How your account and mail are protected

Signing in

Your password, and a second factor: an authenticator app or a security key. Nobody else, administrators included, knows your password.
Mail programs never get your password: each one has an app password of its own, which you can revoke from the panel.
Changes to your account (password, recovery key, new app passwords) are notified to your contact address, outside the platform.

Your stored mail is encrypted with keys that open only with your password, an app password or the recovery key. Administrators do not have them.
It protects disks and backups while the server is off, and against anyone who reads the files without your password.
It does not protect against someone who controls the server while it is running and you are signed in, nor the metadata: senders, recipients, dates, subjects.
If you lose both your password and your recovery key, your stored mail is lost. Nobody will be able to recover it.

For the most sensitive content use end-to-end encryption (OpenPGP) or the platform's encrypted channels.

A forgotten password: the recovery key sets a new one, from the sign-in page.
A lost second factor: sign in with one of your backup codes, if you generated them (Security, Second factor); otherwise the administrators reset it, after checking who you are.
Backup codes stand in for the second factor only; the recovery key stands in for the password, and keeps your mail. They are two different things: keep both.
Both password and recovery key lost: the stored mail cannot be read by anyone any more; the administrators can give you a new, empty mailbox.