[{"data":1,"prerenderedAt":709},["ShallowReactive",2],{"money-live:best":3,"money:best:email-security-for-public-sector":4,"money-links:\u002Fen\u002Fbest\u002Femail-security-for-public-sector":676},true,{"page":5},{"family":6,"bestCategory":7,"slug":8,"navLabel":9,"hubBlurb":10,"icon":11,"eyebrow":12,"h1":13,"lede":14,"seoTitle":13,"seoDescription":15,"reviewed":16,"heroChips":17,"schema":22,"aliases":23,"mentions":26,"sections":51,"faqs":556,"sources":578,"disclaimer":653,"related":654,"cta":673},"best","segments","email-security-for-public-sector","Best email security for the public sector","Nine email security tools for EU authorities, regions and municipalities, scored on targeted phishing, data location, procurement and effort.","building-2","Best tools · Public sector","9 Best Email Security Tools for the Public Sector (2026)","The best email security for EU public-sector organizations on Microsoft 365 and Google Workspace in 2026 is Sentaro, an API-based platform hosted in Sweden on Microsoft Azure that detects targeted phishing and supplier fraud by behavior, publishes its price and its DPA, and connects in four minutes without rerouting mail. The other strong options are Microsoft Defender for Office 365 as the native baseline, Google Workspace’s built-in protection for Workspace tenants, and European gateways such as Libraesva and Retarus where on-premises or German hosting is required.","Nine email security tools for EU authorities and municipalities, scored on targeted phishing, data location, procurement transparency and IT effort. 2026.","2026-10-21",[18,19,20,21],"9 tools compared","NIS2 and cybersäkerhetslagen","Data location and procurement","Last verified 21 October 2026","itemlist",[24,25],"best email security for government","best email security for municipalities",[27,31,33,36,38,41,43,45,47,49],{"name":28,"type":29,"sameAs":30},"NIS 2 Directive","Legislation","https:\u002F\u002Fwww.wikidata.org\u002Fwiki\u002FQ130213702",{"name":32,"type":29},"Cybersäkerhetslagen",{"name":34,"type":35},"Microsoft Defender for Office 365","SoftwareApplication",{"name":37,"type":35},"Google Workspace",{"name":39,"type":40},"Libraesva","Organization",{"name":42,"type":40},"Retarus",{"name":44,"type":40},"Hornetsecurity",{"name":46,"type":35},"NoSpamProxy",{"name":48,"type":40},"Mailinblack",{"name":50,"type":40},"GLIMPS",[52,69,92,115,226,254,486,496,521,526,530],{"t":53,"title":54,"summary":55,"points":56},"verdict","Our recommendation","Sentaro is the best email security for EU authorities, regions and municipalities on Microsoft 365 and Google Workspace. Public inboxes are open by design, so the dangerous email is not the obvious spam but the lure built for a case handler, a payroll team or an official, and the supplier whose bank details “change” before a large invoice. Sentaro detects those by intent and relationship context, is run by a small IT team, and is bought at a published price against a public DPA. Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.",[57,60,63,66],{"label":58,"text":59},"Why Sentaro wins","Behavioral detection for targeted and AI-written phishing, vendor-compromise detection for supplier invoices, and an inventory of every app and OAuth grant in the tenant, live in the Message and App vectors (sentaro.com\u002Fen\u002Fplatform).",{"label":61,"text":62},"Easy to procure and run","$6 per protected account per month, or $68 per account per year, every feature included; the first account is free. Prices in USD (sentaro.com\u002Fen\u002Fpricing). Connects over API in four minutes; no MX changes, no agents.",{"label":64,"text":65},"Data location in writing","Hosted in Sweden on Microsoft Azure, with the primary database in Frankfurt and its subprocessors, including some outside the EU, listed in the DPA (sentaro.com\u002Fen\u002Flegal\u002Fdpa). The Sovereign plan adds dedicated EU tenancy.",{"label":67,"text":68},"Consider another vendor only if","You need on-premises deployment, hosting in one specific country, a signed ISO 27001 certificate today, or encryption and archiving from the same vendor. Sentaro has no named public-sector customer published yet.",{"t":70,"items":71},"picks",[72,76,79,83,86,89],{"label":73,"vendor":74,"reason":75,"own":3},"Best overall for public bodies","Sentaro","Targeted-phishing and supplier-fraud detection, published price, public DPA, four-minute setup.",{"label":77,"vendor":34,"reason":78},"Best native baseline on Microsoft 365","Included in many public-sector licences and covered by the EU Data Boundary.",{"label":80,"vendor":81,"reason":82},"Best native baseline on Google Workspace","Google Workspace built-in protection","Included in every plan, with a Europe data region on Business Standard and above.",{"label":84,"vendor":39,"reason":85},"Best for on-premises deployment","Gateway and API modes in its cloud, a private cloud or on-premises.",{"label":87,"vendor":42,"reason":88},"Best for German hosting","Munich and Frankfurt data centres and EU-operated AI, with ISO 27001.",{"label":90,"vendor":46,"reason":91},"Best for encrypted citizen correspondence","S\u002FMIME and PGP encryption with automatic certificate management, cloud or on-premises.",{"t":93,"title":94,"items":95},"facts","At a glance",[96,99,102,105,108,112],{"label":97,"value":98},"What we compared","Nine email security options public bodies in the EU shortlist: two native layers, one API-based (ICES) platform and six European gateway or API vendors.",{"label":100,"value":101},"Audience","Government agencies, regions, municipalities and municipal associations in the EU on Microsoft 365 or Google Workspace, run by a small IT team and bought through public procurement.",{"label":103,"value":104},"Method","Six weighted criteria (below), each scored 0–10 from the vendor’s public documentation. Not documented scores low-middle, never zero.",{"label":106,"value":107},"Last verified","21 October 2026. Competitor facts were collected on 18 and 21 October 2026.",{"label":109,"value":110,"source":111},"Swedish law in scope","Cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026, covers regions, municipalities and municipal associations.",2,{"label":113,"value":114},"Who wrote it","Sentaro, which ranks itself first. Every competitor fact is sourced at the bottom of the page.",{"t":116,"id":116,"title":117,"intro":118,"columns":119,"groups":126,"footnote":225},"compare","Summary: public-sector email security, side by side","Overall editorial score, then what a public-sector buyer checks first. Sentaro is our product.",[120,121,122,123,124,125],"Score","Deployment","Platforms","Hosting","Public price","Best for",[127],{"rows":128},[129,142,153,164,176,186,196,205,214],{"label":130,"cells":131,"source":141},"Sentaro (our pick)",[132,133,134,135,138,140],"8.1","API, no MX change","Microsoft 365, Google Workspace",{"mark":136,"text":137},"yes","Sweden (Microsoft Azure); see DPA",{"mark":136,"text":139},"$6 per account\u002Fmonth","Authorities and municipalities on cloud mail",7,{"label":34,"cells":143,"source":152},[144,145,146,147,149,151],"7.5","Native to Exchange Online","Microsoft 365",{"mark":136,"text":148},"EU Data Boundary",{"mark":136,"text":150},"Plan 1 $2, Plan 2 $5","Every Microsoft 365 tenant",11,{"label":81,"cells":154,"source":163},[155,156,37,157,160,162],"6.3","Native to Gmail",{"mark":158,"text":159},"partial","Europe data region (edition-dependent)",{"mark":136,"text":161},"Included in Workspace plans","Every Workspace tenant",13,{"label":39,"cells":165,"source":175},[166,167,168,169,171,174],"6.2","Gateway plus API; cloud or on-premises","Microsoft 365, Google Workspace, on-premises Exchange",{"mark":158,"text":170},"Local or chosen cloud",{"mark":172,"text":173},"no","Quote","On-premises or private cloud",16,{"label":42,"cells":177,"source":185},[178,179,180,181,183,184],"5.7","Gateway (MX) or API connector","Microsoft 365 (Workspace planned)",{"mark":136,"text":182},"Munich and Frankfurt",{"mark":172,"text":173},"German hosting",18,{"label":44,"cells":187,"source":195},[188,189,146,190,192,194],"5.4","MX, API or hybrid",{"mark":136,"text":191},"12 regional data centres (vendor)",{"mark":172,"text":193},"Quote via partners","Suite bought through an MSP",20,{"label":46,"cells":197,"source":204},[198,199,146,200,202,203],"5.2","Gateway (MX); cloud or on-premises",{"mark":158,"text":201},"European data centres (cloud); on-premises option",{"mark":172,"text":173},"Encrypted correspondence",23,{"label":48,"cells":206,"source":213},[207,208,146,209,211,212],"5.1","SaaS or on-premises; Microsoft 365 API",{"mark":136,"text":210},"Developed and hosted in France (vendor)",{"mark":172,"text":173},"French local authorities",24,{"label":50,"cells":215,"source":224},[216,217,218,219,222,223],"4.7","API (Microsoft Graph)","Microsoft 365 (Gmail attachment scanning)",{"mark":220,"text":221},"unknown","Not publicly documented",{"mark":172,"text":173},"Malware analysis for French SOCs",26,"“Not publicly documented” means we could not find it in the vendor’s public material in October 2026, not that the capability is missing. Scores are editorial; see the method below.",{"t":227,"id":228,"title":229,"intro":230,"criteria":231,"note":253},"rubric","method","How we evaluated email security for the public sector","Public bodies differ from companies in three ways that shape the criteria: their addresses are public, so targeted lures blend into normal traffic; data location and contract documents are checked in procurement before anything is bought; and many IT teams are small. Criteria where established European gateways lead, such as certifications and on-premises options, are included at meaningful weight.",[232,236,239,243,246,250],{"name":233,"weight":234,"why":235},"Targeted phishing and supplier-fraud detection",25,"Lures aimed at case handlers, payroll and officials, and supplier bank-detail changes before an invoice, rarely carry malware. We score documented detection of payload-free, targeted attacks.",{"name":237,"weight":195,"why":238},"Data location and DPA transparency","Where citizens’ data in mailboxes is processed and stored, and whether a public DPA and subprocessor list let a DPO assess it before the tender.",{"name":240,"weight":241,"why":242},"Effort for a small IT team",15,"A municipality’s IT team cannot run a mail-routing project for every control. API deployment with no MX change scores highest.",{"name":244,"weight":241,"why":245},"Procurement transparency","A published price and plain terms make tenders, framework call-offs and budget approval faster, and let a pilot start without a sales cycle.",{"name":247,"weight":248,"why":249},"Microsoft 365, Workspace and app coverage",10,"Coverage of Microsoft 365 and Google Workspace, and visibility of the apps and AI tools connected to them.",{"name":251,"weight":241,"why":252},"Assurance and suite breadth","Certifications, on-premises options, encryption and archiving for records. European incumbents lead here.","Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Overall score = weighted average of the six criteria.",{"t":255,"id":255,"title":256,"intro":257,"items":258},"ranked","The 9 best email security tools for the public sector, ranked","Scores out of 10, highest first. Six of the other eight are European vendors; where one beats Sentaro on hosting, on-premises options or certifications, the entry says so.",[259,288,316,342,367,389,414,439,461],{"name":74,"own":3,"tag":260,"bestFor":261,"summary":262,"score":263,"scores":264,"pros":273,"cons":278,"pricing":282,"deployment":283,"platforms":284,"hosting":285,"to":286,"source":287},"Our pick","Authorities, regions and municipalities on Microsoft 365 or Google Workspace that want targeted-phishing and supplier-fraud protection a small team can run.","Built in Stockholm, Sentaro is an API-based platform that protects email and SaaS on Microsoft 365 and Google Workspace. Its Message vector reads every inbound and internal message before interaction, scoring intent, sender identity and relationship context, so a “supplementary document” behind a sign-in page or a supplier announcing new bank details stands out even when the sender is unknown or the mailbox is genuine. Its App vector lists every app, AI tool and OAuth grant in the tenant and blocks consent phishing. Verdicts are labeled in the mailbox, where staff read the mail.",8.1,[265,267,268,269,270,271],{"criterion":233,"score":266},9,{"criterion":237,"score":141},{"criterion":240,"score":248},{"criterion":244,"score":248},{"criterion":247,"score":248},{"criterion":251,"score":272},3,[274,275,276,277],"Catches targeted lures and supplier bank-detail changes without a payload.","Published price with every feature included; the first account is free for a pilot.","No mail-routing change, so nothing in your mail flow needs re-approval.","Public DPA and subprocessor list for your DPO’s assessment.",[279,280,281],"No named public-sector customer or case study published yet.","SOC 2 and ISO 27001 certification are in progress, not signed.","Cloud mailboxes only; no on-premises option, encryption or archiving.","$6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Sovereign plan: custom, annual.","API via the Microsoft 365 and Google Workspace admin SDKs; four minutes, no MX change, no agents.","Microsoft 365, Google Workspace, Slack, Teams","Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA","\u002Fen\u002Findustries\u002Fpublic-sector",8,{"name":34,"tag":289,"bestFor":290,"summary":291,"score":292,"scores":293,"pros":302,"cons":306,"pricing":310,"deployment":311,"platforms":312,"hosting":313,"to":314,"site":315,"source":266},"Best native baseline","Every public body on Microsoft 365, as the baseline layer.","Defender for Office 365 is Microsoft’s email protection in Exchange Online. Built-in protection for every cloud mailbox covers anti-malware, anti-spam and spoof intelligence; Plan 1 adds impersonation protection, Safe Links and Safe Attachments; Plan 2 adds Threat Explorer, automated investigation and attack simulation training. Plan 2 is included in Microsoft 365 E5, A5 and G5, and Plan 1 is rolling out to G3 and E3 from June 2026. Microsoft 365 is an EU Data Boundary service, with datacenters that include Sweden.",7.5,[294,296,297,298,299,301],{"criterion":233,"score":295},6,{"criterion":237,"score":266},{"criterion":240,"score":266},{"criterion":244,"score":287},{"criterion":247,"score":300},4,{"criterion":251,"score":287},[303,304,305],"Often already licensed: Plan 1 in Business Premium and, from 2026, G3 and E3; Plan 2 in G5.","EU Data Boundary, with datacenters in Sweden.","Covers Teams, SharePoint and OneDrive natively.",[307,308,309],"Microsoft 365 only.","No dedicated vendor-email-compromise feature found in Microsoft’s documentation.","OAuth app governance and archiving are separate products.","Plan 1 $2.00, Plan 2 $5.00 per user\u002Fmonth, paid yearly; included in several suites","Native to Exchange Online, in the mail flow","Microsoft 365 only","EU Data Boundary for EU\u002FEFTA tenants (Multi-Geo excluded)","\u002Fen\u002Fcompare\u002Fsentaro-vs-microsoft-defender-for-office-365","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fmdo-about",{"name":81,"tag":317,"bestFor":318,"summary":319,"score":320,"scores":321,"pros":328,"cons":332,"pricing":336,"deployment":156,"platforms":337,"hosting":338,"to":339,"site":340,"source":341},"Best on Google Workspace","Public bodies on Google Workspace, as the baseline layer.","Gmail’s built-in protection filters spam, phishing and malware for every Workspace plan, and admins can enable advanced phishing and malware settings: similar-domain and employee-name spoofing checks, link and attachment protections and warning banners. The Security Sandbox detonates attachments on Business Standard and above. Data regions let covered data be stored in Europe on Business Standard and above.",6.3,[322,323,324,325,326,327],{"criterion":233,"score":300},{"criterion":237,"score":141},{"criterion":240,"score":266},{"criterion":244,"score":287},{"criterion":247,"score":300},{"criterion":251,"score":295},[329,330,331],"Included in every Workspace plan.","Europe data region available on most paid editions.","Advanced Protection Program for high-risk officials.",[333,334,335],"Google Workspace only.","Google documents its BEC-related settings as spoofing and name checks; no behavioral model is documented.","Sandbox, data regions and DLP depend on the edition.","Included in Workspace plans (Business Starter to Plus: EUR 6.80 to 21.10 per user\u002Fmonth)","Google Workspace only","Europe data region on Business Standard and above","\u002Fen\u002Fcompare\u002Fsentaro-vs-google-workspace-security","https:\u002F\u002Fworkspace.google.com\u002Fsecurity\u002F",12,{"name":39,"tag":343,"bestFor":344,"summary":345,"score":346,"scores":347,"pros":355,"cons":359,"pricing":363,"deployment":364,"platforms":168,"hosting":365,"site":366,"source":175},"Best for on-premises","Authorities that must run email security on-premises or in a private cloud they choose.","Libraesva, part of the Italian LibraCyber group, offers an email security gateway with API integration for Microsoft 365 and Google Workspace, deployable in its cloud, a private cloud or on-premises, and says it “runs locally or in your chosen cloud”. It describes Adaptive Trust AI that maps communication patterns and sandboxing inside the customer environment, and sells Email Archiver, LetsDMARC and PhishBrain awareness separately. It offers a 30-day free trial.",6.2,[348,349,350,351,352,354],{"criterion":233,"score":295},{"criterion":237,"score":287},{"criterion":240,"score":295},{"criterion":244,"score":300},{"criterion":247,"score":353},5,{"criterion":251,"score":141},[356,357,358],"On-premises and private-cloud deployment.","Covers Microsoft 365, Google Workspace and on-premises Exchange.","30-day free trial.",[360,361,362],"Security certifications not listed on the pages we checked.","Cloud hosting regions not published.","Quote-based pricing.","Quote-based","Gateway plus API integration; cloud, private cloud or on-premises","Runs locally or in your chosen cloud; regions not listed","https:\u002F\u002Fwww.libraesva.com\u002F",{"name":42,"tag":87,"bestFor":368,"summary":369,"score":370,"scores":371,"pros":378,"cons":382,"pricing":363,"deployment":385,"platforms":386,"hosting":387,"site":388,"source":185},"Public bodies on Microsoft 365 that require hosting in Germany and EU-operated AI.","Retarus, an owner-managed Munich company founded in 1992, offers a secure email gateway and an API connector for Microsoft 365. Its documentation names two German data centres, Munich and Frankfurt; it says its AI components operate within the EU and customer data is not used externally for training. It lists ISO 27001 certification and sells encryption, archiving and continuity. Google Workspace is listed as planned.",5.7,[372,373,374,375,376,377],{"criterion":233,"score":300},{"criterion":237,"score":266},{"criterion":240,"score":353},{"criterion":244,"score":272},{"criterion":247,"score":272},{"criterion":251,"score":266},[379,380,381],"German data centres named in its documentation.","EU-operated AI, with customer data not used externally for training (vendor).","Encryption, archiving and continuity from the same vendor.",[383,384,362],"Google Workspace listed as planned only.","BEC not named on the product page.","Secure email gateway (MX) or API connector (ICES)","Microsoft 365 (Google Workspace listed as planned)","Munich and Frankfurt, Germany","https:\u002F\u002Fwww.retarus.com\u002Femail-security\u002F",{"name":44,"tag":390,"bestFor":391,"summary":392,"score":393,"scores":394,"pros":401,"cons":405,"pricing":409,"deployment":410,"platforms":146,"hosting":411,"to":412,"site":413,"source":195},"Best suite via an MSP","Municipalities that buy Microsoft 365 security, backup and archiving as one package through an IT partner.","Hornetsecurity, based in Hanover and part of Proofpoint since December 2025, sells 365 Total Protection in four plans, from filtering and encryption up to archiving, continuity, Microsoft 365 backup, awareness training and DMARC management. It offers MX, API and hybrid modes, states “12 regional data centers, independent of Microsoft’s infrastructure”, and sells mainly through 12,000+ MSPs and channel partners.",5.4,[395,396,397,398,399,400],{"criterion":233,"score":300},{"criterion":237,"score":141},{"criterion":240,"score":295},{"criterion":244,"score":272},{"criterion":247,"score":300},{"criterion":251,"score":287},[402,403,404],"Encryption, archiving, backup and training in one tiered licence.","Regional data centres independent of Microsoft’s infrastructure (vendor).","Large partner channel for organizations that outsource IT.",[406,407,408],"Google Workspace not covered by 365 Total Protection.","BEC and supplier-fraud detection not explicitly documented.","Quote-based pricing through partners.","Quote-based, sold through partners","MX, API or hybrid modes","“12 regional data centers” (vendor); German data centres per third-party profiles","\u002Fen\u002Fcompare\u002Fsentaro-vs-hornetsecurity","https:\u002F\u002Fwww.hornetsecurity.com\u002Fen\u002F365-total-protection\u002F",{"name":46,"tag":415,"bestFor":416,"summary":417,"score":418,"scores":419,"pros":426,"cons":430,"pricing":434,"deployment":435,"platforms":436,"hosting":437,"site":438,"source":204},"Best for encryption","German-speaking authorities whose main need is gateway filtering plus S\u002FMIME and PGP encryption, in the cloud or on-premises.","NoSpamProxy, from Net at Work GmbH in Paderborn, is a secure email gateway available as NoSpamProxy Cloud, upstream of Exchange Online through an MX change, or as NoSpamProxy Server on-premises. It names BEC and sender authentication, uses an AI-based metadata service called 32Guards, and is best known for S\u002FMIME and PGP encryption with automatic certificate management. It lists public institutions among its target customers.",5.2,[420,421,422,423,424,425],{"criterion":233,"score":353},{"criterion":237,"score":141},{"criterion":240,"score":300},{"criterion":244,"score":300},{"criterion":247,"score":272},{"criterion":251,"score":141},[427,428,429],"S\u002FMIME and PGP encryption with automatic certificate management.","Cloud or on-premises server.","German vendor with public institutions among its target customers.",[431,432,433],"The cloud version requires an MX change.","Google Workspace support not stated.","ISO 27001 not stated on the pages we checked.","Quote-based; modules priced separately, with a Suite bundle","Secure email gateway via MX; NoSpamProxy Cloud or NoSpamProxy Server (on-premises)","Microsoft 365 (Google Workspace not stated)","Cloud: certified data centres in Europe (vendor); on-premises option","https:\u002F\u002Fwww.nospamproxy.de\u002Fen\u002F",{"name":48,"tag":440,"bestFor":441,"summary":442,"score":443,"scores":444,"pros":451,"cons":455,"pricing":458,"deployment":459,"platforms":436,"hosting":210,"site":460,"source":234},"Best for French authorities","French local authorities and public bodies that want French-hosted filtering with awareness training.","Mailinblack, based in Marseille, sells Protect for email security alongside Cyber Coach and Cyber Academy awareness training and a password manager. It offers SaaS or on-premises deployment and a native API integration for Microsoft 365. Its sales material says Protect is developed and hosted in France, and its healthcare offer is HDS-certified. It lists local authorities and central government among its segments.",5.1,[445,446,447,448,449,450],{"criterion":233,"score":300},{"criterion":237,"score":287},{"criterion":240,"score":353},{"criterion":244,"score":300},{"criterion":247,"score":272},{"criterion":251,"score":295},[452,453,454],"Developed and hosted in France, per the vendor.","Awareness training and a password manager from the same vendor.","Public-sector segments named on its site.",[456,432,457],"BEC not named on its pages.","Price on request.","Quote-based; offers tiered by organization size","SaaS or on-premises; native API integration for Microsoft 365","https:\u002F\u002Fwww.mailinblack.com\u002Fen\u002F",{"name":50,"tag":462,"bestFor":463,"summary":464,"score":465,"scores":466,"pros":473,"cons":477,"pricing":481,"deployment":482,"platforms":483,"hosting":221,"site":484,"source":485},"Best for malware analysis","Public-sector SOCs in France that prioritize deep attachment and malware analysis on Microsoft 365.","GLIMPS, a French vendor based in Rennes, offers Email Security for Microsoft 365 through a native Microsoft Graph API integration that scans in parallel “without modifying your email infrastructure”, plus GLIMPS Malware for Gmail, SharePoint and OneDrive. It describes deep learning, machine learning and LLMs across 8 proprietary AI models, and shows an ANSSI public contract from 2022, which is a customer reference, not a certification. It offers a 30-day free trial.",4.7,[467,468,469,470,471,472],{"criterion":233,"score":272},{"criterion":237,"score":353},{"criterion":240,"score":287},{"criterion":244,"score":300},{"criterion":247,"score":300},{"criterion":251,"score":353},[474,475,476],"Code-level malware analysis heritage.","Graph API deployment without changing mail infrastructure.","Used by France’s ANSSI under a 2022 public contract.",[478,479,480],"BEC and supplier-fraud coverage not documented.","Hosting location not documented.","Full email security for Microsoft 365 only.","Quote-based; 30-day free trial","API via Microsoft Graph","Microsoft 365 (GLIMPS Malware for Gmail attachments)","https:\u002F\u002Fwww.glimps.re\u002Fen\u002F",27,{"t":487,"id":488,"title":489,"blocks":490},"prose","threats","What email threats hit EU public administration?",[491,494],{"t":492,"text":493},"p","ENISA’s Threat Landscape 2025, covering July 2024 to June 2025, found public administration to be the most targeted sector, at 38.2% of incidents with an identified sector, mostly through hacktivist DDoS, which no email product addresses. Under that volume sit the threats that reach inboxes: public administration was the most targeted sector for state-nexus cyberespionage, with 77 incidents, it accounted for 17% of recorded data breaches, and ransomware was particularly prevalent against municipalities. Across all sectors, phishing was the leading intrusion vector, at about 60% of observed cases.",{"t":492,"text":495},"Public addresses are the reason generic filtering falls short. Citizens, companies and journalists are supposed to email case handlers and registries, so an unknown sender with an attachment is normal traffic, and supplier relationships are often visible in procurement records, which makes invoice fraud easy to time.",{"t":487,"id":497,"title":498,"blocks":499},"how-to-choose","How to choose email security for an authority or municipality",[500,503,505,507,509,517,519],{"t":501,"text":502},"h3","Swedish municipalities and regions under cybersäkerhetslagen",{"t":492,"text":504},"Cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026, applies to regions, municipalities and municipal associations as well as the state agencies within its scope. Six county administrative boards supervise municipalities and regions. Significant incidents must be notified as soon as possible and at the latest within 24 hours, followed by an incident report within 72 hours and a final report within one month, to the CSIRT at Försvarets radioanstalt (FRA) since 1 July 2026. Management must complete training on security measures, and the sanction fee for a public operator can reach SEK 10 million.",{"t":492,"text":506},"Across the EU, NIS2 covers central-government public administration entities and, after a risk-based assessment, regional ones; Article 2(5) lets member states extend it to local government, as Sweden did. A personal data breach in a case handler’s mailbox is also a GDPR Article 33 matter, notified to the supervisory authority within 72 hours of awareness. No product makes an authority compliant with NIS2 or cybersäkerhetslagen; email security supplies the detection and the incident facts. This is general guidance, not legal advice.",{"t":501,"text":508},"Five questions for the tender or the pilot",{"t":510,"items":511},"ul",[512,513,514,515,516],"Where is mail processed and stored, and who are the subprocessors? Ask for the DPA and its subprocessor annex, not a hosting badge.","Who owns the vendor, and in which jurisdiction is its parent company? Your legal team decides what that means for you.","Does deployment change MX records or mail routing, and how long until the first protected mailbox?","What does it cost per mailbox, including add-ons, and can we pilot before the tender closes?","When a lure reaches several mailboxes, can we see who received it, whether anyone acted, and remove it everywhere in one action?",{"t":501,"text":518},"Cloud API, gateway or on-premises?",{"t":492,"text":520},"If your mail is in Microsoft 365 or Google Workspace, an API-based tool such as Sentaro adds detection without touching mail routing and runs behind Microsoft Defender or Gmail’s protection. If policy requires email security to run on your own servers, Libraesva, NoSpamProxy and Mailinblack offer on-premises deployment. If your main need is encrypted correspondence with citizens and other authorities, a gateway with S\u002FMIME and PGP, such as NoSpamProxy, does what Sentaro does not.",{"t":522,"tone":523,"title":524,"text":525},"callout","warn","Read the DPA before you buy","Sentaro is hosted in Sweden on Microsoft Azure, and its primary application database is hosted in Frankfurt. The DPA’s subprocessor list includes providers in the US and globally, among them a US AI provider for limited threat-signal analysis that may not train on customer data. Public bodies with strict data-location requirements should review Annex 3 of the DPA and ask about the Sovereign plan’s dedicated EU tenancy.",{"t":522,"tone":527,"title":528,"text":529},"roadmap","Roadmap: Identity and Behavioral vectors, Q4 2026","Everything scored on this page is live today: the Message vector (since Q2 2026) and the App vector (since Q3 2026). Identity (alerts when lookalikes of your authority’s domain are registered, leaked staff credentials) and Behavioral (impossible travel and anomalous sessions after a takeover, forced re-authentication) reach general availability in Q4 2026, included at no added cost. They are not counted in Sentaro’s scores.",{"t":531,"intro":532,"items":533},"certs","Sentaro’s exact status, so you can weigh the assurance criterion yourself.",[534,539,542,546,552],{"label":535,"status":536,"state":537,"text":538},"SOC 2","In progress","progress","No target date published; Sentaro says it will announce it the day it is signed, and not before.",{"label":540,"status":536,"state":537,"text":541},"ISO 27001","Evidence pack on request from hello@sentaro.com.",{"label":543,"status":544,"state":545},"Google CASA","Verified API integration","done",{"label":547,"status":548,"state":549,"text":550,"to":551},"DPA and subprocessor list","Public","info","Swedish law, SCCs for transfers, 24-hour incident notice, return or deletion within 30 days.","\u002Fen\u002Flegal\u002Fdpa",{"label":19,"status":553,"state":549,"text":554,"to":555},"Readiness support","Email-layer controls and incident facts; not a compliance guarantee.","\u002Fen\u002Fcompliance\u002Fcybersakerhetslagen",[557,560,563,566,569,572,575],{"q":558,"a":559},"What is the best email security for the public sector?","Sentaro — it is our pick for EU authorities, regions and municipalities on Microsoft 365 and Google Workspace. It detects targeted phishing and supplier fraud by behavior, connects over API in four minutes without rerouting mail, publishes its price ($6 per protected account per month, prices in USD) and its DPA, and is hosted in Sweden on Microsoft Azure. Check the DPA subprocessor list against your requirements. Sentaro publishes this list.",{"q":561,"a":562},"What is the best email security for Swedish municipalities?","For a kommun or region on Microsoft 365 or Google Workspace, we recommend Sentaro on top of Microsoft Defender or Gmail’s built-in protection. It is built in Stockholm and hosted in Sweden on Microsoft Azure, its team works in English and Swedish, and it supplies the incident facts cybersäkerhetslagen’s 24-hour notification depends on. Municipalities that need on-premises filtering or heavy encryption also shortlist Libraesva or NoSpamProxy.",{"q":564,"a":565},"Are Swedish municipalities covered by cybersäkerhetslagen?","Yes. Cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026, applies to regions, municipalities and municipal associations. Six county administrative boards supervise them by geographic area, and significant incidents are reported to the CSIRT, which has been Försvarets radioanstalt (FRA) since 1 July 2026.",{"q":567,"a":568},"Is Microsoft Defender enough for a public authority?","It is the right baseline on Microsoft 365, and often already licensed. Microsoft documents impersonation protection, Safe Links and Safe Attachments in Plan 1, but no dedicated vendor-email-compromise feature, and OAuth app governance is a separate product. Authorities that see supplier fraud or targeted lures usually add an API-based layer on top.",{"q":570,"a":571},"Do public bodies need EU-hosted email security?","NIS2 does not mandate EU hosting, but GDPR, national rules and your own policies may restrict where citizens’ data is processed. Assess each vendor’s DPA and subprocessor list. Sentaro is hosted in Sweden on Microsoft Azure and lists its subprocessors, including some outside the EU, in its DPA; Retarus documents German data centres; Libraesva and NoSpamProxy offer on-premises deployment.",{"q":573,"a":574},"Can we pilot email security before a tender?","With an API-based tool, yes, without touching mail routing. Sentaro’s first account is free and it connects in four minutes, so an IT team can see verdicts on real mail before writing requirements. Libraesva and GLIMPS offer 30-day free trials.",{"q":576,"a":577},"What criteria did you use for public bodies?","Six criteria weighted for EU public bodies: targeted phishing and supplier-fraud detection (25%), data location and DPA transparency (20%), effort for a small IT team (15%), procurement transparency (15%), assurance and suite breadth (15%) and platform coverage (10%). Scores come from public vendor documentation as of 21 October 2026, not lab tests. Sentaro wrote the page and ranks itself first.",[579,582,585,588,591,594,597,600,603,605,608,611,614,617,620,622,625,627,630,633,635,638,640,643,645,648,650],{"label":580,"url":581},"Directive (EU) 2022\u002F2555 (NIS2), EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Fdir\u002F2022\u002F2555\u002Foj\u002Feng",{"label":583,"url":584},"Cybersäkerhetslag (SFS 2025:1506)","https:\u002F\u002Fsvenskforfattningssamling.se\u002Fsites\u002Fdefault\u002Ffiles\u002Fsfs\u002F2025-12\u002FSFS2025-1506.pdf",{"label":586,"url":587},"Cybersäkerhetsförordning (SFS 2025:1507)","https:\u002F\u002Fsvenskforfattningssamling.se\u002Fsites\u002Fdefault\u002Ffiles\u002Fsfs\u002F2025-12\u002FSFS2025-1507.pdf",{"label":589,"url":590},"Förordning om ändring i cybersäkerhetsförordningen (SFS 2026:623)","https:\u002F\u002Fsvenskforfattningssamling.se\u002Fsites\u002Fdefault\u002Ffiles\u002Fsfs\u002F2026-05\u002FSFS2026-623.pdf",{"label":592,"url":593},"Regulation (EU) 2016\u002F679 (GDPR), EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj\u002Feng",{"label":595,"url":596},"ENISA Threat Landscape 2025 (October 2025)","https:\u002F\u002Fwww.enisa.europa.eu\u002Fpublications\u002Fenisa-threat-landscape-2025",{"label":598,"url":599},"Sentaro pricing","https:\u002F\u002Fsentaro.com\u002Fen\u002Fpricing",{"label":601,"url":602},"Sentaro Data Processing Agreement and subprocessor list","https:\u002F\u002Fsentaro.com\u002Fen\u002Flegal\u002Fdpa",{"label":604,"url":315},"Microsoft Learn: Why do I need Microsoft Defender for Office 365? (accessed 2026-10-18)",{"label":606,"url":607},"Microsoft: Defender for Office 365 pricing (accessed 2026-10-18)","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365",{"label":609,"url":610},"Microsoft Learn: EU Data Boundary (accessed 2026-10-18)","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fprivacy\u002Feudb\u002Feu-data-boundary-learn",{"label":612,"url":613},"Google Workspace Admin Help: Advanced phishing and malware protection","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fgmail\u002Fadvanced\u002Fadvanced-phishing-and-malware-protection",{"label":615,"url":616},"Google Workspace Admin Help: Data regions (accessed 2026-10-18)","https:\u002F\u002Fsupport.google.com\u002Fa\u002Fanswer\u002F7630496",{"label":618,"url":619},"Google Workspace pricing (accessed 2026-10-18)","https:\u002F\u002Fworkspace.google.com\u002Fpricing",{"label":621,"url":366},"Libraesva: Home page (accessed 2026-10-18)",{"label":623,"url":624},"Libraesva: Proofpoint vs Libraesva (deployment options)","https:\u002F\u002Fwww.libraesva.com\u002Fcompare\u002Fproofpoint-vs-libraesva",{"label":626,"url":388},"Retarus: Email Security (accessed 2026-10-21)",{"label":628,"url":629},"Retarus docs: Email Security data center operations (Munich and Frankfurt)","https:\u002F\u002Fdocs.retarus.com\u002Fseg\u002Fretarus-email-security-data-center-operations-cust",{"label":631,"url":632},"Retarus blog: ISO 27001 certification (KPMG)","https:\u002F\u002Fwww.retarus.com\u002Fblog\u002Fde\u002F?p=28557",{"label":634,"url":413},"Hornetsecurity: 365 Total Protection (accessed 2026-10-21)",{"label":636,"url":637},"Proofpoint: Proofpoint completes acquisition of Hornetsecurity (December 2025)","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fnewsroom\u002Fpress-releases\u002Fproofpoint-completes-acquisition-hornetsecurity",{"label":639,"url":438},"NoSpamProxy (Net at Work GmbH): Home page (accessed 2026-10-18)",{"label":641,"url":642},"NoSpamProxy Cloud (accessed 2026-10-21)","https:\u002F\u002Fwww.nospamproxy.de\u002Fen\u002Fnospamproxy-cloud\u002F",{"label":644,"url":460},"Mailinblack: Home page (accessed 2026-10-21)",{"label":646,"url":647},"Mailinblack: Protect Advanced presentation (French hosting)","https:\u002F\u002Fmarketing.cdn.mailinblack.com\u002Fmarketing\u002FSALES\u002FFR-presentation-Protect-advanced.pdf",{"label":649,"url":484},"GLIMPS: Home page (accessed 2026-10-21)",{"label":651,"url":652},"GLIMPS: Email security for Microsoft 365 (Graph API)","https:\u002F\u002Fwww.glimps.re\u002Fen\u002Fmicrosoft-365-email-protection","Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Product capabilities change; check each vendor’s current documentation. This is general guidance, not legal advice. Trademarks belong to their owners. Corrections: contact Sentaro.",[655,657,658,661,664,667,670],{"label":656,"to":286},"Email security for the public sector",{"label":32,"to":555},{"label":659,"to":660},"EU-sovereign email security","\u002Fen\u002Feu-sovereign-email-security",{"label":662,"to":663},"Best email security for NIS2 and DORA","\u002Fen\u002Fbest\u002Femail-security-for-nis2-and-dora",{"label":665,"to":666},"Best email security for financial services","\u002Fen\u002Fbest\u002Femail-security-for-financial-services",{"label":668,"to":669},"European email security alternatives","\u002Fen\u002Falternatives\u002Feuropean-email-security-alternatives",{"label":671,"to":672},"Pricing","\u002Fen\u002Fpricing",{"title":674,"note":675},"Public inboxes, protected without rerouting a single message.","Connect Microsoft 365 or Google Workspace in four minutes. The first account is free.",{"links":677,"only":701,"labels":704},[678,679,682,685,687,689,692,695,698],{"label":32,"to":555},{"label":680,"to":681},"GDPR","\u002Fen\u002Fcompliance\u002Fgdpr",{"label":683,"to":684},"NIS2","\u002Fen\u002Fcompliance\u002Fnis2",{"label":37,"to":686},"\u002Fen\u002Fplatforms\u002Fgoogle-workspace-email-security",{"label":146,"to":688},"\u002Fen\u002Fplatforms\u002Fmicrosoft-365-email-security",{"label":690,"to":691},"Invoice fraud","\u002Fen\u002Fsolutions\u002Finvoice-fraud",{"label":693,"to":694},"Phishing","\u002Fen\u002Fsolutions\u002Fphishing",{"label":696,"to":697},"Data Breach","\u002Fen\u002Fglossary\u002Fdata-breach",{"label":699,"to":700},"Ransomware","\u002Fen\u002Fglossary\u002Fransomware",{"6":702,"7":703},[700,694,691],[555,684,697,681,688],{"\u002Fen\u002Findustries\u002Fpublic-sector":705,"\u002Fen\u002Fcompare\u002Fsentaro-vs-microsoft-defender-for-office-365":706,"\u002Fen\u002Fcompare\u002Fsentaro-vs-google-workspace-security":707,"\u002Fen\u002Fcompare\u002Fsentaro-vs-hornetsecurity":708},"Public sector","Sentaro vs Microsoft Defender for Office 365","Sentaro vs Google Workspace security","Sentaro vs Hornetsecurity",1792761724933]