Q:

How does Mail.app handle account credentials?

I am looking for an iOS email client that is reasonably secure (ideally, this means that it doesn't store user credentials outside the device - so something like Spark or Outlook for iOS are a no go for me).
I was thinking about the built-in Apple Mail.app but I couldn't find much about its security, so I have a few questions:

Are my account usernames and passwords stored outside of my device at any time if I use this app?
Is there any way to make sure (or to prove beyond reasonable doubt) that the creator of a mail app does not have access to the content of my emails? 
Bonus: does the situation improve if I disable push notifications?

I think this could be a useful discussion for those who are choosing their company's email client of choice and how to prove that one is or is not suitable for corporate use.
Note: this really only focuses on account credentials and email access, not on security in transit, which is already covered in this question.

A:

The default mail app's credentials are stored on the device but could leak to either a local (iTunes) backup if backup encryption is turned on or to iCloud if cloud backup is enabled.
For third-party mail apps there are no ways to prove they aren't malicious besides disassembling it and reading the whole disassembly (good luck!).
Now your second question seems a little absurd. Obviously for a mail app to work it needs to have access to the content of your mails, so all mail clients do have access to that. I assume you wanted to ask about whether the app's developer had access to your mail contents, and that also depends on whether the app binary has any "feature" that would upload email contents or credentials to the developer.
Push notifications are a reasonable excuse to share account credentials with the developer (due to Apple's stupid policy about not allowing apps to run in the background for more than 5 minutes) however if the developer is malicious they could upload the credentials even though you disabled notifications.
In the end, if you don't trust an app's developer, don't install it.

