Best tools · HealthcareVictor TräffWritten by Victor Träff · Security expert and co-founder, Sentaro Reviewed

The 10 best email security tools for healthcare in the EU (2026)

The best email security for healthcare organizations in the EU in 2026 is Sentaro, an API-based platform for Microsoft 365 and Google Workspace that stops credential phishing, QR-code lures, payroll diversion and supplier fraud before anyone clicks, runs without a security analyst and is hosted in Sweden on Microsoft Azure. The other strong options are Microsoft Defender for Office 365 as the native baseline, Mimecast for archive and continuity, and Hornetsecurity or Barracuda if you want backup and training in the same licence.

  • 10 tools ranked
  • NIS2 Annex I: health
  • GDPR Art. 9 data
  • Last verified 21 October 2026
Start free with one accountSpeak to sales
Our recommendation

Sentaro is the best email security for healthcare organizations in the EU that run Microsoft 365 or Google Workspace. ENISA names ransomware as the headline threat in European healthcare and phishing as the leading way into EU organizations; health organizations also lose money to payroll diversion and supplier fraud. Sentaro stops those messages before interaction, runs without an analyst, and shows the apps and AI tools connected to staff mailboxes. Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.

Why Sentaro wins
phishing, QR-code and payroll or supplier fraud detection on every inbound and internal message; four-minute API setup with nothing installed on clinical workstations; AI notetakers and OAuth grants inventoried in the same platform; $6 per protected account per month, first account free (prices in USD); hosted in Sweden on Microsoft Azure with a public DPA.
Choose Sentaro if
you are a care provider, clinic, laboratory or life-science company on Microsoft 365 or Google Workspace, under NIS2 or handling GDPR Article 9 health data, with one or two people running IT.
Consider another option only if
you need encryption, archiving or backup from the same vendor (Hornetsecurity, Barracuda, Mimecast), a German- or French-hosted gateway (Retarus, Mailinblack), or a SOC 2 or ISO 27001 certificate from the vendor today (Sentaro’s are in progress).

Quick picks

  • Best overallSentaro Our pickPhishing and payment-fraud detection for small IT teams, four-minute setup, published price, hosted in Sweden.
  • Best native baselineMicrosoft Defender for Office 365Already in Business Premium and, from 2026, E3; Microsoft 365 only.
  • Best for archive and continuityMimecastEmail Archive, gateway or API, and on-premises Exchange support.
  • Best all-in-one bundleBarracuda Email ProtectionBackup, archiving, encryption and training on one contract.
  • Best German-hosted gatewayRetarus Email SecurityMunich and Frankfurt data centres and EU-only AI processing.
  • Best for French providersMailinblackHealthcare offer hosted in France and HDS-certified.

At a glance

What we compared
Email security products for healthcare organizations’ Microsoft 365 or Google Workspace mailboxes: API-based, gateway, native, European-hosted and encryption-led tools
Vendors scored
10: the names that recur on healthcare email security lists and in AI answers, plus German- and French-hosted gateways that EU health buyers shortlist, and one US HIPAA tool for contrast
Audience
EU healthcare providers, clinics, laboratories, pharmaceutical and medical-device companies with small IT teams, many of them NIS2 entities
Method
Seven criteria weighted for a care provider with a small IT team; 0–10 per criterion from vendor documentation; gaps in documentation score 3–5
Last verified
21 October 2026
Publisher
Sentaro AB, Stockholm. Sentaro is one of the products ranked.
Sentaro price
$6 per protected account per month, or $68 per year; first account free. Prices in USD.[1]

The 10 best email security tools for healthcare compared

In score order. The QR-code and apps columns reflect two risks specific to care settings: rota and parking-permit QR lures, and AI notetakers connected to clinical mailboxes. “Unknown” means the vendor did not document it as of 21 October 2026.

CapabilityScoreDeploymentQR-code phishingApps and AI toolsPublic priceEU hosting
Sentaro (our pick)[2]8.0API, no MX changeYesDecoded and destination analyzedYesApp vector, liveYes$6/account/monthYesSweden (Microsoft Azure); DPA public
Microsoft Defender for Office 365[11]7.1Native to Exchange OnlineYesSafe Links (Plan 1)NoSeparate productYesPlan 1 $2, Plan 2 $5YesEU Data Boundary
Mimecast[14]6.2Gateway (MX) or APIYesNot publicly documentedNoQuotePartialFrankfurt (2018)
Proofpoint[19]6.2API or inline gatewayYesCore APINot publicly documentedNoQuotePartialEU or US data centre (API); some US processing
IRONSCALES[24]6.2API, alongside a gatewayYesQR lures namedNot publicly documentedNoTiers published, prices on quotePartialAWS USA and Germany (subprocessor list)
Hornetsecurity[16]6.1MX, API or hybridNot publicly documentedPartialPermission management (Plan 4)NoQuote via partnersPartial12 regional data centres (vendor)
Barracuda Email Protection[21]6.1API-first, no MX changeNot publicly documentedNot publicly documentedNoQuotePartialGateway: Frankfurt, London; API modules: US
Retarus Email Security[23]5.8Gateway (MX) or API connectorNot publicly documentedNoNoQuoteYesMunich and Frankfurt
Mailinblack[26]5.0SaaS or on-premises; M365 APINot publicly documentedNoNoQuoteYesFrance; HDS for health
Paubox[27]4.5Mail-flow encryption and filteringNot publicly documentedNoYesFrom $32/month for 1–5 sendersNoNone documented

Prices in USD as published on 21 October 2026. Check each vendor’s current documentation before you buy.

  • Yes
  • Partial
  • No
  • On roadmap
  • Paid add-on
  • Not publicly documented
Try it on your own tenant. API connection in about four minutes, alongside what you run today. $6 per account / month.Start freeSpeak to sales →

How we evaluated email security for healthcare

Most EU health organizations do not have a security operations team, hold special-category data in their mailboxes and, if they are medium-sized or larger, fall under NIS2. The weights follow what that buyer needs first.

CriterionWeightWhy it matters
Phishing, QR and payment-fraud detection25%Phishing is the leading intrusion vector in the EU and a main way into ransomware; payroll diversion and supplier bank-detail fraud are the attacks that take money directly. Both must be stopped before a member of staff acts.
Health-data handling and EU hosting transparency20%A compromised clinical mailbox can be a breach of health data, a GDPR Article 9 special category. We score documented hosting, a public subprocessor list, retention and incident notice.
Running effort for a small IT team15%Clinics and small hospitals have one or two IT people. The tool has to deploy without MX changes or agents on shared workstations and decide on its own most of the time.
Supply-chain visibility: connected apps and AI tools15%NIS2 Article 21(2)(d) makes supply-chain security part of the duty. AI notetakers and assistants that staff connect to mail and files are suppliers too, and often unapproved.
Price transparency10%Public-sector and non-profit care buyers budget per year and often must compare offers; a published per-account price shortens that.
Encryption, archiving, backup and training10%Encryption, archiving, backup and training matter, but many organizations already have them through Microsoft 365, Google Workspace or a separate tool.
Certifications and assurance5%Certifications help procurement and audits. They do not stop a phishing email, so they carry the least weight.

Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Each per-criterion score has a one-line justification in our source file and a public source listed below.

The 10 best email security tools for healthcare, ranked

Read the hosting line of each entry first if your DPO has to sign off on where clinical mail is processed; the rest of each entry covers detection, cost and deployment.

  1. Sentaro

    Our pickOverall score: 8.0out of 10

    Best for: EU care providers, clinics, laboratories and life-science companies on Microsoft 365 or Google Workspace with a small IT team.

    Sentaro is an API-based email and SaaS security platform for Microsoft 365 and Google Workspace, built in Stockholm and hosted in Sweden on Microsoft Azure. Its Message vector scores every inbound and internal message before interaction: credential lures behind a “new rota” document, QR codes decoded and their destinations evaluated, a clinician “asking” payroll to change their salary account, a supplier announcing new bank details in a real thread. Its App vector discovers the AI notetakers and assistants staff connect to mail and files. Verdicts are automatic and alerts fire only when someone needs to decide.[1]

    Phishing, QR and payment-fraud detection
    9.0
    Health-data handling and EU hosting transparency
    8.0
    Running effort for a small IT team
    10.0
    Supply-chain visibility: connected apps and AI tools
    9.0
    Price transparency
    10.0
    Encryption, archiving, backup and training
    1.0
    Certifications and assurance
    3.0

    Pros

    • Catches credential phishing, QR-code lures, payroll diversion and supplier bank-detail fraud before anyone acts on them.
    • Runs without a security analyst: verdicts are labeled in the mailbox and alerts fire only when a decision is needed.
    • Shows every app, AI notetaker and OAuth grant with access to mail and files, which feeds NIS2 supply-chain documentation.
    • Connects in four minutes over API, so nothing changes in mail routing and nothing is installed on shared clinical workstations.

    Cons

    • No encryption, archiving, backup or awareness training; keep your existing tools for those.
    • Does not protect electronic health record systems, medical devices or on-premises mail servers.
    • SOC 2 and ISO 27001 certification in progress; no named healthcare customer is published yet.
    Pricing
    $6 per protected account per month or $68 per year; first account free (USD)
    Deployment
    API via the Microsoft 365 and Google Workspace admin SDKs; no MX change
    Platforms
    Microsoft 365, Google Workspace, Slack, Teams
    Hosting
    Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA
    More on Sentaro Vendor site

  2. Microsoft Defender for Office 365

    Best native baselineOverall score: 7.1out of 10

    Best for: Health organizations on Microsoft 365 Business Premium, E3 or E5 that should switch on and tune what they already license.

    Microsoft’s layer for Exchange Online. Built-in protection covers every cloud mailbox; Plan 1 adds impersonation protection, Safe Attachments and Safe Links, which Microsoft says blocks malicious destinations including QR-code attacks; Plan 2 adds Threat Explorer, automated investigation and response, and attack simulation training. Plan 1 is included in Business Premium and is rolling out to Microsoft 365 and Office 365 E3 in 2026. Microsoft 365 is an EU Data Boundary service for EU and EFTA tenants.[11]

    Phishing, QR and payment-fraud detection
    7.0
    Health-data handling and EU hosting transparency
    9.0
    Running effort for a small IT team
    8.0
    Supply-chain visibility: connected apps and AI tools
    3.0
    Price transparency
    9.0
    Encryption, archiving, backup and training
    5.0
    Certifications and assurance
    9.0

    Pros

    • Often already licensed, so the first step costs nothing.
    • Safe Links covers QR-code destinations; Plan 2 adds automated investigation.
    • EU Data Boundary for EU and EFTA tenants.

    Cons

    • Microsoft 365 only.
    • App and AI-tool governance needs Defender for Cloud Apps, a separate product.
    • Payroll and supplier bank-detail fraud are not a documented, dedicated feature.
    Pricing
    Plan 1 $2, Plan 2 $5 per user/month (annual); Plan 1 included in Business Premium and, from 2026, Microsoft 365 and Office 365 E3
    Deployment
    Native to Exchange Online, in the mail flow
    Platforms
    Microsoft 365 only
    Hosting
    EU Data Boundary for tenants signed up in the EU/EFTA (Multi-Geo excluded)
    Sentaro vs Microsoft Defender for Office 365 Vendor site

  3. Mimecast

    Best for archive and continuityOverall score: 6.2out of 10

    Best for: Hospital groups that need a compliance archive, mail continuity during outages or on-premises Exchange support.

    Mimecast offers a Cloud Gateway (MX) and a Cloud Integrated API product, and lists BEC and QR-code phishing on its product page. Detection combines multiple engines, social graphing, sandboxing, on-click URL protection and computer vision for fake login pages. Email Archive is a core product; awareness training, DMARC Analyzer and Incydr DLP are add-ons. It supports on-premises and hybrid Exchange. Trade press reported two new Frankfurt data centres in 2018 (seen via a search summary); the current footprint was not re-confirmed.[14]

    Phishing, QR and payment-fraud detection
    8.0
    Health-data handling and EU hosting transparency
    6.0
    Running effort for a small IT team
    7.0
    Supply-chain visibility: connected apps and AI tools
    4.0
    Price transparency
    3.0
    Encryption, archiving, backup and training
    8.0
    Certifications and assurance
    5.0

    Pros

    • Archive, continuity and on-premises Exchange support in one vendor.
    • QR-code phishing and BEC named on the product page.
    • Choice of gateway or API deployment.

    Cons

    • Quote-based pricing; training and DLP are add-ons.
    • EU data-centre footprint last confirmed in 2018 material.
    • App and AI-tool visibility not documented.
    Pricing
    Quote-based
    Deployment
    Cloud Gateway (MX) or Cloud Integrated (API)
    Platforms
    Microsoft 365, Google Workspace, on-premises and hybrid Exchange
    Hosting
    Frankfurt data centres announced in 2018; current footprint not re-confirmed
    Sentaro vs Mimecast Vendor site

  4. Proofpoint

    Best enterprise suiteOverall score: 6.2out of 10

    Best for: Large hospital groups and pharmaceutical companies that want gateway or API protection plus DLP and archiving from one vendor.

    Proofpoint Core Email Protection deploys via API or as an inline gateway and names BEC and supplier threats; its Core Email Protection API page lists QR-code threats and account takeover for Microsoft 365. Adaptive Email DLP, archiving, Email Fraud Defense for DMARC, Account Takeover Protection and ZenGuide training are available as add-ons. Proofpoint completed its acquisition of Hornetsecurity in December 2025. Prices are not published. Its Core Email Protection API privacy sheet says tenants are assigned to an EU or US data centre, with some processing and storage in the US.[18]

    Phishing, QR and payment-fraud detection
    8.0
    Health-data handling and EU hosting transparency
    6.0
    Running effort for a small IT team
    6.0
    Supply-chain visibility: connected apps and AI tools
    4.0
    Price transparency
    3.0
    Encryption, archiving, backup and training
    9.0
    Certifications and assurance
    6.0

    Pros

    • The broadest add-on catalogue in this list.
    • Gateway or API deployment.
    • QR-code threats and account takeover named for the Core API product.

    Cons

    • Quote-based; most capabilities are add-ons.
    • Some email data may be processed and stored in the US even for EU tenants, per its API privacy sheet (July 2026).
    • The vendor states 48 hours for API deployment.
    Pricing
    Quote-based
    Deployment
    API (via Microsoft Graph) or inline gateway
    Platforms
    Microsoft 365, Google Workspace
    Hosting
    Core Email Protection API: tenant assigned to an EU or US data centre, with some processing and storage in the US (data privacy sheet, July 2026)
    Sentaro vs Proofpoint Vendor site

  5. IRONSCALES

    Best for simulation bundledOverall score: 6.2out of 10

    Best for: Small providers, often through an MSP, that want phishing simulation and email security in one contract.

    IRONSCALES connects at mailbox level over API, works alongside an existing gateway and says it deploys in minutes with no MX changes. It builds behavioral baselines per mailbox, adds community intelligence from other customers’ reports, and names BEC, VIP impersonation and QR lures. Account takeover protection sits in higher tiers, encryption and DLP in Email Protect 360 and Pro, and phishing simulation and training in Complete Protect. Tiers are published; prices are on request.[25]

    Phishing, QR and payment-fraud detection
    8.0
    Health-data handling and EU hosting transparency
    6.0
    Running effort for a small IT team
    8.0
    Supply-chain visibility: connected apps and AI tools
    4.0
    Price transparency
    4.0
    Encryption, archiving, backup and training
    6.0
    Certifications and assurance
    4.0

    Pros

    • QR lures and BEC named; account takeover in higher tiers.
    • Phishing simulation in the same platform.
    • Fast API deployment next to an existing gateway.

    Cons

    • Prices on request.
    • Subprocessor list names AWS in both the USA and Germany without saying who is hosted where.
    • No archiving or backup documented.
    Pricing
    Quote-based (plan tiers published, prices not)
    Deployment
    API at mailbox level; works alongside a gateway
    Platforms
    Microsoft 365, Google Workspace
    Hosting
    Subprocessor list names AWS in the USA and AWS Europe (Germany) for the primary application platform
    Sentaro vs IRONSCALES Vendor site

  6. Hornetsecurity

    Best Microsoft 365 suite with backupOverall score: 6.1out of 10

    Best for: Small care providers on Microsoft 365 whose IT partner wants filtering, encryption, archiving and backup in one licence.

    Hornetsecurity, from Hanover and owned by Proofpoint since December 2025, sells 365 Total Protection in four plans: filtering and automated encryption, then AI-based advanced threat protection, continuity and archiving, then Microsoft 365 backup, then awareness training, permission management and DMARC management. It runs in MX, API or hybrid mode, states “12 regional data centers, independent of Microsoft’s infrastructure”, and is sold through partners. Google Workspace support is not confirmed on its pages.[16]

    Phishing, QR and payment-fraud detection
    5.0
    Health-data handling and EU hosting transparency
    8.0
    Running effort for a small IT team
    6.0
    Supply-chain visibility: connected apps and AI tools
    5.0
    Price transparency
    3.0
    Encryption, archiving, backup and training
    10.0
    Certifications and assurance
    5.0

    Pros

    • Backup of Microsoft 365 mailboxes, OneDrive and SharePoint in the same licence (Plan 3).
    • European vendor with regional data centres.
    • Awareness training and DMARC management in Plan 4.

    Cons

    • Phishing-fraud specifics (BEC, QR) are not named on the product page.
    • Microsoft 365 focus; Google Workspace not confirmed.
    • No published prices.
    Pricing
    Quote-based, sold through partners
    Deployment
    MX, API or hybrid modes
    Platforms
    Microsoft 365 (Google Workspace not confirmed on vendor pages)
    Hosting
    Vendor states "12 regional data centers, independent of Microsoft’s infrastructure"; German data centres per third-party profiles
    Sentaro vs Hornetsecurity Vendor site

  7. Barracuda Email Protection

    Best all-in-one bundleOverall score: 6.1out of 10

    Best for: Clinics and mid-size providers that want security, backup, archiving, encryption and training on one contract.

    Barracuda Email Protection connects to Microsoft 365 and Google Workspace over API without MX changes and says it is “operational in minutes, not weeks”. Its Barracuda IQ models analyse intent and identity anomalies, and “Bailey” explains detections in plain language. The plans page lists phishing and BEC protection, account takeover detection, DMARC reporting, encryption and DLP in all plans, Microsoft 365 backup from Premium, and archiving and training in Premium Plus. Prices are not published; its trust center lists Frankfurt and London regions for Email Gateway Defense but only US regions for Impersonation Protection and Incident Response.[21]

    Phishing, QR and payment-fraud detection
    7.0
    Health-data handling and EU hosting transparency
    5.0
    Running effort for a small IT team
    8.0
    Supply-chain visibility: connected apps and AI tools
    4.0
    Price transparency
    3.0
    Encryption, archiving, backup and training
    10.0
    Certifications and assurance
    4.0

    Pros

    • The widest bundle here: security, DMARC, encryption, DLP, backup, archiving and training.
    • API deployment for both Microsoft 365 and Google Workspace.
    • Plain-language explanations of detections.

    Cons

    • No public pricing.
    • API modules (Impersonation Protection, Incident Response) are listed in US regions only.
    • App and AI-tool visibility not documented.
    Pricing
    Quote-based (three published plans)
    Deployment
    API-first, no MX change
    Platforms
    Microsoft 365, Google Workspace
    Hosting
    Trust center: Email Gateway Defense in regions incl. Frankfurt and London; Impersonation Protection and Incident Response in US regions
    Sentaro vs Barracuda Vendor site

  8. Retarus Email Security

    Best German-hosted gatewayOverall score: 5.8out of 10

    Best for: Regulated hospital groups and pharmaceutical companies on Microsoft 365 that require German hosting and EU-only AI processing.

    Retarus, owner-managed and based in Munich since 1992, offers a secure email gateway and an ICES-style API connector. Its documentation names two German data centres, Munich and Frankfurt; it states that its AI components operate within the EU and that customer data is not used externally for training. It lists encryption, archiving, continuity and a policy engine, and Retarus announced ISO 27001 certification in 2023. It names executive impersonation, not BEC broadly; Google Workspace is listed as planned.[23]

    Phishing, QR and payment-fraud detection
    5.0
    Health-data handling and EU hosting transparency
    10.0
    Running effort for a small IT team
    5.0
    Supply-chain visibility: connected apps and AI tools
    2.0
    Price transparency
    3.0
    Encryption, archiving, backup and training
    8.0
    Certifications and assurance
    8.0

    Pros

    • The most specific EU hosting documentation in this list.
    • EU-only AI processing stated by the vendor.
    • Encryption, archiving and continuity in one product family.

    Cons

    • Microsoft 365 only today; Google Workspace is planned.
    • BEC and QR-code phishing not named.
    • No app or OAuth visibility; prices on request.
    Pricing
    Quote-based
    Deployment
    Secure email gateway (MX) or an API connector (ICES)
    Platforms
    Microsoft 365 (Google Workspace listed as "planned")
    Hosting
    Two German data centres, Munich and Frankfurt (vendor docs); AI components operated in the EU
    Vendor site

  9. Mailinblack

    Best for French providersOverall score: 5.0out of 10

    Best for: French clinics, hospitals and local authorities that want French-hosted filtering and awareness training.

    Mailinblack, based in Marseille, sells Protect for email security alongside Cyber Coach and Cyber Academy for awareness and a password manager. It runs as SaaS or on-premises, with an API integration for Microsoft 365. Its healthcare offer is “hosted in France and HDS-certified”, the French health-data hosting certification. It describes impersonation protection and its own AI, Néréus, but does not name BEC or QR-code phishing. Offers are tiered by company size, with no published price.[26]

    Phishing, QR and payment-fraud detection
    4.0
    Health-data handling and EU hosting transparency
    9.0
    Running effort for a small IT team
    5.0
    Supply-chain visibility: connected apps and AI tools
    1.0
    Price transparency
    3.0
    Encryption, archiving, backup and training
    6.0
    Certifications and assurance
    7.0

    Pros

    • HDS-certified hosting in France for its healthcare offer.
    • Awareness training bundled.
    • On-premises option.

    Cons

    • BEC and QR-code phishing not named.
    • Google Workspace support not stated.
    • No published prices.
    Pricing
    Offers tiered by company size; no published price
    Deployment
    SaaS or on-premises; API integration for Microsoft 365
    Platforms
    Microsoft 365 (Google Workspace not stated)
    Hosting
    “Developed & hosted in France” (vendor sales material); healthcare offer HDS-certified (vendor site)
    Vendor site

  10. Paubox

    Best for US HIPAA encryptionOverall score: 4.5out of 10

    Best for: Groups with US practices that need HIPAA-oriented encrypted email at a published price; not built for EU hosting.

    Paubox, based in San Francisco, sells an Email Suite built around automatic encryption of every outbound email, with no portal for recipients. Plus adds inbound security and ExecProtect+ display-name spoofing protection; Premium adds archiving and DLP. Prices are fully published per sender: on annual billing, 1–5 senders cost $32 (Standard), $65 (Plus) or $75 (Premium) per month. A HIPAA business associate agreement is included and Paubox cites HITRUST CSF certification. No EU hosting is documented.[27]

    Phishing, QR and payment-fraud detection
    4.0
    Health-data handling and EU hosting transparency
    2.0
    Running effort for a small IT team
    6.0
    Supply-chain visibility: connected apps and AI tools
    1.0
    Price transparency
    10.0
    Encryption, archiving, backup and training
    7.0
    Certifications and assurance
    7.0

    Pros

    • The most detailed public pricing in this list.
    • Outbound encryption with no portal for recipients.
    • Archiving and DLP in the Premium plan.

    Cons

    • No EU hosting documented; built for US HIPAA requirements.
    • Inbound protection is basic compared with the API platforms here.
    • No app or AI-tool visibility.
    Pricing
    Per sender: 1–5 senders $32 / $65 / $75 per month (Standard / Plus / Premium, annual billing)
    Deployment
    Mail-flow encryption and inbound filtering; routing method not documented
    Platforms
    Microsoft 365, Google Workspace
    Hosting
    No EU hosting documented
    Vendor site

How should a healthcare organization choose email security?

Start from the threat data for your sector. ENISA’s health-sector threat landscape analysed 215 publicly reported incidents in the EU and neighbouring countries between January 2021 and March 2023: ransomware was involved in 54%, healthcare providers accounted for 53% of incidents, and patient data was the most targeted asset at 30%. Across all EU sectors, ENISA’s Threat Landscape 2025 puts phishing at about 60% of observed intrusions. The European Commission followed with an action plan on the cybersecurity of hospitals and healthcare providers in January 2025.

Check whether you are a NIS2 entity

NIS2 Annex I lists health as a sector of high criticality: healthcare providers, EU reference laboratories, research and development of medicinal products, basic pharmaceutical manufacturing, and medical devices critical in a public health emergency. Annex II adds other medical-device and in vitro diagnostic manufacturers. Medium-sized and larger entities are generally in scope, which brings incident handling, supply-chain security and the 24-hour early warning and 72-hour notification under Article 23. In Sweden this is cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026.

Treat health data in the mailbox as the deciding factor

Referral letters, lab results and staff health records end up in mail. GDPR Article 9 makes health data a special category, and Article 33 requires breach notification within 72 hours of awareness. Ask every vendor where mail is processed and stored, which subprocessors are involved and in which countries, how long raw messages are kept and who can read them. No product makes an organization NIS2 or GDPR compliant; this is general guidance, not legal advice.

A note on HIPAA

Much of what ranks for “healthcare email security” is written for US HIPAA buyers, which is why encryption-first products such as Paubox appear on those lists. HIPAA is US law and does not apply to an EU provider’s EU operations. If your group also runs US practices, a HIPAA business associate agreement may matter there; for EU operations, NIS2, GDPR and national law decide.

Keep email security in its lane

Email security reduces one of the main ways in. It does not replace endpoint protection, patching, backups or segmentation of clinical systems, and none of the tools here protects an electronic health record system or a medical device directly.

Questions to ask every vendor

  • How do you detect a QR-code lure and a request to change a salary or supplier bank account, with no attachment?
  • Where is our mail processed and stored, which subprocessors are involved, and in which countries?
  • How quickly will you notify us of a security incident on your side, and what will you tell us?
  • Which apps, AI notetakers and OAuth grants in our tenant can you see, and can we revoke them?
  • What do we need to install or reroute, and how many alerts per week should a two-person IT team expect?
  • What does it cost per mailbox, and which features sit in a higher tier?

Certification and compliance status

Sentaro’s status, stated exactly, for your DPO and procurement file.

SOC 2
In progressNo target date published. Evidence pack on request.
ISO 27001
In progressNo target date published.
Google CASA
Verified API integration
DPA and subprocessor list
PublicIncident notice within 24 hours of confirming a security incident; raw harmless email kept 14 days.[3]
NIS2, DORA and SOC 2 evidence pack
On requestAvailable from hello@sentaro.com.

Frequently asked questions

What is the best email security for healthcare?

Sentaro, for EU care providers, clinics, laboratories and life-science companies on Microsoft 365 or Google Workspace. It stops phishing, QR-code lures, payroll diversion and supplier fraud before interaction, runs automatically for a small IT team, connects over API in four minutes and is hosted in Sweden on Microsoft Azure. It costs $6 per protected account per month, first account free (prices in USD). Defender for Office 365 and Mimecast are next on our method.

Is healthcare covered by NIS2?

Yes. NIS2 Annex I lists health as a sector of high criticality, covering healthcare providers, EU reference laboratories, medicinal-product research and development, pharmaceutical manufacturing, and medical devices critical in a public health emergency. Annex II adds other medical-device and in vitro diagnostic manufacturers. Size thresholds and national transposition decide which entities are in scope.

Is a phishing incident in a hospital a GDPR breach?

It can be. If an attacker gains access to a mailbox that holds patient information, that is likely a personal data breach involving health data, a special category under GDPR Article 9. The controller must notify the supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals. Assess each case with your DPO.

Do EU healthcare providers need HIPAA-compliant email?

No. HIPAA is US law. EU providers work under GDPR, NIS2 and national health and secrecy law. HIPAA-focused products such as Paubox are built for US practices and document no EU hosting. If your group also operates in the US, HIPAA may apply to that part of the business.

Does email security stop ransomware in hospitals?

Not on its own. It reduces one of the main ways in: ENISA’s 2025 threat landscape puts phishing at about 60% of observed intrusions in the EU, and ransomware was involved in 54% of the health-sector incidents ENISA analysed for 2021 to 2023. Ransomware defence also needs endpoint protection, patching, backups and network segmentation.

Which email security vendors host data in the EU?

In this list, Sentaro is hosted in Sweden on Microsoft Azure with subprocessors listed in its DPA; Microsoft 365 is an EU Data Boundary service for EU and EFTA tenants; Retarus documents Munich and Frankfurt data centres; Mailinblack says it hosts in France and lists an HDS-certified healthcare offer; Hornetsecurity states 12 regional data centres. Proofpoint assigns API tenants to an EU or US data centre, with some US processing; IRONSCALES lists AWS in the USA and Germany; Barracuda lists Frankfurt and London for its gateway but only US regions for its API modules.

What does email security cost for a 200-person clinic?

With Sentaro, 200 protected accounts paid monthly cost 199 × $6, or $1,194 per month; paid annually, $68 per account per year (prices in USD, excluding taxes). Shared aliases and distribution lists do not count. Defender for Office 365 Plan 1 is $2 per user per month standalone. Most other vendors here quote on request.

Where does Sentaro score lowest for healthcare?

On encryption, archiving, backup and training it scores 1 out of 10, the lowest of the ten tools, because it offers none of them; on certifications it scores 3, because SOC 2 and ISO 27001 are in progress. Sentaro publishes this page and ranks itself first, so we show those scores in full. If a hospital procurement file needs a certificate today, Retarus (ISO 27001) and Microsoft (Service Trust Portal) document theirs.

Sources and method

Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Product capabilities and prices change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.

  1. Sentaro pricing
  2. Sentaro: platform (API deployment, Vord engine, vectors)
  3. Sentaro Data Processing Agreement and subprocessor list
  4. ENISA Threat Landscape: Health Sector (January 2021 to March 2023)
  5. ENISA: Checking-up on health: ransomware accounts for 54% of cybersecurity threats (5 July 2023)
  6. ENISA Threat Landscape 2025 (October 2025)
  7. European Commission: European action plan on the cybersecurity of hospitals and healthcare providers
  8. Directive (EU) 2022/2555 (NIS2), EUR-Lex
  9. Regulation (EU) 2016/679 (GDPR), EUR-Lex
  10. Cybersäkerhetslag (SFS 2025:1506)
  11. Microsoft Learn: Why do I need Microsoft Defender for Office 365? (accessed 2026-10-18)
  12. Microsoft: Defender for Office 365 pricing (accessed 2026-10-18)
  13. Microsoft Learn: EU Data Boundary (accessed 2026-10-18)
  14. Mimecast: Email Security (accessed 2026-10-18)
  15. Datacentre News: Mimecast opens two Frankfurt data centres (2018)
  16. Hornetsecurity: 365 Total Protection (accessed 2026-10-18)
  17. Hornetsecurity: Email security modes
  18. Proofpoint: Core Email Protection (accessed 2026-10-18)
  19. Proofpoint: Core Email Protection API (accessed 2026-10-21)
  20. Barracuda: Email Protection (accessed 2026-10-18)
  21. Barracuda: Email Protection plans (accessed 2026-10-18)
  22. Retarus: Email Security (accessed 2026-10-21)
  23. Retarus docs: Email Security data center operations (Munich and Frankfurt)
  24. IRONSCALES: Home page (accessed 2026-10-18)
  25. IRONSCALES: Pricing (accessed 2026-10-18)
  26. Mailinblack: home page (products, hosting, HDS) (accessed 2026-10-21)
  27. Paubox: pricing (plans, per-sender prices, BAA) (accessed 2026-10-21)
  28. Proofpoint: Data privacy information sheet, Core Email Protection API (updated 24 July 2026; accessed 2026-10-21)
  29. Proofpoint: Third-party service providers and subprocessors (updated 14 October 2026; accessed 2026-10-21)
  30. Barracuda Trust Center: Data center locations (accessed 2026-10-21)
  31. IRONSCALES: List of current sub-processors (PDF, December 2024; accessed 2026-10-21)
RelatedEmail security for healthcare (industry guide)Best email security for law firmsBest email security for nonprofitsNIS2 and email securityQR-code phishingSentaro vs Microsoft Defender for Office 365Pricing

Stop the phishing email before it reaches the ward.

Connect Microsoft 365 or Google Workspace in four minutes. The first account is free.

Speak to salesStart free