A method for independently encrypting channels of data in a transaction, comprising: encryption of a first data channel in the transaction using a first security association; encryption of a second data channel in the transaction using a second security association; and encryption of a third data channel in the transaction using a third security association; wherein the first and third data channels (23, 25) each consist of point-to-point control data and the second data channel consists of end-to-end content data, the method including: negotiation of a first encryption key and the first security association for the first data channel between a mobile device and a server operating as a transfer agent for the transaction; negotiation of a second encryption key and the second security association for the second data channel between a mobile device and a computer operating as an endpoint for the transaction; and negotiation of a third encryption key and the third security association for the third data channel between the server and the endpoint; wherein the control data in the first and third data channels (23, 25) includes authentication and routing information for the transaction, the authentication information includes, in the first data channel, an authentication token issued to the mobile device from the server after the server has successfully validated a username and password transmitted to the server by the mobile device against information in a user database and, in the third data channel, a user identifier associated with the authentication token, and the end-to-end content data in the second data channel includes a payload for the transaction that includes the content of email messages, electronic files, or other electronic data. encryption of a first data channel in the transaction using a first security association; encryption of a second data channel in the transaction using a second security association; and encryption of a third data channel in the transaction using a third security association; wherein the first and third data channels (23, 25) each consist of point-to-point control data and the second data channel consists of end-to-end content data, the method including: negotiation of a first encryption key and the first security association for the first data channel between a mobile device and a server operating as a transfer agent for the transaction; negotiation of a second encryption key and the second security association for the second data channel between a mobile device and a computer operating as an endpoint for the transaction; and negotiation of a third encryption key and the third security association for the third data channel between the server and the endpoint; negotiation of a first encryption key and the first security association for the first data channel between a mobile device and a server operating as a transfer agent for the transaction; negotiation of a second encryption key and the second security association for the second data channel between a mobile device and a computer operating as an endpoint for the transaction; and negotiation of a third encryption key and the third security association for the third data channel between the server and the endpoint; wherein the control data in the first and third data channels (23, 25) includes authentication and routing information for the transaction, the authentication information includes, in the first data channel, an authentication token issued to the mobile device from the server after the server has successfully validated a username and password transmitted to the server by the mobile device against information in a user database and, in the third data channel, a user identifier associated with the authentication token, and the end-to-end content data in the second data channel includes a payload for the transaction that includes the content of email messages, electronic files, or other electronic data.