I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ten-bucks-a-month web hosts that also serves their two page website) to transport most of this data.

Is data passing mail-servers not at the same level of risk as the various cloud storage solutions (Dropbox, AWS, etc)?

  • This totally depends what every single person considers an important secret. For someone it's a mail, for someone else it's a file etc.
    – cen
    Commented Dec 20, 2012 at 5:53

3 Answers 3


In the general case I would agree with you that cloud services are no more inherently risky than e-mail providers. Any time you store data with a 3rd party there are security risks, especially if you're using a consumer grade service which doesn't have things like contracts in place where you can specify security/audit requirements.

I'd say that there's a slight difference between e-mail and cloud services in that the programs and servers for e-mail storage and transport are quite mature and most of them will have been through the mill of vulnerability disclosure, whereas a lot of cloud services will be newer codebases that may not have had the same level of scrutiny. Of course that is a bit of a generalisation but may well still hold.


As cen commented, this, like so many security decisions, depends entirely on what you want to protect.

Many organisations keep their mail in house (although anything that needs to travel to a recipient elsewhere has to travel across systems you don't control... )

You need to weigh up your risk appetite and decide what can and what can't be outsourced based on your needs.

  • For a business that collects data via email that travels through out-of-house mail servers, I'm arguing that rejecting other cloud services due security risks is somehow irrational since the data has already been or currently is minimally protected (e.g. copies of the files received by email lay on a IMAP server).
    – Drew Lex
    Commented Dec 20, 2012 at 8:23
  • 2
    Keep in mind that if your "cloud" mail service is hosted in the United States, the emails may be considered a business record, which you automatically lose all rights to.
    – Polynomial
    Commented Dec 20, 2012 at 10:02

I would challenge that using most third party SAAS data storage services are MORE secure than e-mail. Some of them even use encryption on the communication to prevent unauthorized access to the data in transit. E-mail on the other hand offers no such protection in most cases. I think you are running in to the "security concern" of "I don't like it, it is new and I don't understand it." It's unfortunately a fairly common "security" concern.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .