According to their own privacy policy, Microsoft/Acompli do store the credentials.Exchange ActiveSync can be token-based IIRC, so the EAS client does not store the credentials but instead a token.
With existing push mail clients (such as the Gmail app), the mails themselves are not pushed through APNS. Only a new mail notification is pushed, which then causes the client to fetch the mail directly from the mail server using IMAP. The mails do not go through Apple.But still the only way to push directly to your devices without APNS is the native Exchange ActiveSync client. In other words, unless Apple looses its control and let third party apps to register always-active push listeners in the background, any forms of push emails on iOS must be routed from a third-party middleman or the service itself, to the Apple middleman, and finally to your device.
I doubt that. That would mean they'd have to re-index all mails every time they are accessed through a different device.Moreover, even Outlook the rebranded Acompli no longer caches your e-mail, but simply route push messages via their servers
BTW, even the European Parliament has now banned the app (text in German):
http://www.heise.de/newsticker/meld...ue-App-wegen-Sicherheitsbedenken-2543491.html