diff --git a/app/api/push/preview/route.ts b/app/api/push/preview/route.ts
index 150ce009a..8e48073ba 100644
--- a/app/api/push/preview/route.ts
+++ b/app/api/push/preview/route.ts
@@ -13,6 +13,7 @@ import { rebaseApiUrl } from '@/lib/stalwart/jmap-api';
 import { forwardedClientHeaders, loginClientAddress } from '@/lib/auth/client-address';
 import { DisallowedUrlError } from '@/lib/security/url-guard';
 import { UPSTREAM_JSON_MAX_BYTES, UpstreamBodyTooLargeError, readJsonCapped } from '@/lib/security/capped-body';
+import { serverDevicePolicy } from '@/lib/admin/server-device-policy';
 
 export const runtime = 'nodejs';
 export const dynamic = 'force-dynamic';
@@ -23,6 +24,10 @@ interface ResolvedTarget {
   accountId: string;
   /** See StalwartCredentials.trusted - false routes through the guarded fetch. */
   trusted: boolean;
+  /** The login, for its device policy. */
+  serverUrl: string;
+  username: string;
+  accountName?: string;
   /**
    * Cookie slot of the login that owns the account. Handed back so a click
    * on the notification opens the message in that login: the worker knows
@@ -75,7 +80,7 @@ async function resolveTargetForAccount(accountId: string, forwarded: Record<stri
             Object.prototype.hasOwnProperty.call(session.accounts ?? {}, accountId);
           if (mailAccountId !== accountId && !isSharedAccount) return null;
           return {
-            target: { authHeader: ctx.authHeader, apiUrl, accountId, trusted, slot },
+            target: { authHeader: ctx.authHeader, apiUrl, accountId, trusted, slot, serverUrl, username: ctx.username, accountName: ctx.accountName },
             own: mailAccountId === accountId,
           };
         } catch {
@@ -103,7 +108,7 @@ async function resolveDefaultTarget(creds: StalwartCredentials, forwarded: Recor
   const apiUrl = rebaseApiUrl(session, creds.serverUrl);
   const accountId = session.primaryAccounts?.['urn:ietf:params:jmap:mail'];
   if (!apiUrl || !accountId) return null;
-  return { authHeader: creds.authHeader, apiUrl, accountId, trusted: creds.trusted };
+  return { authHeader: creds.authHeader, apiUrl, accountId, trusted: creds.trusted, serverUrl: creds.serverUrl, username: creds.username, accountName: creds.accountName };
 }
 
 /**
@@ -198,7 +203,20 @@ export async function GET(request: NextRequest) {
     }
 
     const inboxId = inboxBody.ids[0];
-    const emailProperties = ['id', 'threadId', 'from', 'subject', 'preview', 'receivedAt'];
+    // Organisation > Devices > Push without sender and subject, for this
+    // login's scopes (worked out from its own session): the message's
+    // sender, subject and text are never read, so they can't reach the
+    // notification, the push service or the lock screen. Unknown counts as on.
+    const redacted = await serverDevicePolicy({
+      serverUrl: target.serverUrl,
+      authHeader,
+      username: target.username,
+      accountName: target.accountName,
+      trusted,
+    }).then((devices) => devices.pushWithoutContent, () => true);
+    const emailProperties = redacted
+      ? ['id', 'threadId', 'receivedAt']
+      : ['id', 'threadId', 'from', 'subject', 'preview', 'receivedAt'];
 
     if (!inboxId && !requestedEmailId) {
       return NextResponse.json({
@@ -333,10 +351,13 @@ export async function GET(request: NextRequest) {
     // Some servers build the preview from HTML without skipping <style>; a
     // notification that opens on a style sheet says nothing.
     if (email?.preview) email = { ...email, preview: cleanPreview(email.preview) };
+    // Whatever the server sent anyway, only what a click needs goes back.
+    if (redacted && email) email = { id: email.id, threadId: email.threadId, receivedAt: email.receivedAt ?? null };
 
     return NextResponse.json({
       email,
       unreadTotal,
+      ...(redacted ? { redacted: true } : {}),
       ...(target.slot !== undefined ? { slot: target.slot } : {}),
     }, {
       headers: {
diff --git a/lib/__tests__/push-preview-device-policy.test.ts b/lib/__tests__/push-preview-device-policy.test.ts
new file mode 100644
index 000000000..09e389931
--- /dev/null
+++ b/lib/__tests__/push-preview-device-policy.test.ts
@@ -0,0 +1,121 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+// Organisation > Devices > Push without sender and subject, held by the
+// server: the preview route never reads the sender, subject or text of a
+// message for a login the policy covers, so they can't reach the
+// notification. Who is covered comes from the login's own JMAP session,
+// with every non-personal account counted as a group.
+
+vi.mock('next/server', () => ({
+  NextResponse: {
+    json: (data: unknown, init?: { status?: number }) => ({ json: async () => data, status: init?.status ?? 200 }),
+  },
+}));
+vi.mock('next/headers', () => ({ cookies: async () => ({ get: () => undefined }) }));
+vi.mock('@/lib/logger', () => ({ logger: { warn: vi.fn(), error: vi.fn(), debug: vi.fn(), info: vi.fn() } }));
+vi.mock('@/lib/account-utils', () => ({ MAX_ACCOUNT_SLOTS: 1 }));
+
+const login = vi.hoisted(() => ({ username: 'alice@example.org' }));
+vi.mock('@/lib/stalwart/auth-context', () => ({
+  readStalwartAuthContextFromStore: (_store: unknown, slot: number) =>
+    slot === 0 ? { serverUrl: 'https://mail.example.org', authHeader: `Bearer ${login.username}`, username: login.username } : null,
+}));
+vi.mock('@/lib/stalwart/credentials', () => ({ getStalwartCredentials: vi.fn() }));
+
+const policy = vi.hoisted(() => ({ current: {} as Record<string, unknown> }));
+vi.mock('@/lib/admin/config-manager', () => ({
+  configManager: { ensureLoaded: async () => {}, getPolicy: () => policy.current },
+}));
+
+const fetchJmapServer = vi.fn();
+vi.mock('@/lib/stalwart/server-fetch', () => ({
+  fetchJmapServer: (...args: unknown[]) => fetchJmapServer(...args),
+  isTrustedJmapServerUrl: async () => true,
+}));
+vi.mock('@/lib/security/url-guard', () => ({ DisallowedUrlError: class DisallowedUrlError extends Error {} }));
+
+import { DEFAULT_POLICY } from '@/lib/admin/types';
+import { clearServerDeviceSubjects } from '@/lib/admin/server-device-policy';
+
+const SESSION = {
+  apiUrl: 'https://mail.example.org/jmap',
+  primaryAccounts: { 'urn:ietf:params:jmap:mail': 'a' },
+  accounts: { a: { name: 'alice@example.org', isPersonal: true }, g: { name: 'team@example.org', isPersonal: false } },
+};
+
+const json = (data: unknown) => ({ ok: true, json: async () => data, headers: new Headers() });
+
+let emailGets: Array<Record<string, unknown>> = [];
+function mockJmap() {
+  emailGets = [];
+  fetchJmapServer.mockImplementation(async (url: string, init?: { body?: string }) => {
+    if (url.endsWith('/.well-known/jmap') || url.endsWith('/jmap/session')) return json(SESSION);
+    const body = JSON.parse(init?.body ?? '{}') as { methodCalls: [string, Record<string, unknown>, string][] };
+    if (body.methodCalls[0][0] === 'Mailbox/query') return json({ methodResponses: [['Mailbox/query', { ids: ['inbox'] }, 'mb']] });
+    for (const call of body.methodCalls) if (call[0] === 'Email/get') emailGets.push(call[1]);
+    // The server answers with everything, whatever was asked.
+    return json({
+      methodResponses: [
+        ['Email/query', { ids: ['e1'], total: 1 }, 'eq'],
+        ['Email/get', { list: [{ id: 'e1', threadId: 't1', subject: 'Salary list', preview: 'All salaries', from: [{ name: 'Boss', email: 'boss@example.org' }], receivedAt: '2026-11-01T10:00:00Z' }] }, 'eg'],
+      ],
+    });
+  });
+}
+
+async function callRoute() {
+  const { GET } = await import('@/app/api/push/preview/route');
+  const request = { headers: new Headers(), nextUrl: { searchParams: { get: (k: string) => (k === 'accountId' ? 'a' : null) } } };
+  const res = (await GET(request as unknown as Parameters<typeof GET>[0])) as unknown as { status: number; json: () => Promise<Record<string, unknown>> };
+  return { status: res.status, body: await res.json() };
+}
+
+const withDevices = (devices: Record<string, boolean>, scope?: { domains?: string[]; groups?: string[] }) => {
+  policy.current = scope
+    ? { ...DEFAULT_POLICY, scopes: [{ id: 's', label: 'S', match: scope, policy: { organisation: { devices } } }] }
+    : { ...DEFAULT_POLICY, organisation: { devices } };
+};
+
+describe('push preview under "Push without sender and subject"', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    clearServerDeviceSubjects();
+    login.username = 'alice@example.org';
+    mockJmap();
+  });
+
+  it('shows sender and subject when the policy is off', async () => {
+    withDevices({ pushWithoutContent: false });
+    const { body } = await callRoute();
+    expect(body.redacted).toBeUndefined();
+    expect(body.email).toMatchObject({ subject: 'Salary list', from: [{ email: 'boss@example.org' }] });
+  });
+
+  it('neither asks for nor returns sender, subject or text when it is on', async () => {
+    withDevices({ pushWithoutContent: true });
+    const { status, body } = await callRoute();
+    expect(status).toBe(200);
+    expect(body.redacted).toBe(true);
+    expect(body.email).toEqual({ id: 'e1', threadId: 't1', receivedAt: '2026-11-01T10:00:00Z' });
+    expect(emailGets.length).toBeGreaterThan(0);
+    for (const get of emailGets) {
+      expect(get.properties).not.toContain('from');
+      expect(get.properties).not.toContain('subject');
+      expect(get.properties).not.toContain('preview');
+    }
+  });
+
+  it('applies a group scope from the login’s own session, counting every non-personal account', async () => {
+    withDevices({ pushWithoutContent: true }, { groups: ['team@example.org'] });
+    const { body } = await callRoute();
+    expect(body.redacted).toBe(true);
+    expect(JSON.stringify(body)).not.toContain('Salary');
+  });
+
+  it('leaves logins outside the scope alone', async () => {
+    withDevices({ pushWithoutContent: true }, { domains: ['other.example'] });
+    const { body } = await callRoute();
+    expect(body.redacted).toBeUndefined();
+    expect(body.email).toMatchObject({ subject: 'Salary list' });
+  });
+});
diff --git a/lib/__tests__/push-preview-route-ambiguous.test.ts b/lib/__tests__/push-preview-route-ambiguous.test.ts
index 6d2587bd2..f83e8bb77 100644
--- a/lib/__tests__/push-preview-route-ambiguous.test.ts
+++ b/lib/__tests__/push-preview-route-ambiguous.test.ts
@@ -67,6 +67,12 @@ vi.mock('@/lib/security/url-guard', () => ({
   DisallowedUrlError: class DisallowedUrlError extends Error {},
 }));
 
+// The route reads the device policy (Organisation > Devices); none is set here.
+vi.mock('@/lib/admin/config-manager', async () => {
+  const { DEFAULT_POLICY } = await import('@/lib/admin/types');
+  return { configManager: { ensureLoaded: async () => {}, getPolicy: () => DEFAULT_POLICY } };
+});
+
 async function callRoute(accountId: string) {
   const { GET } = await import('@/app/api/push/preview/route');
   const request = {
diff --git a/lib/__tests__/push-preview-route-owner.test.ts b/lib/__tests__/push-preview-route-owner.test.ts
index a1eca1dda..faee32a7f 100644
--- a/lib/__tests__/push-preview-route-owner.test.ts
+++ b/lib/__tests__/push-preview-route-owner.test.ts
@@ -72,6 +72,12 @@ vi.mock('@/lib/security/url-guard', () => ({
   DisallowedUrlError: class DisallowedUrlError extends Error {},
 }));
 
+// The route reads the device policy (Organisation > Devices); none is set here.
+vi.mock('@/lib/admin/config-manager', async () => {
+  const { DEFAULT_POLICY } = await import('@/lib/admin/types');
+  return { configManager: { ensureLoaded: async () => {}, getPolicy: () => DEFAULT_POLICY } };
+});
+
 async function callRoute(accountId: string, emailId: string | null) {
   const { GET } = await import('@/app/api/push/preview/route');
   const request = {
diff --git a/lib/__tests__/push-preview-route.test.ts b/lib/__tests__/push-preview-route.test.ts
index 3fa7e4c53..3880595cb 100644
--- a/lib/__tests__/push-preview-route.test.ts
+++ b/lib/__tests__/push-preview-route.test.ts
@@ -39,6 +39,12 @@ vi.mock('@/lib/security/url-guard', () => ({
   DisallowedUrlError: class DisallowedUrlError extends Error {},
 }));
 
+// The route reads the device policy (Organisation > Devices); none is set here.
+vi.mock('@/lib/admin/config-manager', async () => {
+  const { DEFAULT_POLICY } = await import('@/lib/admin/types');
+  return { configManager: { ensureLoaded: async () => {}, getPolicy: () => DEFAULT_POLICY } };
+});
+
 function jsonResponse(data: unknown) {
   return { ok: true, json: async () => data };
 }
diff --git a/lib/__tests__/sw-push-redacted.test.ts b/lib/__tests__/sw-push-redacted.test.ts
new file mode 100644
index 000000000..7f0477b3f
--- /dev/null
+++ b/lib/__tests__/sw-push-redacted.test.ts
@@ -0,0 +1,54 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import vm from 'node:vm';
+import { describe, it, expect, vi } from 'vitest';
+
+// Organisation > Devices > Push without sender and subject: the preview
+// route answers `redacted` with only the message's ids. The worker then
+// says "New mail", never "(no subject)", and still opens the message.
+const SW_SOURCE = readFileSync(join(process.cwd(), 'public', 'sw.js'), 'utf8');
+
+function loadWorker(preview: Record<string, unknown>) {
+  const listeners = new Map<string, (event: unknown) => void>();
+  const calls: Array<{ title: string; options: Record<string, unknown> }> = [];
+  const self = {
+    location: { href: 'https://mail.example.com/sw.js', origin: 'https://mail.example.com' },
+    addEventListener: (type: string, fn: (event: unknown) => void) => listeners.set(type, fn),
+    skipWaiting: () => {},
+    clients: { claim: () => {}, matchAll: async () => [] },
+    registration: {
+      showNotification: async (title: string, options: Record<string, unknown>) => { calls.push({ title, options }); },
+      getNotifications: async () => [],
+    },
+  };
+  const caches = { open: async () => ({ match: async () => undefined, put: async () => {} }) };
+  const fetchMock = vi.fn(async () => ({ ok: true, json: async () => preview }));
+  const context = vm.createContext({ self, caches, fetch: fetchMock, URL, URLSearchParams, Response, Date, console, AbortController, setTimeout, clearTimeout });
+  vm.runInContext(SW_SOURCE, context);
+  async function push(payload: unknown) {
+    const waits: Promise<unknown>[] = [];
+    listeners.get('push')?.({ data: { json: () => payload }, waitUntil: (p: Promise<unknown>) => waits.push(p) });
+    await Promise.all(waits);
+  }
+  return { push, calls };
+}
+
+const delivery = { kind: 'jmap-email-push', accountId: 'a', emailIds: ['e1'] };
+
+describe('service worker with a redacted preview', () => {
+  it('shows "New mail" and opens the one message', async () => {
+    const { push, calls } = loadWorker({ unreadTotal: 1, redacted: true, email: { id: 'e1', threadId: 't1', receivedAt: null } });
+    await push(delivery);
+    expect(calls).toHaveLength(1);
+    expect(calls[0].title).toBe('New mail');
+    expect(calls[0].options.body).toBe('You have new mail');
+    expect(calls[0].options.data).toMatchObject({ kind: 'email', emailId: 'e1' });
+  });
+
+  it('counts several unread messages without naming any', async () => {
+    const { push, calls } = loadWorker({ unreadTotal: 3, redacted: true, email: { id: 'e1', threadId: 't1' } });
+    await push(delivery);
+    expect(calls[0].title).toBe('New mail');
+    expect(calls[0].options.body).toBe('3 unread messages');
+  });
+});
diff --git a/lib/__tests__/web-push-properties.test.ts b/lib/__tests__/web-push-properties.test.ts
new file mode 100644
index 000000000..50f8399f3
--- /dev/null
+++ b/lib/__tests__/web-push-properties.test.ts
@@ -0,0 +1,12 @@
+import { describe, expect, it } from 'vitest';
+import { EMAIL_PUSH_PROPERTIES } from '@/lib/web-push';
+
+// The emailPush subscription goes through the push service: it may carry
+// ids only. With from, subject or preview here, they would reach the push
+// service around the device policy "Push without sender and subject",
+// whose text the server holds back in app/api/push/preview.
+describe('EMAIL_PUSH_PROPERTIES', () => {
+  it('stays id and threadId', () => {
+    expect([...EMAIL_PUSH_PROPERTIES]).toEqual(['id', 'threadId']);
+  });
+});
diff --git a/lib/admin/server-device-policy.ts b/lib/admin/server-device-policy.ts
new file mode 100644
index 000000000..e4ac81ed5
--- /dev/null
+++ b/lib/admin/server-device-policy.ts
@@ -0,0 +1,100 @@
+/**
+ * The device policies (policy.json `organisation.devices`) as the server
+ * applies them itself, where it can: the push notification text
+ * (app/api/push/preview) and the office editor (app/api/wopi). The browser
+ * talks to the mail server directly for everything else, so those gates
+ * are browser-only (lib/device-policy.ts).
+ *
+ * Who the caller is comes from their own JMAP session, never from the
+ * browser. For these gates every non-personal account in the session
+ * counts as a group (a mailbox another person shared counts too): more
+ * scopes matched means more held back, the safe direction. A session that
+ * can't be read counts the login address alone.
+ */
+
+import { createHash } from 'node:crypto';
+import { configManager } from './config-manager';
+import { DEFAULT_ORGANISATION_POLICY, type OrganisationPolicy } from './organisation-policy';
+import { resolvePolicy, type PolicySubject } from './policy-scopes';
+import { fetchJmapSession } from '@/lib/stalwart/jmap-api';
+
+export type ServerDevicePolicy = OrganisationPolicy['devices'];
+
+export interface DeviceCreds {
+  serverUrl: string;
+  authHeader: string;
+  username: string;
+  accountName?: string;
+  trusted: boolean;
+}
+
+const TTL_MS = 5 * 60 * 1000;
+const CACHE_KEY = Symbol.for('bulwark.serverDeviceSubjects');
+
+// One cache per process, not per bundle copy.
+function cache(): Map<string, { at: number; subject: Promise<PolicySubject> }> {
+  const g = globalThis as typeof globalThis & { [CACHE_KEY]?: Map<string, { at: number; subject: Promise<PolicySubject> }> };
+  g[CACHE_KEY] ??= new Map();
+  return g[CACHE_KEY];
+}
+
+async function readSubject(creds: DeviceCreds): Promise<PolicySubject> {
+  const email = (creds.accountName || creds.username || '').trim().toLowerCase();
+  const session = await fetchJmapSession(creds.serverUrl, creds.authHeader, { trusted: creds.trusted }).catch(() => null);
+  const accounts = (session?.accounts ?? {}) as Record<string, { name?: string; isPersonal?: boolean }>;
+  const groups = Object.values(accounts)
+    .filter((account) => account?.isPersonal === false && typeof account.name === 'string' && account.name.includes('@'))
+    .map((account) => account.name!.trim().toLowerCase())
+    .filter((name) => name !== email)
+    .sort();
+  return { email, groups };
+}
+
+/** The caller as the device gates see them, kept for a few minutes per credential. Never rejects. */
+export function strictDeviceSubject(creds: DeviceCreds): Promise<PolicySubject> {
+  const key = createHash('sha256').update(`${creds.serverUrl}\n${creds.authHeader}`).digest('hex');
+  const entries = cache();
+  const now = Date.now();
+  const hit = entries.get(key);
+  if (hit && now - hit.at < TTL_MS) return hit.subject;
+  const subject = readSubject(creds);
+  entries.set(key, { at: now, subject });
+  if (entries.size > 1000) {
+    for (const [k, v] of entries) if (now - v.at >= TTL_MS) entries.delete(k);
+  }
+  return subject;
+}
+
+/** The device policy that applies to this login. */
+export async function serverDevicePolicy(creds: DeviceCreds): Promise<ServerDevicePolicy> {
+  await configManager.ensureLoaded();
+  const subject = await strictDeviceSubject(creds);
+  const devices = resolvePolicy(configManager.getPolicy(), subject).policy.organisation?.devices;
+  return { ...DEFAULT_ORGANISATION_POLICY.devices, ...(devices ?? {}) };
+}
+
+/**
+ * The WOPI CheckFileInfo switches for the office editor (Collabora and
+ * ONLYOFFICE read these): no printing, no export or "save a copy" when
+ * downloads or export are off, and the watermark.
+ */
+export function wopiDeviceInfo(devices: ServerDevicePolicy, username: string, now: Date = new Date()): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  if (devices.noPrint) {
+    out.DisablePrint = true;
+    out.HidePrintOption = true;
+  }
+  if (devices.noDownloads || devices.noExport) {
+    out.DisableExport = true;
+    out.HideExportOption = true;
+    out.HideSaveOption = true;
+    out.DisableCopy = true;
+  }
+  if (devices.watermark) out.WatermarkText = `${username} · ${now.toISOString().slice(0, 10)}`;
+  return out;
+}
+
+/** For tests. */
+export function clearServerDeviceSubjects(): void {
+  cache().clear();
+}
diff --git a/lib/web-push.ts b/lib/web-push.ts
index fa267e07e..01d9486ee 100644
--- a/lib/web-push.ts
+++ b/lib/web-push.ts
@@ -81,8 +81,11 @@ const PUSH_TYPES = ['EmailDelivery'] as const;
 // capability and get the plain EmailDelivery subscription as before.
 export const EMAIL_PUSH_CAPABILITY = 'urn:ietf:params:jmap:emailpush';
 
-// Only ids: the relay stays content-blind and the SW dedupes on them.
-const EMAIL_PUSH_PROPERTIES = ['id', 'threadId'];
+// Only ids: the relay stays content-blind and the SW dedupes on them. Never
+// add from, subject or preview: they would reach the push service around
+// the device policy "Push without sender and subject" (its text is held
+// back in app/api/push/preview). A test keeps this list as it is.
+export const EMAIL_PUSH_PROPERTIES: readonly string[] = ['id', 'threadId'];
 
 function sameTypes(a: readonly string[] | null | undefined, b: readonly string[]): boolean {
   if (!a || a.length !== b.length) return false;
diff --git a/public/sw.js b/public/sw.js
index 00f9cc8f3..1c9bb3bfb 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -204,7 +204,13 @@ async function handlePush(event) {
   let body;
   let data = { kind: "mail-list", accountId, slot };
 
-  if (email) {
+  if (email && preview && preview.redacted) {
+    // The organisation keeps sender and subject off notifications
+    // (Organisation > Devices): the route sent neither.
+    title = accountLabel ? `New mail (${accountLabel})` : "New mail";
+    body = unreadTotal > 1 ? `${unreadTotal} unread messages` : "You have new mail";
+    if (unreadTotal <= 1) data = { kind: "email", emailId: email.id, threadId: email.threadId, slot };
+  } else if (email) {
     const sender = email.from && email.from[0];
     const senderName = (sender && sender.name) || (sender && sender.email) || "New mail";
     title = senderName + (accountLabel ? ` (${accountLabel})` : "");