We've put a lot of effort into security hardening (e.g. disabled swap entirely, disabled usb-storage devices, disabled core dumps, disabled apport, etc).
[0]: https://github.com/forwardemail/forwardemail.net/blob/ef67fe...
[1]: https://github.com/forwardemail/forwardemail.net/blob/ef67fe...
[2]: https://github.com/forwardemail/forwardemail.net/blob/ef67fe...
[3]: https://github.com/forwardemail/forwardemail.net/blob/ef67fe...
On "matters" - I was distinguishing all of a customer's mailboxes being encrypted together vs their mailboxes being individually encrypted. I was saying that the former is the most useful point of comparison I'd want to see - is my data encrypted separately to other people's - not the latter. But I may not be representative.
Edit: It matters because if someone has access to the filesystem, or our MongoDB database, then they still can't read/write to your email mailbox because they don't have your IMAP password (which we only show to you _once_ for 30 seconds and render in-memory). We use ChaCha20-Poly1305 encryption on the SQLite mailboxes (which is generally considered quantum-secure[0]). Passwords are generated[1] via Node.js `crypto.pbkdf2`.
[0]: https://crypto.stackexchange.com/a/90311 [1]: https://github.com/forwardemail/forwardemail.net/blob/d537fc...