We store each user's individual mailbox as its own encrypted SQLite database file on an encrypted volume. Even if the volume is decrypted, mailboxes can still not be read. This is the main reason and we detail this in the link we shared.

Another requirement was full text search on the mailboxes with the data itself being encrypted at rest (SQLite fit our needs for that too; not many others provide this). We have a comparison chart at https://forwardemail.net/blog/docs/best-quantum-safe-encrypt....