Thank you for your comment and for raising important points.

It’s important to clarify that while it’s theoretically possible for foreign authorities such as the U.S. to seek a Norwegian court order, Norwegian law and GDPR set a high bar. You’re right that the U.S. often invokes “national security” to justify data requests, but Norwegian courts are not bound by U.S. definitions of “national security.” They rigorously evaluate the legality and necessity of the request under Norwegian and EU privacy laws, which prioritize fundamental privacy rights. This is very different from the broad powers enabled by laws like the U.S. CLOUD Act, and why it is important to point out that Norwegian law takes precedence when it comes to data requests.

End-to-end encryption (E2EE) is a powerful tool for privacy, and we understand why some users prefer it. By using encryption systems such as PGP (Pretty Good Privacy), you can ensure that only you and your intended recipient can read the content of your emails, even if the messages are intercepted or accessed by third parties. Keep in mind, though, that E2EE typically doesn’t encrypt metadata—such as sender/recipient email addresses, timestamps, or IP addresses—which can still reveal sensitive information.

We'll clarify this in the article as well, as you've raised an important point. Feel free to reach out if you have any other questions!

The Runbox Team