Email was not designed for confidential material, but it is still the default channel for contracts, medical paperwork, legal correspondence, financial details and internal planning. People who handle that material do not need exotic tools. They need a short set of habits applied every time. This article lists the ones that matter most.
Send less
The safest sensitive data is data that was never sent. Before writing a message, ask whether the recipient needs the detail or whether a reference will do. "The file is in the usual place" carries less risk than the file itself. Avoid restating full account numbers, national identifiers or medical details in replies when a partial value or a case number is enough. Each copy that exists is a copy that can be forwarded, indexed, backed up or leaked.
Address with care
Most misdirected sensitive mail comes from autocomplete. Before sending, read the full recipient address, not just the name. Check the domain against the one you expect. Be deliberate about reply-all, and remove people who do not need the thread when you reply. If a message contains sensitive content and a new recipient is added in a chain, stop and confirm.
Share links, not files
Where possible, send a link to a document held in an access-controlled location instead of attaching it. A link can be revoked, restricted to named people, and in many systems set to expire. An attachment is a permanent copy in every recipient's mailbox and in every device that syncs it. If you must attach a file, remove document metadata first, since authors, revision history and comments often travel with the file.
Keep passwords out of the message
If an encrypted file needs a password, send the password through a different channel from the file. A password in the same thread as the attachment defeats the purpose of encrypting it. The broader case against sending credentials by email is in why you should never email a password.
Encrypt when both sides can
When both parties already use PGP or S/MIME, encrypt the message. Encryption protects the body and attachments so that only holders of the private keys can read them, but it does not hide who is talking to whom or when. Confirm keys out of band before relying on them, especially for a first exchange. Under Account > Encryption on ITProMail, you can manage PGP keys and Web Key Directory publication. The PGP guide explains the setup, and PGP in practice covers day-to-day use.
Audit forwarding and aliases
A forwarding rule is one of the most common ways sensitive mail leaks, and it is easy to forget. Check the forwarding and filter settings on every account you use, and remove any rule that sends copies to an address you no longer control. ITProMail filters live under Account > Filters, and aliases under Account > Aliases. Review both on a fixed schedule, and after any change of role or device.
Clean up deliberately
Deleting a message does not remove it from every place it was stored. On ITProMail, Trash is emptied after 14 days, so anything you delete stays recoverable for a limited period and then goes. Sent items keep copies of what you sent, which is often the copy that matters during an incident. Decide which folders hold sensitive material, and purge them on your own schedule rather than leaving the cleanup to chance.
Protect the devices
- Use a screen lock on every phone and computer that syncs mail, and keep the lock timeout short.
- Turn off notification previews on the lock screen for sensitive accounts.
- Sign out of webmail on shared or borrowed machines, and check the sessions list under Account > Security afterwards.
- Remove mail accounts from devices you sell, return or stop using, and revoke app passwords tied to them.
Strengthen the account
Use a second factor on every mail account. A TOTP app or a FIDO2 key is a meaningful improvement over a password alone. Create a separate app password for each client rather than one shared across devices, so a single revocation cuts off one device without disrupting the rest. The app passwords guide and the security checklist describe the account settings in detail.
A short routine
Pick a few items and repeat them every time: read the full recipient list, prefer links to attachments, check forwarding rules monthly, review sessions and app passwords quarterly, and keep the recovery path documented. Habits like these will not stop a determined attacker, but they remove most of the accidental exposure that happens in day-to-day work.