Send confidential mail encrypted, handled in one place
A contract for your lawyer, payroll data for your tax adviser. Only the right people should read such mail. The Mail Security Gateway encrypts it with PGP or S/MIME. This happens centrally in the mail flow, not on every desk.
Request a demoHow email encryption works in the gateway
Encryption makes a mail unreadable to outsiders. Only someone with the right key can open it. The gateway does this work in one place. It supports both common standards: PGP and S/MIME.
Outbound mail from group mailboxes
You set up encryption for group mailboxes, such as "hr@" or "contracts@". When someone sends from there, the gateway looks up each recipient's public key. If it has them all, it encrypts the mail and signs it with the group key. The recipient can also see that the mail really comes from you.
Inbound mail to a team
When an encrypted mail reaches a group mailbox, the gateway decrypts it with the group key. Then it encrypts it again for every enabled member. Each person opens it with their own key. Nobody has to pass the group key around. It sits in a secured key vault.
Finding keys without manual work
The gateway finds a recipient's key on its own. It queries the Web Key Directory of the recipient's domain. This is a standard that companies use to publish their PGP keys. The gateway stores keys it finds and checks them again on a regular basis.
Portal delivery for recipients without a key
Many recipients have no PGP or S/MIME key. The portal is made for this case. The content stays in the gateway and is stored there encrypted. The recipient only gets a notice with a link. The subject line is replaced too, because it can be confidential as well.
To read the mail, the recipient opens the link in a browser. They enter their address and get a one-time code sent to exactly that address. So a forwarded link is of no use to anyone else. The session ends after 30 minutes. The portal does not help if the recipient's mailbox has been taken over. We say that openly.
If only some recipients lack a key, the gateway splits the mail. Some get the encrypted mail, the others get the portal link. If the gateway cannot store the content, it holds the mail back. It never quietly sends it as plain text. Depending on how your mail server is connected, a single mail with "[VERTRAULICH]" (confidential) in the subject can also reach outside recipients only through the portal.
Four options when a key is missing
For each group mailbox you choose what happens when a key is missing:
- Reject: The mail does not go out. The sender learns this at once.
- Sign only: The mail goes out as plain text, but with the group signature.
- Plain text with warning: This is the default. Existing mailboxes do not change.
- Portal: The content stays safe in the gateway. Only the link is delivered.
Signed mail stays unchanged
A digital signature shows that a mail was not changed on its way. That is why the gateway does not touch signed or encrypted mail. No warning banners, signatures or rewritten links go into it. A disclaimer for outbound mail is added before encryption. So it sits inside the protected part. The gateway checks inbound signatures.
Questions about email encryption
- What happens if the recipient has no key?
- You decide that per group mailbox. The mail can be rejected, sent signed only, or sent as plain text with a warning. Or it goes out through the portal. Then the content never leaves the gateway. The default is plain text with a warning.
- Does the recipient need software for the portal?
- No. They open the link in a browser, enter their address and type in a one-time code. The code goes by mail to exactly that address.
- How does the gateway find the recipients’ keys?
- It looks in its own cache, in the Web Key Directory of the recipient’s domain, in the user directory and in keys added by hand. It refreshes stored keys on a regular basis.
- Does the gateway change signed mail?
- No. Warning banners, signatures and link rewriting leave signed and encrypted mail alone. Otherwise the signature would break.
Roll out encryption the easy way
We show you group mailboxes and the portal with an example and work out which option suits your partners.
Request a demoHow we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.