1) a shared consumer service (i.e. a bunch of gmail accounts in the public namespace)
2) some kind of dedicated-instance-within app service (which seems to be how google apps for your domain works)
3) container/vm based isolation of app service (i.e. a provider who runs dedicated VMs of their own or standard platforms for people...I think some of the hosted exchange options are like this)
4) dedicated servers but with provider retaining root, but a third party or your own staff doing app administration on mail server
5) #4 but without root for provider, but with normal machines and thus singleuser
6) #4/5 with encrypted disk, such that it would be trickier
7) Colo vs. dedicated servers, with full crypto.
8) On-premise
I personally think the correct option for most organizations for mail is absolute-minimum 3, maybe 4. I feel uncomfortable less than 6. For someone like wikileaks, you are abjectly incompetent other than 7 or 8, at least using commodity technology today.
Comments
There's some spectrum between:
1) a shared consumer service (i.e. a bunch of gmail accounts in the public namespace)
2) some kind of dedicated-instance-within app service (which seems to be how google apps for your domain works)
3) container/vm based isolation of app service (i.e. a provider who runs dedicated VMs of their own or standard platforms for people...I think some of the hosted exchange options are like this)
4) dedicated servers but with provider retaining root, but a third party or your own staff doing app administration on mail server
5) #4 but without root for provider, but with normal machines and thus singleuser
6) #4/5 with encrypted disk, such that it would be trickier
7) Colo vs. dedicated servers, with full crypto.
8) On-premise
I personally think the correct option for most organizations for mail is absolute-minimum 3, maybe 4. I feel uncomfortable less than 6. For someone like wikileaks, you are abjectly incompetent other than 7 or 8, at least using commodity technology today.