What standard email encryption actually covers
When people say email is encrypted, they usually mean TLS: the connection between two mail servers is encrypted, like a sealed tube between post offices. Gmail uses it automatically, and Microsoft’s Exchange Online uses it whenever the other side supports it. Microsoft’s own documentation puts the limit plainly: TLS encrypts the connection, not the message.
That leaves three gaps that matter for client documents:
- The message is readable where it is stored. At each provider, on both ends, and in their backups.
- Copies multiply. Sent folder, inbox, every synced phone and laptop, every forward and every reply that quotes the original.
- The weak end is often the client’s. A work account the employer can read, a shared family login, an old password reused elsewhere.
True message-level encryption for email exists (S/MIME, Microsoft Purview Message Encryption, Google’s client-side encryption on certain Workspace editions), but it has to be bought and set up, and it often makes the recipient sign in somewhere to read it. Few small firms and fewer clients run it.
A client portal compared with email
| Ordinary email | End-to-end encrypted portal (Brun) | |
|---|---|---|
| Encrypted in transit | Usually (TLS, when both servers support it) | Yes |
| Readable by the provider | Yes, on each provider's servers | No. Encrypted on the sender's device; Brun has no key |
| Copies of the document | Every mailbox and synced device it reaches | One place, removed when you delete the portal |
| Attachment size | 25 MB in Gmail; 20 MB by default in Outlook | 2 GB per file |
| Proof the firm received it | Only if someone replies | Delivered, then Opened by name, shown to the client |
| Signing documents | Print, sign, scan, email back, or a separate tool | Built in, on the same page |
| Everything for one matter in one place | Scattered across threads | Files, signatures, updates and messages together |
| Client effort | None, everyone has email | Open a link. No account, no app |
When email is fine, and when it isn’t
Email is fine for
- Scheduling, reminders and logistics.
- Documents that are already public, like filed pleadings.
- Telling a client that something is waiting for them somewhere safer.
Use a portal for
- IDs, bank and tax records, photos and video evidence.
- Agreements, settlement terms, drafts and advice.
- Anything from a client writing on a work account or a shared device.
That last column is exactly how Brun uses email: its notices to the client say only that something new is waiting, with a link, and carry nothing from the matter. The content itself stays in the encrypted portal.
What a portal doesn’t fix
A portal protects what is sent through it. If a client also forwards your advice from their own email, or screenshots the page, that copy is outside any system’s control. And Brun isn’t an email replacement for the whole firm: it covers the exchange with clients, not your correspondence with courts, opposing counsel or vendors.
Related: how to send sensitive documents securely, what a privilege email disclaimer does, and secure file sharing for law firms.
Sources (checked November 2, 2026): support.google.com/mail/answer/6330403, /7674059, /13317990, /6584; learn.microsoft.com (Exchange Online TLS; Outlook attachment size limits). Gmail and Outlook are trademarks of their owners.