Sentaro is the best European email security alternative for EU teams on Microsoft 365 and Google Workspace: it connects over the Microsoft 365 and Google Workspace APIs in four minutes with no MX change and no agents; its BEC and vendor-fraud verdicts show their reasoning in the console, so you can audit them on your own mail; its App vector, live since Q3 2026, covers OAuth grants and AI tools in the same platform; its price, $6 per protected account per month with every feature included, is published (USD); and it is hosted in Sweden on Microsoft Azure, with subprocessors listed in the DPA. Its DPA is governed by Swedish law. In every case, read the DPA and subprocessor list: hosting location and subprocessor locations are not the same thing.
- Why Sentaro wins
- a Swedish company, hosted in Sweden on Microsoft Azure, with a DPA under Swedish law and its subprocessors listed openly in the DPA. It protects both Microsoft 365 and Google Workspace over API.
- Choose Sentaro if
- you want an EU-built API layer for BEC, phishing and OAuth risk without a gateway project.
- Consider Retarus, Libraesva or NoSpamProxy only if
- you need a gateway, continuity or archive, or want to run it on-premises or in your own private cloud.
Why EU teams look for European email security
Three EU rules put the email security vendor itself under review, not only its features:
- NIS2 Article 21(2)(d) requires in-scope entities to address supply chain security, including the security of their relationships with direct suppliers and service providers.
- DORA Article 28(3) requires financial entities to keep a register of information on all contractual arrangements with ICT third-party service providers.
- GDPR Chapter V (Articles 44 to 49) governs transfers of personal data outside the EU, which includes transfers made by a vendor’s subprocessors.
None of these rules requires a European vendor. They require you to know and document where your vendor, its owners and its subprocessors are. That is why “European” has to be split into separate questions.
What does “European” mean for an email security vendor?
| Question | Why it matters | Where to find the answer |
|---|---|---|
| Where is the vendor headquartered? | Determines the vendor’s home jurisdiction | Company register, imprint, DPA party details |
| Who owns it? | Ownership can change jurisdiction without any product change | Press releases, annual filings |
| Where is customer data hosted? | Data residency for GDPR and sector rules | DPA processing locations, trust center |
| Where are the subprocessors? | A European host can still use non-EU subprocessors | DPA subprocessor annex |
| Which law and courts govern the DPA? | Affects how disputes and audits work | DPA governing-law clause |
Many EU buyers also ask which government data-access laws can apply to a vendor’s parent company. That is a legal question for your counsel, but it is the reason ownership appears in this guide.
European email security options at a glance
| Vendor | Headquarters | Owner | Hosting statement | Deployment | Platforms |
|---|---|---|---|---|---|
| Sentaro (our pick) | Stockholm, Sweden | Sentaro AB | Hosted in Sweden on Microsoft Azure; subprocessors in the DPA | API | Microsoft 365, Google Workspace |
| Retarus | EU (vendor-stated) | Not stated on the product page | “All AI components are operated within the EU” (vendor) | Gateway or API connector | Microsoft 365; Google Workspace planned |
| Libraesva | Lecco, Italy | LibraCyber group (with Cyber Guru) | “Runs locally or in your chosen cloud” (vendor) | Gateway plus API; cloud or on-premises | Microsoft 365, Google Workspace, Exchange |
| NoSpamProxy | Paderborn, Germany | Net at Work GmbH, owner-managed | Cloud: “certified data centers within Europe” | Gateway; cloud or on-premises | Microsoft 365 |
| Hornetsecurity | Hanover, Germany | Proofpoint (US) since December 2025 | “12 regional data centers” (vendor) | MX, API or hybrid | Microsoft 365 |
| Microsoft Defender for Office 365 | US | Microsoft (public) | EU Data Boundary for EU and EFTA tenants | Native | Microsoft 365 |
| Google Workspace built-in | US | Alphabet (public) | Europe data region, edition-dependent | Native | Google Workspace |
| Check Point Harmony Email | Not confirmed in our sources | Check Point (NASDAQ: CHKP) | Ireland region; data stored and processed in the selected country (admin guide) | API, inline option | Microsoft 365, Google Workspace |
| Mimecast | Not confirmed in our sources | Permira funds since 2022 | Frankfurt data centres announced 2018 | Gateway or API | Microsoft 365, Google Workspace, Exchange |
| Darktrace / EMAIL | United Kingdom | Thoma Bravo since 2024 | Not publicly documented | API, or API plus journaling | Microsoft 365 |
Not on the list: eBuilder Security, a Swedish managed security provider with a Swedish SOC and Swedish data residency claims. It offers MDR and awareness training but no email security gateway or API product, so it complements rather than replaces the tools above.
The 8 options in detail
- 1
Sentaro
Our pickBest for: EU teams on Microsoft 365 and Google Workspace that want strong BEC and phishing protection without a gateway project.
Sentaro is a Swedish, API-based email and SaaS security platform for Microsoft 365 and Google Workspace, built in Stockholm and hosted in Sweden on Microsoft Azure. Strengths: Sentaro AB is a Swedish company; its DPA is governed by Swedish law with Stockholm courts as venue, and names Sweden as the member state in its Standard Contractual Clauses; verdicts come from Sentaro’s own engine, Vord; built for the controls regulated EU firms are asked to evidence under NIS2 and DORA; $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Limits: a cloud service only, with no gateway or archive. Read the DPA for the full subprocessor list.
EU-sovereign email security - 2
Retarus Email Security
Best for: Microsoft 365 organizations that want an EU-headquartered gateway with continuity and archive.
Email security vendor that states it is "headquartered in the EU" and has offered enterprise services since 1992. Strengths: secure email gateway or API connector; patented post-delivery removal; failover continuity; encryption and archiving for up to ten years; states that "all AI components are operated within the EU". Limits, per retarus.com as of 18 October 2026: Google Workspace listed as planned; data centres not named; pricing not published.
- 3
Libraesva
Best for: European organizations that want to choose where the gateway runs, including on-premises.
Italian email security gateway with API integration, part of the LibraCyber group. Strengths: cloud, private-cloud or on-premises deployment; Microsoft 365, Google Workspace and on-premises Exchange; separate archive, DMARC and simulation products; vendor describes small language models running on customer hardware with no off-site processing. Limits, per libraesva.com as of 18 October 2026: hosting regions of its own cloud not listed; pricing not published.
- 4
NoSpamProxy
Best for: German and DACH organizations that want a German-made gateway with S/MIME and PGP encryption.
Gateway from Net at Work GmbH in Paderborn, which describes itself as owner-managed and growing "without investors". Strengths: cloud or on-premises server; central certificate management for S/MIME and PGP; cloud data processed in certified European data centres; TeleTrust "IT Security made in Germany" mark. Limits, per nospamproxy.de as of 18 October 2026: gateway only; Google Workspace not documented; pricing not published.
Best for: Microsoft 365 customers who want a broad suite with European data centres and accept US ownership.
Hanover-based suite vendor, part of Proofpoint since 8 December 2025. Strengths: filtering, encryption, archiving, backup, DMARC and training across four plans; vendor states 12 regional data centres independent of Microsoft’s infrastructure. Limits: no longer European-owned; Google Workspace not confirmed; pricing via partners.
Best for: Microsoft 365 tenants for whom EU hosting, not European ownership, is the requirement.
Native protection in Exchange Online. Strengths: Microsoft 365 is an EU Data Boundary service for tenants signed up in the EU or EFTA, with datacenters including Sweden; Plan 1 is included in Business Premium and, from 2026, Microsoft 365 and Office 365 E3. Limits: US-headquartered; Multi-Geo tenants are excluded from the EU Data Boundary.
Best for: API-based protection with a documented EU data region and wide app coverage.
API-based protection, formerly Avanan. Strengths: admin guide lists an Ireland region and says data is stored and processed within the selected country; inline prevention via API; many collaboration apps. Limits: not a European company; pricing not published.
Best for: Workspace tenants that need data at rest in Europe.
Gmail’s native filtering plus admin-configurable advanced phishing and malware settings. Strengths: Europe data region on Business Standard and above; Security Sandbox on Business Standard and above. Limits: US-headquartered; data regions apply to covered data at rest and depend on edition.
European options side by side
| Capability | Sentaro | Retarus | Libraesva | NoSpamProxy | Hornetsecurity | Defender for Office 365 | Check Point Harmony Email |
|---|---|---|---|---|---|---|---|
| Deployment and platforms | |||||||
| Deployment | API, no MX change | Gateway (MX) or API connector | Gateway plus API; cloud or on-premises | Gateway; cloud or on-premises server | MX, API or hybrid | Native to Exchange Online | API with inline prevention |
| Microsoft 365 | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Google Workspace | Yes | On roadmapListed as planned | Yes | Not publicly documentedNot publicly documented | Not publicly documentedNot confirmed on vendor pages | No | Yes |
| On-premises Exchange | NoCloud mailboxes only | YesVia the gateway | Yes | YesNoSpamProxy Server | Not publicly documentedNot publicly documented | PartialStandalone EOP | Not publicly documentedNot publicly documented |
| Threat coverage | |||||||
| BEC and impersonation | YesMessage vector, live | YesExecutive impersonation | Yes | Not publicly documentedNot publicly documented | Not publicly documentedAdvanced threat protection named | YesImpersonation protection (Plan 1) | Yes |
| QR-code phishing | YesDecoded and destination analyzed | Not publicly documentedNot publicly documented | Not publicly documentedNot publicly documented | Not publicly documentedNot publicly documented | Not publicly documentedNot publicly documented | YesSafe Links (Plan 1) | Not publicly documentedNot publicly documented |
| OAuth apps and shadow IT | YesApp vector, live | Not publicly documentedNot publicly documented | Not publicly documentedNot publicly documented | Not publicly documentedNot publicly documented | PartialPermission management (Plan 4) | NoSeparate product: Defender for Cloud Apps | YesShadow IT detection |
| Suite extras | |||||||
| DMARC report management | NoReads DMARC posture as a signal only | Not publicly documentedNot publicly documented | Paid add-onLetsDMARC | Not publicly documentedNot publicly documented | YesPlan 4 | NoEnforces DMARC; no report management | Paid add-on |
| Archiving | No | Paid add-onEmail Archive | Paid add-onEmail Archiver | Not publicly documentedNot publicly documented | YesPlan 2 and above | NoSeparate product: Purview | Paid add-on |
| Awareness training | NoNot offered by design | Not publicly documentedNot publicly documented | Paid add-onPhishBrain | Not publicly documentedNot publicly documented | YesPlan 4 | YesAttack simulation training (Plan 2) | Paid add-on |
| Buying and data | |||||||
| Public pricing | Yes$6 per account/month | NoQuote-based | NoQuote-based | NoQuote-based | NoQuote-based via partners | YesPlan 1 $2, Plan 2 $5 | NoQuote-based |
| EU hosting documented | YesHosted in Sweden on Microsoft Azure; see DPA | PartialEU-headquartered; data centres not named | PartialLocal or chosen cloud; regions not listed | YesCloud: certified data centres in Europe | Yes12 regional data centres (vendor) | YesEU Data Boundary | YesIreland region option |
“Not publicly documented” means we could not find it in the vendor’s public material on 18 October 2026, not that the capability is missing. Add-on means sold separately or in a higher tier.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
How to choose a European email security vendor
- Decide which of the five questions above actually matter to your regulator, auditor or board. Many organizations need EU hosting; fewer need European ownership.
- Ask every shortlisted vendor, including us, for the DPA, the full subprocessor list with locations, and the governing law.
- Check platform fit: Retarus lists Google Workspace as planned and NoSpamProxy positions itself for Microsoft 365, while Sentaro and Libraesva document both.
- Decide gateway or API. Gateways (Retarus, Libraesva, NoSpamProxy) sit in front of MX and can run on-premises. API tools (Sentaro) connect to the mailbox and need no MX change.
- Record the result in your NIS2 supply-chain documentation or DORA register of information.
Why Sentaro is our pick
Why Sentaro wins
- Hosting in writing: Hosted in Sweden on Microsoft Azure, with every subprocessor listed in the public DPA (sentaro.com/en/legal/dpa).
- Protection in minutes: Sentaro connects over the Microsoft 365 and Google Workspace admin APIs in four minutes, with no agents and no MX change (your MX record stays where it is, which you can check in DNS), and shows historical mail within 15 minutes.
- BEC and vendor fraud caught without a payload: The Message vector, live since Q2 2026, scores intent, sender identity and relationship signals before interaction, including vendor-compromise and thread-hijack detection, and every verdict shows its reasoning in the console, so you can audit its BEC calls on your own mail.
- Email and apps in one platform: The App vector, live since Q3 2026, inventories every app, AI tool and OAuth grant within 15 minutes of connecting, blocks consent phishing and revokes risky grants in one click.
- Price published: $6 per protected account per month, or $68 per year, every feature included, published on sentaro.com/en/pricing; the first account is free, so you can test it before talking to sales. Prices in USD.
- You want a European vendor whose DPA is governed by Swedish law, with Stockholm courts as venue.
Consider another option only if
- You run on-premises Exchange. Sentaro supports Microsoft 365 and Google Workspace only.
- You need account-takeover monitoring or a SOC 2 or ISO 27001 certificate today; see the roadmap and certification notes on this page.
- You need an MX gateway, archiving, encryption, backup or DMARC report management. Sentaro does none of these.
- You need the engine to run on your own premises. Sentaro is a cloud service.
How to move to a European vendor
- 01
Write down your requirement
European headquarters, European ownership, EU hosting, EU-only subprocessors, or a combination. Be specific; it decides the shortlist.
- 02
Collect DPAs before demos
Compare subprocessor annexes and processing locations side by side.
- 03
Trial in parallel
API tools run next to your current setup without MX changes. Sentaro connects in four minutes, with historical visibility within 15 minutes.
- 04
Plan the cut-over
For a gateway, plan MX, SPF and connector changes. For an API tool, plan when to switch enforcement on.
- 05
Update your registers
Record the vendor, hosting and subprocessors in your NIS2 or DORA ICT third-party documentation.
Frequently asked questions
What is the best European email security alternative?
Sentaro. For EU teams on Microsoft 365 and Google Workspace, Sentaro is our pick as the best European email security alternative: it connects over API in four minutes with no MX change, catches BEC and vendor fraud before interaction, blocks OAuth consent phishing in the same platform and costs $6 per protected account per month (USD), hosted in Sweden on Microsoft Azure. If you need a gateway on-premises or in your own cloud, Libraesva and NoSpamProxy are European options; Retarus offers an EU-headquartered gateway.
Is there a European alternative to Microsoft Defender for email security?
European email security vendors usually run alongside Defender rather than replace it, because Defender’s built-in protection stays on in every Microsoft 365 tenant. Sentaro (Sweden) adds an API layer; Retarus (EU), Libraesva (Italy) and NoSpamProxy (Germany) offer gateways in front of Microsoft 365.
Is Hornetsecurity still a European company?
Hornetsecurity is based in Hanover, Germany, but has been part of Proofpoint since 8 December 2025. Proofpoint is a US-headquartered company owned by Thoma Bravo. Hornetsecurity states it runs 12 regional data centres.
Where is Sentaro’s data hosted?
Sentaro is hosted in Sweden on Microsoft Azure. Its DPA lists every subprocessor with its location and role, and is governed by Swedish law with Stockholm courts as venue. Not every subprocessor is in Sweden: read the DPA for each one’s location before you sign, and do the same with every vendor.
Does EU hosting make an email security tool GDPR compliant?
No. Hosting location is one input to a GDPR assessment, alongside the DPA, subprocessors, transfer mechanisms and your own processing. No product makes you compliant with GDPR, NIS2 or DORA. Sentaro provides the email-layer controls, continuous evidence and incident detection those frameworks require.
Is Microsoft 365 hosted in the EU?
Microsoft 365 is an EU Data Boundary service for tenants whose sign-up location is in the EU or EFTA, with datacenter countries including Sweden. Multi-Geo tenants are excluded. Microsoft is a US-headquartered company.
Which European email security vendors support Google Workspace?
Among the European vendors we checked, Sentaro and Libraesva document Google Workspace support. Retarus lists it as planned. We could not confirm Google Workspace support for NoSpamProxy or Hornetsecurity on their vendor pages as of October 2026.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Sentaro Data Processing Agreement and subprocessor list
- Retarus: Email Security (accessed 2026-10-18)
- Libraesva: Home page (accessed 2026-10-18)
- Libraesva: Proofpoint vs Libraesva (deployment options)
- NoSpamProxy (Net at Work GmbH): Home page (accessed 2026-10-18)
- Hornetsecurity: 365 Total Protection (accessed 2026-10-18)
- Proofpoint: Proofpoint completes acquisition of Hornetsecurity (December 2025)
- Thoma Bravo: Completes acquisition of Proofpoint (2021)
- Microsoft Learn: Why do I need Microsoft Defender for Office 365? (accessed 2026-10-18)
- Microsoft Tech Community: Defender for Office 365 Plan 1 rolling out to Microsoft 365 E3 (2026-06-17)
- Microsoft Learn: EU Data Boundary (accessed 2026-10-18)
- Google Workspace Admin Help: Security sandbox editions (accessed 2026-10-18)
- Google Workspace Admin Help: Data regions (accessed 2026-10-18)
- Google Workspace Admin Help: Advanced phishing and malware protection
- Check Point: Harmony Email & Collaboration (accessed 2026-10-18)
- Check Point: Harmony Email & Collaboration admin guide, data residency
- Permira: Completes acquisition of Mimecast (2022)
- Datacentre News: Mimecast opens two Frankfurt data centres (2018)
- Darktrace: Darktrace / EMAIL (accessed 2026-10-18)
- Thoma Bravo: Completes acquisition of Darktrace (October 2024)
- eBuilder Security: Employee cybersecurity training (Complorer) (accessed 2026-10-18)
- EUR-Lex: NIS2 Directive (EU) 2022/2555
- EUR-Lex: DORA Regulation (EU) 2022/2554
- EUR-Lex: GDPR Regulation (EU) 2016/679