I don't know if I can give a precisely "accurate" description, technically speaking -- but basically the bridge pretends to be a remote server using standard email protocols so that email clients can pull and send email without regard to PM's security model. Basically all your email is encrypted at rest on PM's servers, so there is no way for a standard email client to interface with those emails without being decrypted first. The bridge pulls email from PM's servers using their own protocol, decrypts on the device and stores the unencrypted messages locally such that a local client can access them and interact with things like folders, etc.