) are stored on the service provider's systems and are secured with the users' password.
I've come up with a few questions to ask already, such as:
- Can I bring my own keys.
- How can I migrate away from the service provider if need be?
- Are you SOC-2, SOC-3 and/or SAS70 compliant? (Thanks to Jeff Ferland for that!)
- How are the physical grounds of the service's backend secured?
- Are the backend systems disk-level or volume-level secured?
What are some other good questions that an email security provider such as this should be asked?