-1

Imagine you are a software solutions company.

One of the solutions you provide are domains, email and forwarding mail to their Gmail accounts.

After we have created a domain and several email accounts and the forwarding to their Gmail personal accounts.

HOW can I formally and technically (not by "trust", and not by a "written contract") assure our clients that we have not more access to their emails after a point?

(I do not care about hosting providers, Gmail, NSA or whatever accessing their mails, I'm talking about ANY simple dev company may access confidential information from their clients!)

3

From how I understand what you are asking, the short answer is: Sorry, you can`t do that.

If you are at any point handling any data from a client (i.e. an email), then there is simply no way you can prove conclusively to that client that you are not at any point keeping a copy of that data. If you did want to keep the customers data, there would simply be to many ways for you to do it discretely for it to be practically possible for a customer to catch you doing it.

In the end, it will therefore come down to a question of trust; you basically have to convince your customers that you do in fact not have any intention of keeping their data, and hope they believe you.

Side note / alternative:

If all you are doing is forwarding mail which is sent to a specific domain, then perhaps providing your customers with a guide to using encryption might help? Then you can tell your customers:

Do this, and you're data will be securely encrypted, no matter where you send it. Now we have no way of knowing the contents of your data. We'll just forward it safely to your personal account for you.

The main catch I can see regarding this is that you could in theory still retain a substantial amount of meta data about your clients. This might for instance include statistics about how many emails have been sent, from and to where/whom they were sent, possibly including server names and IP addresses that may give hints about locations, affiliates, etc.

If this is important, then you're basically back to the question of whether your customers trust you when you presumably claim that you will never keep any such data.

1

With the few details you have provided, the very general answer is to publish an architecture document that describes at what point you do and do not have access to their information. In this document, you would outline the data flow and the boundaries of your control and where each client's data intermixes (or not).

This document is important. Your customers can audit and compare what you say you do and what you actually do.

4
  • Thanks I'm referring just to what CAN be done technically. For example, I bought a shared hosting in godaddy for my cliente. (Im the company provider). I create some mail accounts, I give them instructions about POP3 AND sending from gmail and the password (that I created by the way). No mater what, after that, if I want (illegal in some countries), I just enter godaddy workspace mail panel and just "lunch" any mail i created. Even when he can always remove mails from server, I can have access and for example, "send copy" to my account. This is a horribly (technical) privacy issue.
    – voskyc
    Jul 27 '15 at 2:57
  • For this, you need to work with GoDaddy - you need to work with the provider to determine what technical controls are possible.
    – schroeder
    Jul 27 '15 at 3:38
  • But more in general, with cpanel in any hosting company, or whatever, is there anyway for the reseller or the "dev company" to "no have more" access to those mails. Or more simply, if I ask you to you to buy some domain for me and create some mail accounts for me. How can you then make sure to me that after a point you have no more factual access to my mails? If you want, we can continue this by chat, if you believe it does not contribute to the general public, bue I believe it will :-)
    – voskyc
    Jul 27 '15 at 3:51
  • That will depend on the capabilities of the cpanel. You need to talk with your provider.
    – schroeder
    Jul 27 '15 at 4:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.