In short: Email encryption software protects sensitive messages and attachments so only the intended recipient can read them. Modern products apply encryption automatically by policy and deliver either over enforced TLS or through a secure web portal. They work with Microsoft 365 and Google Workspace and are usually licensed per sending user.
What is email encryption?
Most email travels between servers using opportunistic TLS, which encrypts the connection if both sides support it but falls back to plain text if not. Once delivered, the message sits readable in the recipient's mailbox. For everyday mail that is acceptable, but for payroll data, medical information, legal documents or customer records you may need more control.
Email encryption software adds that control. Typical methods are:
- Enforced TLS: the message is only sent if the connection is encrypted
- Secure portal delivery: the recipient receives a notification and reads the message in a secure web portal after verifying their identity
- Encrypted attachments: a password-protected or encrypted file the recipient opens with a code
- S/MIME or PGP: certificate-based end-to-end encryption, used where both parties support it
UK GDPR requires appropriate technical measures to protect personal data, and it names encryption as an example. The ICO has taken action over misdirected and unprotected email, so many UK organisations treat encryption as a standard control.
Encryption also reduces the impact of mistakes. If a message is sent to the wrong address, portal delivery lets you withdraw access before it is read, which can make the difference when deciding whether an incident needs reporting to the ICO within the 72-hour window that UK GDPR sets for notifiable breaches.
Email encryption: vendors and products we supply
- Echoworx: Policy-based email encryption with portal, TLS, PDF and S/MIME or PGP delivery.
- Echoworx Email Encryption: Standard and Advanced editions compared, licensed per user, monthly or annual.
- Hornetsecurity: Microsoft 365 email security, archiving, backup and compliance, per user.
- Hornetsecurity 365 Total Protection: Plans 1 to 4: Microsoft 365 email security, archiving, backup and compliance.
- Hornetsecurity Email Encryption: Automatic S/MIME and PGP email encryption with certificate management.
- IRONSCALES: AI email security, awareness training, DMARC and encryption for Microsoft 365.
- IRONSCALES Email Encryption: Sender and policy-based email encryption for Microsoft 365, per user.
- Proofpoint: Proofpoint Essentials email security, archiving and awareness training, per user.
- Proofpoint Essentials: Email filtering, encryption, continuity and archiving packages, per user.
- Sophos: Endpoint, EDR, XDR, MDR, firewall, email and mobile security licences, managed in Sophos Central.
- Sophos Email: Cloud email security for Microsoft 365 and Google Workspace, licensed per mailbox.
- Trend Micro Email and Collaboration Security: Cloud email gateway, API inbox protection and XDR for Microsoft 365 and Google Workspace.
What to look for
- Automatic policies: encrypt based on content (for example, National Insurance or bank details), recipient or a keyword in the subject
- Easy recipient experience: no software to install, with clear branding so recipients trust the message
- Replies and revocation: secure replies, read receipts and the ability to withdraw access
- Integration: an Outlook add-in or Gmail workflow, and support for Microsoft 365 and Google Workspace
- Large file delivery for documents too big for normal email
- Audit trails for compliance evidence
How email encryption is licensed
Email encryption is usually licensed per sending user, with recipients free. Some vendors sell it as an add-on to an email security package, others as a standalone product such as Echoworx, with tiers that add features like large file transfer or custom branding. Check whether you need every user licensed or only the teams that send sensitive data; policy-based products can sometimes be scoped to departments.
How to choose
- Identify who sends sensitive information and to whom: HR, finance, legal, clinical or customer service teams.
- Decide how much you want to rely on users: automatic policy-based encryption reduces mistakes.
- Test the recipient journey with a few real external contacts.
- Check whether your email security suite already includes encryption before buying a separate tool.
- Consider data loss prevention alongside encryption to catch messages that should not be sent at all.
Remember the people on the other side: solicitors, accountants, local authorities and NHS bodies often have their own encryption tools, so check whether your chosen product works well when replying to encrypted mail from them.
How we help
We help you scope who needs licensing, set up policies that match your data, and supply the subscription alongside your other email tools. Contact us and ask us for a quote.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Microsoft 365 or Gmail email already encrypted?
Mail is usually encrypted in transit with TLS between servers that support it, but this is not guaranteed and does not control what happens after delivery. Encryption software enforces protection and adds portal delivery, revocation and audit.
Do recipients need software to read encrypted email?
Not with most modern products. Recipients either receive the message over an enforced TLS connection or read it in a secure web portal after verifying their identity.
Is email encryption required under UK GDPR?
UK GDPR does not mandate a specific tool, but it requires appropriate security for personal data and names encryption as an example measure. For sensitive data sent by email, encryption is widely regarded as appropriate.