Riseup Email: What a Nonprofit, Ad-Free Provider Actually Guarantees

Email is the oldest internet communication protocol still in widespread use, and one of the least private. Standard email travels in plaintext, is stored indefinitely on corporate servers, and is readable by anyone with legal access to that provider. Riseup, the collective that has run communication tools for activists and organizers since 1999, is one of the few long-running alternatives. What follows is drawn from Riseup's own documentation — including the limits they state themselves, which are easy to miss and matter more than the marketing. What Riseup actually encrypts Storage is encrypted per-account. Your emails are encrypted individually on Riseup's servers and can only be unlocked with your password. Riseup states plainly that this means they have no ability to read your stored mail. Incoming mail is encrypted automatically, and decrypted only when you authenticate. This is not end-to-end encryption. Riseup's documentation is direct about it: unless you use the Mailvelope browser extension or your own OpenPGP setup, their system is not end-to-end encrypted. Mail between Riseup users stays encrypted using the at-rest method, but a message travelling to a corporate provider is ordinary email once it leaves. Transport is encrypted where possible. Riseup uses StartTLS between their servers and to other secure providers, protecting against network eavesdroppers. For an activist provider, traffic correlation and metadata analysis is the actual threat model, so see below. What Riseup does not keep No IP logging. Riseup states it does not log the IP addresses of anyone using its services, including email. No IP in outgoing mail. Most providers embed your address in the message headers, letting any recipient approximate your location. Riseup does not. Your user ID is hidden. When using a temporary alias, the originating account is not exposed in the message. You can purge everything from the account management system in a click. Ad-free, phone-free signup. No phone number, no personal details — access is by invite code. The metadata defence The feature worth understanding is delivery to other activist providers over Tor. Messages between participating providers are relayed over Tor onion services rather than normal SMTP relays. This matters because the content of an email being encrypted tells you nothing if an observer can see exactly who is talking to whom, and when. Riseup quotes former CIA director Michael Hayden on the point: we kill people based on metadata. Relay over Tor breaks that correlation for the case where both ends are running participating infrastructure. All services also offer Tor onion services directly, so you can reach Riseup without revealing where you are connecting from. The trade-offs, stated plainly Riseup's own "What you do not get" list is worth reading in full. The main ones: Your password is critical. Because your password is the decryption key, anyone who obtains it can read all your mail. Riseup's advice is blunt: never give anyone your password, and if Riseup asks for it, it is a trick. No recovery if you lose it. Lose your password and your recovery code and nobody can decrypt your mail — including Riseup. That is the feature working as intended, and it is also unforgiving. 1 GB of storage. The quota is small by commercial standards. Riseup suggests downloading mail via a client. Trash auto-deletes after 21 days, spam after 7. No backups of old messages. Keeping your own data safe is your job. Not end-to-end encrypted by default, as covered above. No SLAs. It is a donation-funded collective, not a business with support contracts. Who it suits Riseup email makes sense if you are an activist, organiser, journalist working with sensitive sources, or simply someone who wants ad-free mail that is not readable by a provider — and who is willing to manage a password carefully. It is a poor fit if you need large storage, guaranteed uptime, or hands-on support. Those are real features, and Riseup does not pretend otherwise. Getting started Request an invite at riseup.net — there is no open instant signup. Save your recovery code somewhere safe immediately. There is one at a time; generating a new one invalidates the old. Use a dedicated client. Riseup recommends Thunderbird, which auto-configures from your Riseup address and password. Set a service-specific password for email so a compromise elsewhere does not hand over everything. Learn to recognise phishing. Riseup warns that you will eventually receive a fraudulent message claiming to be from them, and that sender addresses are trivially forged. The bigger picture Riseup is a useful example of a different funding model. As their own mutual aid page puts it, there is no such thing as free email — Gmail, Hotmail and Yahoo make their money from surveillance. Riseup runs on donations, sells no ads, and accepts that its users are a small, self-selected group rather than a growth target. That is why the storage quota is 1 GB and there is no instant signup. It is also the honest answer to why this kind of service cannot compete on features with a company whose business model is your behavioural profile. Get your own mail checked Want to see what metadata your current email exposes? Try Email Header Analysis — it shows the headers a provider attaches to every message you send.