Sentaro is the best email security for law firms on Microsoft 365 and Google Workspace. The attacks that cost law firms money are quiet: new account details in a genuine completion thread, a partner “on a flight” asking for an urgent transfer, a data-room invite that harvests a password. Sentaro is built for exactly these, needs no gateway project, and publishes its price. Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.
- Why Sentaro wins
- thread-hijack and vendor-compromise detection with reasoning on every verdict in the console; four-minute API setup with no MX change; OAuth apps with mailbox access visible in the same platform; $6 per protected account per month, first account free (prices in USD); hosted in Sweden on Microsoft Azure with a public DPA.
- Choose Sentaro if
- your firm handles client funds or transactions, runs Microsoft 365 or Google Workspace, and has no one whose full-time job is email security.
- Consider another option only if
- outbound encryption, archiving or DLP is your first requirement (Trustifi, Mimecast, Proofpoint), your policy requires on-premises filtering (Libraesva), or you need a SOC 2 or ISO 27001 certificate from the vendor today (Sentaro’s are in progress).
Quick picks
- Best overallSentaro Our pickClient-funds fraud detection, four-minute API setup, published price, hosted in Sweden.
- Best native baselineMicrosoft Defender for Office 365Already in Business Premium and, from 2026, E3; Microsoft 365 only.
- Best for large firmsAbnormal AIBehavioral platform with the longest certification list here.
- Best on-premises option in EuropeLibraesvaGateway that can run on your own hardware or private cloud.
- Best for archiving and continuityMimecastEmail Archive plus gateway or API, and on-premises Exchange support.
- Best for outbound encryptionTrustifiOutbound Shield encryption and DLP next to inbound filtering.
At a glance
- What we compared
- Email security products that protect a law firm’s Microsoft 365 or Google Workspace mailboxes: API-based, gateway, native and encryption-led tools
- Vendors scored
- 9, chosen from the vendors that appear on law-firm email security lists and in AI answers for this query, plus European gateway options
- Audience
- European law firms of roughly 10 to 500 people, bound by professional secrecy, handling client funds, with lean or outsourced IT
- Method
- Seven weighted criteria (weights sum to 100), each vendor scored 0–10 from its own public documentation; not publicly documented means a low-middle score, never a guess
- Last verified
- 21 October 2026
- Publisher
- Sentaro AB, Stockholm. Sentaro is one of the products ranked.
- Sentaro price
- $6 per protected account per month, or $68 per year; first account free. Prices in USD.[1]
The 9 best email security tools for law firms compared
Ranked by overall score. “Not publicly documented” means we did not find it in the vendor’s public material on 21 October 2026, not that it is missing.
| Capability | Score | Deployment | Thread-hijack / supplier fraud | Outbound encryption | Public price | EU hosting |
|---|---|---|---|---|---|---|
| Sentaro (our pick)[2] | 8.0 | API, no MX change | YesMessage vector, live | No | Yes$6/account/month | YesSweden (Microsoft Azure); DPA public |
| Microsoft Defender for Office 365[9] | 7.3 | Native to Exchange Online | PartialImpersonation protection (Plan 1) | Paid add-onMessage Encryption add-on | YesPlan 1 $2, Plan 2 $5 | YesEU Data Boundary |
| Abnormal AI[12] | 6.9 | API, no MX change | YesBEC and vendor fraud named | Not publicly documented | NoQuote | PartialUS or EU (Ireland), by subscription |
| Proofpoint[14] | 6.2 | API or inline gateway | YesSupplier threats named | Not publicly documentedNot documented for Core | NoQuote | PartialEU or US data centre (API); some US processing |
| Libraesva[16] | 6.0 | Gateway plus API; on-prem option | YesAdaptive Trust AI | Yes | NoQuote | PartialLocal or chosen cloud |
| Mimecast[17] | 5.9 | Gateway (MX) or API | YesBEC featured | Not publicly documented | NoQuote | PartialFrankfurt (2018) |
| IRONSCALES[20] | 5.9 | API, alongside a gateway | YesBEC and VIP impersonation | Paid add-on360 and Pro tiers | NoTiers published, prices on quote | PartialAWS USA and Germany (subprocessor list) |
| Hornetsecurity[21] | 5.7 | MX, API or hybrid | Not publicly documentedNot named | YesPlan 1 and above | NoQuote via partners | Partial12 regional data centres (vendor) |
| Trustifi[23] | 5.5 | API, relay or MX | PartialBEC and spoofing named | YesOutbound Shield | NoQuote | Not publicly documented |
Prices in USD as published on 21 October 2026. Check each vendor’s current documentation before you buy.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
How we evaluated email security for law firms
A law firm’s biggest email losses come from fraud around client money and from mailbox takeovers that expose privileged material. Its IT is usually one person or an outside provider. The weights follow that order of priorities.
| Criterion | Weight | Why it matters |
|---|---|---|
| Client-funds and thread-hijack fraud detection | 25% | Changed account details inside a genuine matter or completion thread, and partner impersonation without a link or attachment, are the attacks bar associations warn about. Signature filters do not see them. |
| Confidentiality and data-handling transparency | 20% | Professional secrecy follows client information into every tool that reads mail. We score documented hosting, a public subprocessor list, retention and who can read mail. |
| Deployment and running effort for a lean firm | 15% | A firm without a security team needs something that works without MX changes, rules to maintain or daily triage. |
| Price transparency and total cost | 15% | Partners approve a published per-account price faster than a quote cycle, and the price should not depend on the tier you happen to negotiate. |
| Visibility of apps with mailbox access | 10% | Data-room tools, e-signature apps and AI assistants get mailbox and file access through OAuth grants. A rogue grant is a confidentiality breach without a single phishing click. |
| Encryption, archiving and DLP | 10% | Outbound encryption, archiving and DLP matter to many firms. They are often already covered by Microsoft Purview, Google Vault or a separate tool, so they carry less weight here. |
| Certifications and maturity | 5% | Certifications and a long track record help with client security questionnaires, but they do not stop an injected reply. |
Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Each per-criterion score has a one-line justification in our source file and a public source listed below.
The 9 best email security tools for law firms, ranked
Every entry uses the same structure: what it is, who it fits, what it costs, how it deploys and where it is hosted.
Sentaro
Our pickOverall score: 8.0out of 10Best for: European law firms on Microsoft 365 or Google Workspace that move client money and have no security team to tune a gateway.
Sentaro is an API-based email and SaaS security platform for Microsoft 365 and Google Workspace, built in Stockholm and hosted in Sweden on Microsoft Azure. For a law firm, its Message vector is the part that matters: it reads relationship and thread context, so a “please use our new account” reply injected into a real completion thread, or a partner impersonation with no link or attachment, is scored before anyone acts on it. The App vector shows every app and OAuth grant with access to lawyers’ mail and files. Verdicts show their reasoning in the console, so the risk partner can see why a message was blocked.[1]
- Client-funds and thread-hijack fraud detection
- 9.0
- Confidentiality and data-handling transparency
- 8.0
- Deployment and running effort for a lean firm
- 10.0
- Price transparency and total cost
- 10.0
- Visibility of apps with mailbox access
- 9.0
- Encryption, archiving and DLP
- 1.0
- Certifications and maturity
- 3.0
Pros
- Built for the quiet attacks law firms suffer: changed account details in a matter thread, injected replies, partner impersonation without a payload.
- Connects over the Microsoft 365 and Google Workspace APIs in four minutes; the firm’s MX record and mail routing do not change.
- Shows which apps and AI tools have been granted access to mailboxes and files, and revokes risky grants in one click.
- Nobody at Sentaro reads your mail in the course of providing the service; the DPA names the narrow exceptions and every subprocessor.
Cons
- No outbound encryption, archiving or DLP; keep Microsoft Purview, Google Vault or a dedicated encryption tool for those.
- Alerts when lookalikes of your firm’s domain are registered are Identity vector, Q4 2026; Sentaro cannot see mail sent to your clients’ inboxes.
- SOC 2 and ISO 27001 certification in progress, and no named law-firm customer is published yet.
- Pricing
- $6 per protected account per month or $68 per year; first account free (USD)
- Deployment
- API via the Microsoft 365 and Google Workspace admin SDKs; no MX change
- Platforms
- Microsoft 365, Google Workspace, Slack, Teams
- Hosting
- Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA
Microsoft Defender for Office 365
Best native baselineOverall score: 7.3out of 10Best for: Firms on Microsoft 365 Business Premium or E3 that want to switch on what they already pay for before adding anything.
Microsoft’s own layer for Exchange Online. Built-in protection covers every cloud mailbox; Plan 1 adds user and domain impersonation protection, mailbox intelligence, Safe Links and Safe Attachments, and Plan 2 adds Threat Explorer, automated investigation and attack simulation training. Plan 1 is included in Microsoft 365 Business Premium and is rolling out to Microsoft 365 and Office 365 E3 in 2026. Microsoft 365 is an EU Data Boundary service for tenants signed up in the EU or EFTA.[9]
- Client-funds and thread-hijack fraud detection
- 6.0
- Confidentiality and data-handling transparency
- 9.0
- Deployment and running effort for a lean firm
- 9.0
- Price transparency and total cost
- 9.0
- Visibility of apps with mailbox access
- 3.0
- Encryption, archiving and DLP
- 5.0
- Certifications and maturity
- 9.0
Pros
- Already licensed in Business Premium and, from 2026, E3, so the cost is often zero.
- Impersonation protection, Safe Links (including QR-code destinations) and Safe Attachments in Plan 1.
- EU Data Boundary for EU and EFTA tenants.
Cons
- Microsoft 365 only; a firm on Google Workspace gets nothing from it.
- App governance, archiving and DLP are separate Microsoft products.
- No dedicated vendor-email-compromise feature is documented in Plan 1 or Plan 2.
- Pricing
- Plan 1 $2, Plan 2 $5 per user/month (annual); Plan 1 included in Business Premium and, from 2026, Microsoft 365 and Office 365 E3
- Deployment
- Native to Exchange Online, in the mail flow
- Platforms
- Microsoft 365 only
- Hosting
- EU Data Boundary for tenants signed up in the EU/EFTA (Multi-Geo excluded)
Abnormal AI
Best for large firmsOverall score: 6.9out of 10Best for: Large international firms that want an enterprise behavioral platform with a long certification list and can run a sales-led purchase.
Abnormal AI builds a behavioral baseline for every employee and vendor and flags deviations using identity, behavioral and content signals, connected over API with no MX change. It names BEC and vendor fraud explicitly, sells account takeover protection and an AI phishing coach, and lists ISO 27001, ISO 27701, ISO 42001, SOC 2 Type II and FedRAMP Moderate in its trust center. Pricing is not published; its subprocessor list names AWS hosting in the US or the EU (Ireland), set by subscription.[12]
- Client-funds and thread-hijack fraud detection
- 9.0
- Confidentiality and data-handling transparency
- 7.0
- Deployment and running effort for a lean firm
- 9.0
- Price transparency and total cost
- 3.0
- Visibility of apps with mailbox access
- 5.0
- Encryption, archiving and DLP
- 4.0
- Certifications and maturity
- 10.0
Pros
- Detection designed around behavior and vendor relationships, the same problem space as client-funds fraud.
- The longest certification list in this ranking.
- API deployment with no MX change.
Cons
- Quote-based pricing and an enterprise focus (vendor: more than 30% of the Fortune 500).
- EU (Ireland) hosting is a subscription choice; the US is the other listed location.
- No archiving or outbound encryption documented.
- Pricing
- Quote-based
- Deployment
- API (ICES); no MX change
- Platforms
- Microsoft 365, Google Workspace
- Hosting
- Subprocessor list (updated 31 July 2026): AWS in the US or the EU (Ireland), set by subscription
Proofpoint
Best enterprise suiteOverall score: 6.2out of 10Best for: Large firms that want gateway or API protection plus DLP, archiving and DMARC from one vendor.
Proofpoint Core Email Protection deploys via API (Microsoft Graph, no MX change) or as an inline gateway, and names BEC and supplier threats on its product page. The add-on catalogue is the deepest here: Email Fraud Defense for DMARC and lookalike domains, Adaptive Email DLP, Account Takeover Protection, ZenGuide training and Digital Communications Governance for archiving. Proofpoint completed its acquisition of Hornetsecurity in December 2025. Prices are not published. Its Core Email Protection API privacy sheet says tenants are assigned to an EU or US data centre, with some processing and storage in the US.[14]
- Client-funds and thread-hijack fraud detection
- 8.0
- Confidentiality and data-handling transparency
- 6.0
- Deployment and running effort for a lean firm
- 6.0
- Price transparency and total cost
- 3.0
- Visibility of apps with mailbox access
- 4.0
- Encryption, archiving and DLP
- 9.0
- Certifications and maturity
- 6.0
Pros
- Gateway or API deployment from one vendor.
- DLP, archiving, DMARC and account-takeover add-ons for firms that want one contract.
- Supplier-threat detection named on the product page.
Cons
- Quote-based pricing; most capabilities are add-ons.
- Some email data may be processed and stored in the US even for EU tenants, per its API privacy sheet (July 2026).
- The vendor states 48 hours for API deployment, longer than the API-first tools here.
- Pricing
- Quote-based
- Deployment
- API (via Microsoft Graph) or inline gateway
- Platforms
- Microsoft 365, Google Workspace
- Hosting
- Core Email Protection API: tenant assigned to an EU or US data centre, with some processing and storage in the US (data privacy sheet, July 2026)
Libraesva
Best on-premises option in EuropeOverall score: 6.0out of 10Best for: Firms whose secrecy policy requires mail to be filtered on their own hardware or in a private cloud they choose.
Libraesva is an Italian email security gateway with API integration for Microsoft 365 and Google Workspace. It runs in its cloud, a private cloud or on-premises, and describes small language models running on customer hardware with no off-site processing. Its “Semantic AI” reads intent and “Adaptive Trust AI” maps communication patterns for BEC. Archiving, DMARC (LetsDMARC) and phishing simulation (PhishBrain) are separate products. Hosting regions and certifications are not listed.[16]
- Client-funds and thread-hijack fraud detection
- 7.0
- Confidentiality and data-handling transparency
- 8.0
- Deployment and running effort for a lean firm
- 5.0
- Price transparency and total cost
- 3.0
- Visibility of apps with mailbox access
- 4.0
- Encryption, archiving and DLP
- 8.0
- Certifications and maturity
- 4.0
Pros
- On-premises and private-cloud deployment, which no API-only service offers.
- Analysis that can stay on the firm’s own hardware.
- Archiving, DMARC and awareness products from the same group.
Cons
- A gateway project, with no published setup time.
- Prices on request; certifications not listed.
- OAuth app visibility not documented.
- Pricing
- Quote-based
- Deployment
- Gateway plus API integration; cloud, private cloud or on-premises
- Platforms
- Microsoft 365, Google Workspace, on-premises Exchange
- Hosting
- Vendor says it "runs locally or in your chosen cloud"; regions not listed
Mimecast
Best for archiving and continuityOverall score: 5.9out of 10Best for: Firms that need a compliance archive, continuity during outages or support for on-premises Exchange.
Mimecast offers a Cloud Gateway (MX) and a Cloud Integrated API product for Microsoft 365, and has protected organizations since 2003. Its detection uses social graphing, sandboxing, on-click URL protection and computer vision for brand and login-page impersonation, and it names BEC and QR-code phishing. Email Archive is a core product; DMARC Analyzer, awareness training and Incydr DLP are add-ons. A 2018 trade-press report, seen via a search summary, says Mimecast opened two Frankfurt data centres; the current footprint was not re-confirmed.[17]
- Client-funds and thread-hijack fraud detection
- 7.0
- Confidentiality and data-handling transparency
- 6.0
- Deployment and running effort for a lean firm
- 7.0
- Price transparency and total cost
- 3.0
- Visibility of apps with mailbox access
- 4.0
- Encryption, archiving and DLP
- 8.0
- Certifications and maturity
- 5.0
Pros
- Email Archive and a long continuity heritage.
- Gateway or API in one vendor, and on-premises or hybrid Exchange support.
- QR-code phishing and BEC named on the product page.
Cons
- Quote-based pricing; DMARC, training and DLP are add-ons.
- EU data-centre footprint last confirmed in 2018 material.
- OAuth app visibility not documented.
- Pricing
- Quote-based
- Deployment
- Cloud Gateway (MX) or Cloud Integrated (API)
- Platforms
- Microsoft 365, Google Workspace, on-premises and hybrid Exchange
- Hosting
- Frankfurt data centres announced in 2018; current footprint not re-confirmed
IRONSCALES
Best for training bundledOverall score: 5.9out of 10Best for: Small and mid-size firms, often through an MSP, that want phishing simulation in the same contract.
IRONSCALES connects at mailbox level over API and works alongside an existing gateway. It builds behavioral baselines per mailbox and adds community threat intelligence from other customers’ reports, names BEC, VIP impersonation and QR lures, and bundles phishing simulation and awareness training in its Complete Protect tier. Encryption and DLP sit in the Email Protect 360 and Pro tiers. Plan tiers are published; prices are on request.[20]
- Client-funds and thread-hijack fraud detection
- 7.0
- Confidentiality and data-handling transparency
- 5.0
- Deployment and running effort for a lean firm
- 9.0
- Price transparency and total cost
- 4.0
- Visibility of apps with mailbox access
- 4.0
- Encryption, archiving and DLP
- 6.0
- Certifications and maturity
- 4.0
Pros
- Deploys in minutes beside an existing gateway.
- Phishing simulation and training in the same platform.
- Large MSP footprint (vendor: 3,000+ MSPs), useful if an MSP runs your IT.
Cons
- Prices on request.
- Subprocessor list names AWS in both the USA and Germany without saying who is hosted where.
- No archiving documented.
- Pricing
- Quote-based (plan tiers published, prices not)
- Deployment
- API at mailbox level; works alongside a gateway
- Platforms
- Microsoft 365, Google Workspace
- Hosting
- Subprocessor list names AWS in the USA and AWS Europe (Germany) for the primary application platform
Hornetsecurity
Best Microsoft 365 suite via an MSPOverall score: 5.7out of 10Best for: Small firms on Microsoft 365 whose IT partner wants filtering, encryption, archiving and backup in one tiered licence.
Hornetsecurity, from Hanover and owned by Proofpoint since December 2025, sells 365 Total Protection in four plans: filtering and automated encryption (Plan 1), AI-based advanced threat protection, continuity and archiving (Plan 2), Microsoft 365 backup (Plan 3), and awareness training, permission management and DMARC management (Plan 4). It runs in MX, API or hybrid mode and states “12 regional data centers, independent of Microsoft’s infrastructure”. It is sold through partners; Google Workspace support is not confirmed on its pages.[21]
- Client-funds and thread-hijack fraud detection
- 4.0
- Confidentiality and data-handling transparency
- 8.0
- Deployment and running effort for a lean firm
- 6.0
- Price transparency and total cost
- 3.0
- Visibility of apps with mailbox access
- 5.0
- Encryption, archiving and DLP
- 10.0
- Certifications and maturity
- 5.0
Pros
- Encryption, archiving, continuity and backup in one tiered licence.
- European heritage and regional data centres.
- A very large partner channel: 12,000+ MSPs and channel partners, per Proofpoint’s December 2025 release.
Cons
- BEC-specific detection not named on the product page.
- Microsoft 365 focus; Google Workspace not confirmed.
- No published prices.
- Pricing
- Quote-based, sold through partners
- Deployment
- MX, API or hybrid modes
- Platforms
- Microsoft 365 (Google Workspace not confirmed on vendor pages)
- Hosting
- Vendor states "12 regional data centers, independent of Microsoft’s infrastructure"; German data centres per third-party profiles
Trustifi
Best for outbound encryptionOverall score: 5.5out of 10Best for: Firms whose first requirement is encrypting outgoing client mail and applying DLP, with inbound filtering in the same tool.
Trustifi, based in Las Vegas, pairs Inbound Shield with Outbound Shield, which it describes as automated outbound email security with data loss prevention, encryption and compliance for sensitive information. It also sells archiving, account takeover protection, awareness training and email MDR, and has a law-firm industry page. Trustifi says it connects to Microsoft 365 and Gmail by API or relay without an MX change. Pricing, EU hosting and certifications are not publicly documented.[23]
- Client-funds and thread-hijack fraud detection
- 6.0
- Confidentiality and data-handling transparency
- 4.0
- Deployment and running effort for a lean firm
- 8.0
- Price transparency and total cost
- 3.0
- Visibility of apps with mailbox access
- 4.0
- Encryption, archiving and DLP
- 9.0
- Certifications and maturity
- 4.0
Pros
- Outbound encryption and DLP alongside inbound filtering.
- Archiving with e-discovery, account takeover protection and training as add-ons.
- API or relay deployment without an MX change, per its FAQ (read via a search summary; the page blocks automated access).
Cons
- No public pricing.
- EU hosting and certifications not documented.
- US-oriented compliance positioning (HIPAA, FINRA).
- Pricing
- Not publicly listed; third-party figures conflict
- Deployment
- API to Microsoft 365 and Gmail, SMTP relay, or MX
- Platforms
- Microsoft 365, Google Workspace, SMTP-based systems via relay
- Hosting
- Not publicly documented
How should a law firm choose email security?
Start from how money and privileged information leave the firm, not from a feature list. In May 2025 Sveriges advokatsamfund, the Swedish Bar Association, warned members that several law firms had been hit by fraud using forged emails made to look as if they came from a law firm. In the FBI’s Internet Crime Report 2025, legal services were the most reported industry among more than 1,400 ransomware complaints from organizations outside the US critical-infrastructure sectors, at 18% (US data). Both point to the same two risks: payment fraud and mailbox compromise.
Test the tool on the attack you fear most
Ask each vendor how it handles a reply injected into a real matter thread that asks the accounts team to use a new account before completion, with no link and no attachment. Then ask to see what the admin sees when it flags one. A tool that only checks links, attachments and sender reputation will pass that message.
Map professional secrecy to the vendor’s paperwork
In Sweden, Rättegångsbalken chapter 8, section 4 requires an advokat to keep confidential what they learn in their professional work, and other member states have equivalent rules. GDPR Article 32 asks for security appropriate to the risk, and Article 33 for breach notification within 72 hours. Law firms are not a listed NIS2 sector, but their covered clients must manage supplier security under NIS2 Article 21(2)(d), which is why security questionnaires reach firms. Before connecting a tenant, read the vendor’s DPA with the partner responsible for risk: where data is hosted, which subprocessors are involved and where, how long raw mail is kept, and who can read it. This is general information, not legal advice.
Decide whether you still need a gateway
An API-based tool sits inside Microsoft 365 or Google Workspace and leaves mail routing alone. A gateway sits in front of it and brings archiving, continuity and on-premises options. If your archive and encryption already live in Microsoft Purview, Google Vault or a dedicated tool, a gateway mostly duplicates the native filtering you already pay for.
Keep the call-back routine
No email tool sees the messages criminals send to your clients pretending to be you, and none inspects a phone call. Tell clients at engagement that the firm never changes account details by email, confirm every change on a number from the file, and have two people release client funds.
Questions to ask every vendor
- How do you detect a changed bank account in an existing thread when the message has no link or attachment?
- Where is our mail processed and stored, which subprocessors are involved, and in which countries?
- Who at your company can read our mail, and under what logged conditions?
- How long do you keep raw messages, quarantined items and metadata, and what happens at termination?
- Which apps and OAuth grants in our tenant can you see, and can we revoke them from your console?
- What is the full price per mailbox for the features we need, and which features are in a higher tier?
Certification and compliance status
Sentaro’s status, stated exactly. Useful when a client’s security questionnaire asks about your email security vendor.
- SOC 2
- In progressNo target date published. Evidence pack on request.
- ISO 27001
- In progressNo target date published.
- Google CASA
- Verified API integration
- DPA and subprocessor list
- Public[3]
- NIS2, DORA and SOC 2 evidence pack
- On requestAvailable from hello@sentaro.com.
Frequently asked questions
What is the best email security for law firms?
Sentaro, for European law firms on Microsoft 365 or Google Workspace. It detects changed payment instructions in matter threads, injected replies and partner impersonation without a link or attachment, shows its reasoning on every verdict, and connects over API in four minutes without changing mail routing. It costs $6 per protected account per month, first account free (prices in USD). Microsoft Defender for Office 365 and Abnormal AI are the next strongest on our method.
What is the biggest email threat to a law firm?
Payment-instruction fraud around client funds and completions, followed by mailbox takeover through credential phishing. The Swedish Bar Association warned in May 2025 that several firms had been hit by fraud using forged law-firm emails. The fraudulent message often sits in a genuine thread and carries no malware, so detection has to come from behavior and context, backed by a phone call-back routine.
Do law firms need encrypted email?
Many do, for sending privileged documents to clients and counterparties. Encryption protects mail in transit to the recipient; it does not stop an injected reply or a phishing page. Microsoft offers Message Encryption as an add-on, and Trustifi, Hornetsecurity and Libraesva include encryption. Sentaro does not encrypt outbound mail, so pair it with one of these if you need it.
Is Microsoft Defender for Office 365 enough for a law firm?
It is a solid baseline for spam, malware and impersonation, and it is often already licensed through Business Premium. Microsoft does not document a dedicated vendor-email-compromise or thread-hijack feature in Plan 1 or Plan 2, and it covers Microsoft 365 only. Many firms keep Defender and add an API-based layer for client-funds fraud; Sentaro is designed to run alongside it.
Does NIS2 apply to law firms?
Law firms are not a listed NIS2 sector. NIS2 still reaches them through their clients: covered entities must manage security in their relationships with direct suppliers and service providers under Article 21(2)(d), so they send law firms security questionnaires and contract clauses. A firm that also provides a listed service could be in scope for that activity.
Can an email security vendor read our privileged mail?
It depends on the vendor, so ask for the DPA. Sentaro’s analysis is automated and nobody at Sentaro reads your mail in the course of providing the service; the DPA names the narrow exceptions, keeps raw harmless email for 14 days, and lists every subprocessor and its location. Whether that fits your secrecy obligations is a judgment for the firm. This is not legal advice.
How much does email security cost for a 40-lawyer firm?
With Sentaro, 40 protected accounts paid monthly cost 39 × $6, or $234 per month, since the first account is free and shared aliases do not count (prices in USD, excluding taxes). Defender for Office 365 Plan 1 is $2 per user per month standalone or included in Business Premium. Abnormal, Proofpoint, Mimecast, Libraesva, Hornetsecurity, IRONSCALES and Trustifi quote on request.
Why does Sentaro rank itself first?
Sentaro publishes this page and Sentaro is our product, so we say so at the top. The ranking follows a published method: seven weighted criteria chosen for European law firms, with per-criterion scores from public documentation. Sentaro scores lowest of all nine on encryption, archiving and DLP, and low on certifications, and we show both.
Sources and method
Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Product capabilities and prices change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Sentaro pricing
- Sentaro: platform (API deployment, Vord engine, vectors)
- Sentaro Data Processing Agreement and subprocessor list
- Sveriges advokatsamfund: Advokatsamfundet varnar för bedrägerier via e-post (20 May 2025)
- Rättegångsbalk (1942:740), chapter 8, section 4, Riksdagen
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- FBI IC3 Internet Crime Report 2025
- Microsoft Learn: Why do I need Microsoft Defender for Office 365? (accessed 2026-10-18)
- Microsoft: Defender for Office 365 pricing (accessed 2026-10-18)
- Microsoft Learn: EU Data Boundary (accessed 2026-10-18)
- Abnormal AI: Inbound Email Security (accessed 2026-10-18)
- Abnormal AI: Trust center (certifications)
- Proofpoint: Core Email Protection (accessed 2026-10-18)
- Libraesva: Home page (accessed 2026-10-18)
- Libraesva: Proofpoint vs Libraesva (deployment options)
- Mimecast: Email Security (accessed 2026-10-18)
- Datacentre News: Mimecast opens two Frankfurt data centres (2018)
- IRONSCALES: Home page (accessed 2026-10-18)
- IRONSCALES: Pricing (accessed 2026-10-18)
- Hornetsecurity: 365 Total Protection (accessed 2026-10-18)
- Hornetsecurity: Email security modes
- Trustifi: product overview (llms.txt) (accessed 2026-10-21)
- Trustifi: FAQ (deployment by API or relay) (accessed 2026-10-21)
- Abnormal AI: Subprocessors (updated 31 July 2026; accessed 2026-10-21)
- Proofpoint: Data privacy information sheet, Core Email Protection API (updated 24 July 2026; accessed 2026-10-21)
- Proofpoint: Third-party service providers and subprocessors (updated 14 October 2026; accessed 2026-10-21)
- IRONSCALES: List of current sub-processors (PDF, December 2024; accessed 2026-10-21)