Best tools · EuropeVictor TräffWritten by Victor Träff · Security expert and co-founder, Sentaro Reviewed

10 best European email security providers for business (2026)

The best European email security for businesses on Microsoft 365 and Google Workspace in 2026 is Sentaro, from Sentaro AB in Stockholm: an API-based platform hosted in Sweden on Microsoft Azure, with a public DPA under Swedish law that lists every subprocessor. The other strong European options are Libraesva (Italy) for a gateway you can run on-premises, Retarus (Germany) for German-hosted gateway, continuity and archive, and Mailinblack (France) for French-hosted protection with training.

  • 10 providers ranked
  • HQ, hosting and DPA checked
  • Business security, not mailboxes
  • Last verified 21 Oct 2026
Start free with one accountSpeak to sales
Our recommendation

Sentaro is the best European email security for EU organizations on Microsoft 365 and Google Workspace. It is built and run by a Swedish company, hosted in Sweden on Microsoft Azure, and its DPA (governed by Swedish law, Stockholm courts) names every subprocessor and its location, including the few outside the EU. It connects over API in four minutes with no MX change, catches BEC and vendor fraud without a payload, and costs a published $6 per protected account per month (USD). Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.

Why Sentaro wins
a Swedish company with a public DPA and subprocessor list, an API deployment that needs no gateway, BEC detection that reads intent and relationship history, and a published price.
Choose Sentaro if
you want European email security for Microsoft 365 and Google Workspace that you can deploy this week and document for NIS2, DORA or GDPR from public papers.
Consider Libraesva, Retarus or NoSpamProxy only if
you need a gateway with continuity, archiving or S/MIME and PGP encryption, or want the filter on your own premises.
Not what you are looking for?
Proton, Tuta and Mailfence are encrypted mailbox providers, a different product category; see “Business email security vs encrypted mailboxes” below.

Quick picks

  • Best overall for EU teams on Microsoft 365 and Google WorkspaceSentaro Our pickSwedish, API-based, public DPA and subprocessor list, $6 per account per month.
  • Best on-premises or private-cloud gatewayLibraesvaItalian gateway with API integration that runs on-premises, in private cloud or in its cloud.
  • Best German-hosted gateway with continuityRetarusMunich-based, owner-managed; Munich and Frankfurt data centres; continuity, encryption and archive.
  • Best for French healthcare and public sectorMailinblackSays Protect is “developed & hosted in France”; lists an HDS-certified healthcare offer and training.
  • Best for S/MIME and PGP encryptionNoSpamProxyGerman gateway with automatic certificate management, on-premises or cloud.
  • Best EU-hosted native baselineMicrosoft Defender for Office 365Not European-owned, but an EU Data Boundary service already in your Microsoft 365 tenant.

At a glance

What we compared
9 European-headquartered business email security vendors plus Microsoft Defender for Office 365 as the EU-hosted baseline
Who it is for
Organizations in the EU and EEA that protect Microsoft 365 or Google Workspace mail and must document vendor jurisdiction, hosting and subprocessors
Not covered
Encrypted consumer and business mailboxes (Proton, Tuta, Mailfence): they replace your mail provider rather than protect it
Method
Seven weighted criteria, scored 0–10 from public vendor documentation; overall score = weighted average
Last verified
21 October 2026
Written by
Sentaro, a Swedish email security vendor ranked first on this list

Business email security vs encrypted mailboxes

Search for “European email security” and most results list encrypted mailbox providers such as Proton, Tuta and Mailfence. Those are email services: you move your mailboxes to them. This page is about business email security: products that protect the Microsoft 365 or Google Workspace mailboxes you already run against phishing, business email compromise (BEC), malware and account misuse.

Encrypted mailbox providerBusiness email security
What it isA replacement mail serviceA layer on top of Microsoft 365 or Google Workspace
Main jobKeep message content privateStop phishing, BEC and malware before someone acts on it
Typical buyerIndividuals, privacy-first teamsIT and security teams at organizations
ExamplesProton, Tuta, MailfenceSentaro, Libraesva, Retarus, NoSpamProxy

Encryption does not stop a convincing invoice-fraud email from a lookalike domain, and a phishing filter does not encrypt your mail. Some of the vendors below (NoSpamProxy, SEPPmail, Retarus) also sell outbound encryption for business mail.

European email security providers compared

One row per provider, in score order. “Not documented” means we could not find it in the vendor’s public material on 21 October 2026.

CapabilityScoreHeadquarters and ownerHosting (vendor-documented)DeploymentPlatformsPublic price
Sentaro (our pick)[1]8.6Stockholm, Sweden; Sentaro ABHosted in Sweden on Microsoft Azure; subprocessors in the DPAAPI, no MX changeMicrosoft 365, Google WorkspaceYes$6 per account/month
Libraesva[4]7.3Lecco, Italy; LibraCyber group“Runs locally or in your chosen cloud”; regions not listedGateway plus API; cloud or on-premisesMicrosoft 365, Google Workspace, ExchangeNoQuote
Retarus[7]6.9Munich, Germany; owner-managedMunich and Frankfurt data centresGateway (MX) or ICES connectorMicrosoft 365; Google Workspace plannedNoQuote
Microsoft Defender for Office 365[11]6.4US; Microsoft (baseline, not European)EU Data Boundary for EU/EFTA tenantsNativeMicrosoft 365YesPlan 1 $2, Plan 2 $5
Mailinblack[12]6.1Marseille, France; owner not documented“Developed & hosted in France”SaaS or on-premises; Microsoft 365 APIMicrosoft 365NoQuote, tiered by company size
NoSpamProxy[14]6.0Paderborn, Germany; Net at Work GmbHCloud location not stated; on-premises server optionGateway (MX); cloud or on-premisesMicrosoft 365NoQuote
Hornetsecurity[15]5.8Hanover, Germany; Proofpoint (US) since Dec 2025“12 regional data centers”MX, API or hybridMicrosoft 365NoQuote via partners
Vade[17]5.7France; Hornetsecurity, so ProofpointNot documentedAPI, no MX changeMicrosoft 365, Google WorkspaceNoQuote via MSPs
SEPPmail[20]5.5Neuenhof, Switzerland; SEPPmail AGSwiss and German data centresGateway or SEPPmail.cloudMicrosoft 365NoQuote
GLIMPS[21]5.4Rennes, France; VC-backedNot documentedAPI (Microsoft Graph)Microsoft 365; Gmail malware scanningNoQuote; 30-day trial

Editorial scores using the criteria and weights below; based on public documentation, not lab tests.

  • Yes
  • Partial
  • No
  • On roadmap
  • Paid add-on
  • Not publicly documented
Try it on your own tenant. API connection in about four minutes, alongside what you run today. $6 per account / month.Start freeSpeak to sales →

How we evaluated European email security

“European” can mean where a vendor is headquartered, who owns it, where it hosts your data, or where its subprocessors are. We score those separately, then weigh them against what the product actually does for a Microsoft 365 or Google Workspace tenant. Suite breadth is in the rubric because European gateway vendors genuinely lead on it.

CriterionWeightWhy it matters
European headquarters and ownership15%Headquarters and ownership decide the vendor’s home jurisdiction. Ownership can change without any product change, as Hornetsecurity and Vade show.
Documented hosting and DPA transparency15%Named data-centre locations and a public DPA with a subprocessor list are what you put in a GDPR record or a NIS2 supply-chain register. We reward disclosure, and we deduct where some processing sits outside the EU.
Microsoft 365 and Google Workspace support15%Many European organizations run Google Workspace as well as Microsoft 365. Several European vendors document Microsoft 365 only.
BEC and targeted-phishing detection20%Being European does not stop a single phishing email. BEC and targeted phishing are where most losses happen, so detection carries the most weight.
Deployment effort15%An API connection protects mailboxes the same day; an MX gateway needs routing changes and a migration plan.
Price transparency10%A published price lets a buyer compare without a sales cycle.
Suite breadth and on-premises options10%Encryption, archiving, continuity and an on-premises option are real requirements for some regulated buyers, and gateway vendors lead here.

Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Every score has a one-line reason in our source file. Unknown capabilities score as “not documented” (4–5), never as missing.

The 10 best European email security providers, ranked

  1. Sentaro

    Our pickOverall score: 8.6out of 10

    Best for: EU teams on Microsoft 365 and Google Workspace that want strong BEC and phishing protection without a gateway project.

    Sentaro is a Swedish, API-based email and SaaS security platform for Microsoft 365 and Google Workspace, from Sentaro AB in Stockholm. It is hosted in Sweden on Microsoft Azure, and verdicts come from Vord, Sentaro’s proprietary engine. Its DPA is governed by Swedish law with Stockholm courts as venue and lists every subprocessor: Microsoft Azure (regions “EU and/or US”), PlanetScale (database, Frankfurt), Anthropic (US, limited threat-signal analysis, no training on customer data), Cloudflare and Grafana (global) and GitHub (US). It is EU-sovereign by design, but not every subprocessor is in the EU, and the DPA says so.[1]

    European headquarters and ownership
    10.0
    Documented hosting and DPA transparency
    7.0
    Microsoft 365 and Google Workspace support
    10.0
    BEC and targeted-phishing detection
    9.0
    Deployment effort
    10.0
    Price transparency
    10.0
    Suite breadth and on-premises options
    2.0

    Pros

    • Swedish company; DPA under Swedish law, with Sweden as the member state in its Standard Contractual Clauses.
    • Public subprocessor list with locations, and at least 30 days’ notice of new subprocessors.
    • Protects Microsoft 365 and Google Workspace over API in four minutes, with no MX change.
    • BEC and vendor-fraud detection without a payload, plus OAuth and shadow-AI visibility in the same platform.
    • Published price with every feature included.

    Cons

    • Some subprocessors sit outside the EU (listed in the DPA); buyers who need EU-only processing should read it first.
    • Cloud service only: no gateway, archive, encryption or on-premises option.
    • SOC 2 and ISO 27001 certification in progress.
    Pricing
    $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD.
    Deployment
    API via the Microsoft 365 and Google Workspace admin SDKs; no MX change
    Platforms
    Microsoft 365, Google Workspace, Slack, Teams
    Hosting
    Hosted in Sweden on Microsoft Azure; subprocessors and their locations listed in the DPA
    EU-sovereign email security Vendor site

  2. Libraesva

    Best on-premises optionOverall score: 7.3out of 10

    Best for: European organizations that want to choose where the gateway runs, including on their own premises or private cloud.

    Libraesva is an Italian email security gateway with API integration, part of the LibraCyber group formed with Cyber Guru in 2026. It runs in Libraesva’s cloud, a private cloud or on-premises, supports Microsoft 365, Google Workspace and on-premises Exchange, and describes small language models that run on customer hardware with no off-site processing. Archive, DMARC and phishing simulation are separate products.[6]

    European headquarters and ownership
    9.0
    Documented hosting and DPA transparency
    6.0
    Microsoft 365 and Google Workspace support
    9.0
    BEC and targeted-phishing detection
    8.0
    Deployment effort
    6.0
    Price transparency
    3.0
    Suite breadth and on-premises options
    9.0

    Pros

    • On-premises and private-cloud deployment, which a cloud-only service cannot offer.
    • Microsoft 365, Google Workspace and on-premises Exchange.
    • Broad suite: archive, DMARC, simulation, and Teams protection as an add-on.

    Cons

    • Hosting regions of its own cloud not listed.
    • Pricing not published.
    Pricing
    Quote-based
    Deployment
    Gateway plus API; cloud, private cloud or on-premises
    Platforms
    Microsoft 365, Google Workspace, on-premises Exchange
    Hosting
    “Runs locally or in your chosen cloud”; regions not listed
    Vendor site

  3. Retarus

    Best German-hosted gatewayOverall score: 6.9out of 10

    Best for: Regulated European enterprises on Microsoft 365 that want German hosting, continuity and archive from an owner-managed vendor.

    Retarus is a Munich-based, owner-managed company founded in 1992. Its Email Security runs as a secure email gateway or as an API connector (ICES), with sandboxing, post-delivery protection, continuity, encryption and archiving. Retarus documentation names two German data centres, Munich and Frankfurt, and the vendor states its AI components operate within the EU. Google Workspace is listed as planned.[8]

    European headquarters and ownership
    10.0
    Documented hosting and DPA transparency
    8.0
    Microsoft 365 and Google Workspace support
    5.0
    BEC and targeted-phishing detection
    6.0
    Deployment effort
    6.0
    Price transparency
    3.0
    Suite breadth and on-premises options
    10.0

    Pros

    • German-hosted, owner-managed and EU-only AI processing (vendor-stated).
    • Gateway or API connector from one vendor.
    • ISO 27001 certification announced on the Retarus blog (July 2023).

    Cons

    • Google Workspace only planned.
    • BEC not named on the product page; pricing not published.
    Pricing
    Quote-based
    Deployment
    Secure email gateway (MX) or an API connector (ICES)
    Platforms
    Microsoft 365 (Google Workspace listed as planned)
    Hosting
    Munich and Frankfurt data centres, per Retarus documentation
    Vendor site

  4. Microsoft Defender for Office 365

    EU-hosted baselineOverall score: 6.4out of 10

    Best for: Microsoft 365 tenants for whom EU hosting, not European ownership, is the requirement.

    Defender for Office 365 is not European: Microsoft is a US-headquartered company. It is on this list as the baseline every Microsoft 365 tenant already has. Microsoft 365 is an EU Data Boundary service for tenants signed up in the EU or EFTA, with datacenter countries including Sweden; Multi-Geo tenants are excluded. Plan 1 adds impersonation protection, Safe Links and Safe Attachments.[11]

    European headquarters and ownership
    2.0
    Documented hosting and DPA transparency
    9.0
    Microsoft 365 and Google Workspace support
    5.0
    BEC and targeted-phishing detection
    6.0
    Deployment effort
    9.0
    Price transparency
    9.0
    Suite breadth and on-premises options
    6.0

    Pros

    • Already in your tenant; Plan 1 included in Business Premium and, from 2026, E3.
    • Detailed EU Data Boundary documentation.

    Cons

    • Not a European company.
    • Microsoft 365 only; no dedicated vendor-email-compromise feature documented.
    Pricing
    Plan 1 $2, Plan 2 $5 per user/month, annual (USD)
    Deployment
    Native to Exchange Online
    Platforms
    Microsoft 365 only
    Hosting
    EU Data Boundary for EU/EFTA tenants (Multi-Geo excluded)
    Sentaro vs Microsoft Defender for Office 365 Vendor site

  5. Mailinblack

    Best for French organizationsOverall score: 6.1out of 10

    Best for: French SMBs, healthcare providers and local authorities that want French-hosted anti-phishing with awareness training.

    Mailinblack, based in Marseille, sells Protect (email security), Cyber Coach and Cyber Academy (awareness), and the Sikker password manager. It is offered as SaaS or on-premises with a native API integration for Microsoft 365. Its sales material says Protect is “developed & hosted in France”, and its healthcare offer is “hosted in France and HDS-certified”. The vendor AI is called Néréus.[12]

    European headquarters and ownership
    8.0
    Documented hosting and DPA transparency
    8.0
    Microsoft 365 and Google Workspace support
    5.0
    BEC and targeted-phishing detection
    5.0
    Deployment effort
    6.0
    Price transparency
    4.0
    Suite breadth and on-premises options
    6.0

    Pros

    • French hosting per its sales material, and an HDS-certified healthcare offer per its site.
    • Training and a password manager from the same vendor.

    Cons

    • Google Workspace not stated; BEC not named.
    • Ownership and per-user pricing not published.
    Pricing
    Quote-based; offers tiered by company size
    Deployment
    SaaS or on-premises; native API integration for Microsoft 365
    Platforms
    Microsoft 365
    Hosting
    “Developed & hosted in France” (vendor)
    Vendor site

  6. NoSpamProxy

    Best for S/MIME and PGPOverall score: 6.0out of 10

    Best for: German organizations that need gateway filtering plus S/MIME and PGP encryption, on-premises or in the cloud.

    NoSpamProxy is made by Net at Work GmbH in Paderborn. NoSpamProxy Cloud sits upstream of Exchange Online as a secure email gateway (it needs MX and routing changes); NoSpamProxy Server runs on-premises. It names BEC, adds an AI-based metadata service called 32Guards, and is best known for S/MIME and PGP encryption with automatic certificate management. It carries the TeleTrust “IT Security made in Germany” label.[14]

    European headquarters and ownership
    10.0
    Documented hosting and DPA transparency
    5.0
    Microsoft 365 and Google Workspace support
    5.0
    BEC and targeted-phishing detection
    6.0
    Deployment effort
    4.0
    Price transparency
    4.0
    Suite breadth and on-premises options
    8.0

    Pros

    • Strong S/MIME and PGP encryption with automatic certificate management.
    • On-premises server option.
    • German, privately held vendor with an MSP partner program.

    Cons

    • MX gateway: routing changes needed.
    • Cloud hosting location and Google Workspace support not stated on the pages we checked.
    Pricing
    Quote-based; per module, 1-month (cloud), 1-year or 3-year terms
    Deployment
    Secure email gateway (MX); cloud or on-premises server
    Platforms
    Microsoft 365
    Hosting
    Not stated on the pages we checked; on-premises option
    Vendor site

  7. Hornetsecurity

    Overall score: 5.8out of 10

    Best for: Microsoft 365 SMBs and MSPs that want filtering, archiving, backup and training in one tiered license and accept US ownership.

    Hornetsecurity is based in Hanover, Germany, and has been part of US-headquartered Proofpoint since 8 December 2025. Its 365 Total Protection runs in MX, API or hybrid mode across four plans, from filtering and encryption up to archiving, backup, DMARC management and awareness training. The vendor states it runs “12 regional data centers, independent of Microsoft’s infrastructure”.[15]

    European headquarters and ownership
    4.0
    Documented hosting and DPA transparency
    7.0
    Microsoft 365 and Google Workspace support
    5.0
    BEC and targeted-phishing detection
    5.0
    Deployment effort
    7.0
    Price transparency
    3.0
    Suite breadth and on-premises options
    10.0

    Pros

    • The broadest Microsoft 365 suite on this list.
    • Large European MSP channel.

    Cons

    • No longer European-owned.
    • Google Workspace not covered by 365 Total Protection; BEC specifics not documented.
    Pricing
    Quote-based, sold through partners
    Deployment
    MX, API or hybrid modes
    Platforms
    Microsoft 365
    Hosting
    “12 regional data centers” (vendor); locations not listed
    Sentaro vs Hornetsecurity Vendor site

  8. Vade

    Overall score: 5.7out of 10

    Best for: MSPs that want lightweight API-based filtering for both Microsoft 365 and Google Workspace.

    Vade, a French email filtering company, was acquired by Hornetsecurity in 2024, so it is now also part of Proofpoint. Vade for Microsoft 365 deploys over API with “No MX Changes”, and there is a Vade for Google Workspace. The vendor says its AI learns from more than 1.4 billion protected mailboxes and uses computer vision and NLP against phishing and spear phishing. One secondary source says the Vade brand is being retired; vadesecure.com was still live in October 2026.[17]

    European headquarters and ownership
    4.0
    Documented hosting and DPA transparency
    4.0
    Microsoft 365 and Google Workspace support
    9.0
    BEC and targeted-phishing detection
    7.0
    Deployment effort
    8.0
    Price transparency
    3.0
    Suite breadth and on-premises options
    3.0

    Pros

    • API deployment for both Microsoft 365 and Google Workspace.
    • Large mailbox telemetry from telco and ISP customers (vendor-stated).

    Cons

    • US-owned via Hornetsecurity and Proofpoint; brand future uncertain.
    • Hosting and pricing not documented.
    Pricing
    Quote-based via MSPs
    Deployment
    API (ICES); no MX change
    Platforms
    Microsoft 365, Google Workspace
    Hosting
    Not publicly documented
    Vendor site

  9. SEPPmail

    Best for email encryptionOverall score: 5.5out of 10

    Best for: Swiss and German organizations whose main need is compliant email encryption, with filtering as an add-on.

    SEPPmail AG is based in Neuenhof, Switzerland, with offices in Germany. It is primarily an encryption specialist: its Secure E-Mail Gateway supports GINA password-based encryption, S/MIME, OpenPGP and domain encryption, plus large-file transfer and managed certificates. SEPPmail.cloud adds spam, phishing and malware filtering and runs in data centres in Switzerland and Germany. Switzerland is in Europe but not in the EU.[20]

    European headquarters and ownership
    8.0
    Documented hosting and DPA transparency
    8.0
    Microsoft 365 and Google Workspace support
    5.0
    BEC and targeted-phishing detection
    3.0
    Deployment effort
    4.0
    Price transparency
    3.0
    Suite breadth and on-premises options
    8.0

    Pros

    • Encryption to any recipient, including those without certificates (GINA).
    • Named Swiss and German data centres for the cloud service.

    Cons

    • Threat detection depth and BEC coverage not documented.
    • Gateway deployment; Google Workspace not stated.
    Pricing
    Quote-based
    Deployment
    Gateway: appliance, virtual, in Azure, or SEPPmail.cloud
    Platforms
    Microsoft 365
    Hosting
    Switzerland and Germany (SEPPmail.cloud)
    Vendor site

  10. GLIMPS

    Overall score: 5.4out of 10

    Best for: French enterprise and public-sector SOCs that prioritize deep attachment and malware analysis on Microsoft 365.

    GLIMPS is a French company (Rennes per press; its site footer also lists Toronto) known for deep-learning malware analysis, which it says ANSSI has used under a 2022 public contract. GLIMPS Email Security for Microsoft 365 connects through the Microsoft Graph API without changing mail infrastructure and scans in parallel. The vendor describes “Deep Learning, Machine Learning, and Large Language Models” and eight proprietary AI models. For Gmail, it offers attachment and file malware scanning rather than full email security.[22]

    European headquarters and ownership
    8.0
    Documented hosting and DPA transparency
    4.0
    Microsoft 365 and Google Workspace support
    5.0
    BEC and targeted-phishing detection
    4.0
    Deployment effort
    8.0
    Price transparency
    4.0
    Suite breadth and on-premises options
    4.0

    Pros

    • Code-level malware analysis heritage.
    • Graph API deployment with no infrastructure change; 30-day trial.

    Cons

    • BEC coverage and hosting location not documented.
    • Microsoft 365 only for full email security.
    Pricing
    Quote-based; 30-day free trial
    Deployment
    API (Microsoft Graph); no change to mail infrastructure
    Platforms
    Microsoft 365; malware scanning for Gmail, SharePoint and OneDrive
    Hosting
    Not publicly documented
    Vendor site

How to choose a European email security provider

Start by writing down which kind of “European” your regulator, auditor or board actually needs. Most organizations need EU hosting and a clean DPA. Fewer need European ownership. A small number need EU-only processing for every subprocessor, or an on-premises filter.

Your requirementWhat to checkWho fits on this list
European company and contract lawDPA party, governing law, venueSentaro, Libraesva, Retarus, NoSpamProxy, Mailinblack, SEPPmail, GLIMPS
Named EU or European data centresData-centre locations in docs or DPASentaro (Sweden, Azure), Retarus (Munich, Frankfurt), SEPPmail (CH, DE), Mailinblack (France)
European ownership todayRecent acquisitionsNot Hornetsecurity or Vade (Proofpoint since December 2025)
EU-only subprocessorsThe full subprocessor annexAsk every vendor; Sentaro’s DPA lists some non-EU subprocessors
On-premises filteringDeployment optionsLibraesva, NoSpamProxy, Mailinblack, SEPPmail
Google WorkspacePlatform documentationSentaro, Libraesva, Vade

Questions to ask every European email security vendor, including us

  • Which legal entity signs the DPA, under which law, with which courts?
  • Where is mail content processed and stored, by data centre, and is that the same for every customer tenant?
  • Send the full subprocessor list with locations. Which see message content?
  • Who owns the company today, and has that changed in the last two years?
  • Do you cover Google Workspace as well as Microsoft 365?
  • Does deployment need an MX change, and how long until protection starts?
  • How do you detect BEC that has no link or attachment?

GDPR Chapter V governs transfers of personal data outside the EU, including transfers by a vendor’s subprocessors, and NIS2 Article 21 asks in-scope entities to manage supply-chain security. Neither rule requires a European vendor; both require you to know where your vendor and its subprocessors are. A vendor that publishes that in writing makes the job easier, whichever country it is in. For the sovereignty angle in depth, see EU-sovereign email security; for replacing a specific US vendor, see European email security alternatives.

Certification and compliance status

Exact states as Sentaro publishes them.

SOC 2
In progressCertification in progress. Evidence pack on request.
ISO 27001
In progressCertification in progress; no target date published.
Google CASA
Verified API integration
DPA and subprocessor list
PublicSwedish law, Stockholm courts; every subprocessor with its location.
NIS2 and DORA
ReadinessBuilt for the controls regulated EU firms are asked to evidence. No product makes you compliant.

Frequently asked questions

What is the best European email security?

Sentaro, for organizations on Microsoft 365 and Google Workspace. It is a Swedish company, hosted in Sweden on Microsoft Azure, with a public DPA under Swedish law that lists every subprocessor and its location. It connects over API in four minutes with no MX change, detects BEC and vendor fraud without a payload, and costs $6 per protected account per month (USD). Sentaro publishes this list. If you need an on-premises gateway, Libraesva and NoSpamProxy are European options.

Is Proton or Tuta an email security solution for businesses?

Proton and Tuta are encrypted email providers: you move your mailboxes to them to keep content private. They are not a layer that protects Microsoft 365 or Google Workspace against phishing and business email compromise. If your organization stays on Microsoft 365 or Google Workspace, you need business email security such as Sentaro, Libraesva or Retarus instead.

Does Sentaro keep all data in the EU?

Sentaro is hosted in Sweden on Microsoft Azure, and its primary database is hosted in Frankfurt. Its DPA also lists subprocessors outside the EU, including Anthropic (US) for limited threat-signal analysis without training on customer data, GitHub (US), and Cloudflare and Grafana (global); it describes Azure regions as “EU and/or US”. Read the DPA at sentaro.com/en/legal/dpa before you sign, and ask every vendor for the same list.

Is Hornetsecurity still a European company?

Hornetsecurity is based in Hanover, Germany, but has been part of Proofpoint since 8 December 2025, per Proofpoint. Proofpoint is US-headquartered and owned by Thoma Bravo. Vade, the French filtering company Hornetsecurity bought in 2024, is therefore also part of Proofpoint.

Which European email security vendors support Google Workspace?

Among the European vendors on this list, Sentaro, Libraesva and Vade document Google Workspace support. Retarus lists it as planned. NoSpamProxy, Mailinblack and SEPPmail do not state it on the pages we checked, and GLIMPS offers malware scanning for Gmail rather than full email security. Checked 21 October 2026.

Is Microsoft 365 hosted in the EU?

Microsoft 365 is an EU Data Boundary service for tenants whose sign-up location is in the EU or EFTA, with datacenter countries including Sweden; Multi-Geo tenants are excluded. Microsoft itself is a US-headquartered company, which is why some buyers add a European vendor on top of Defender for Office 365.

Does a European email security vendor make us GDPR or NIS2 compliant?

No. No product makes you compliant with GDPR, NIS2 or DORA. A European vendor with a clear DPA makes your transfer assessment and supply-chain documentation simpler. Sentaro provides the email-layer controls, continuous evidence and incident detection those frameworks require; the compliance work stays yours.

Sources and method

Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Sentaro is our product. Competitor facts come from each vendor’s public pages listed below; some were seen in search results where a page blocked automated access. Capabilities and ownership change; check current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.

  1. Sentaro Data Processing Agreement and subprocessor list
  2. Sentaro pricing
  3. Sentaro: Platform (deployment, Vord engine)
  4. Libraesva: Home page (accessed 2026-10-18)
  5. Libraesva: Proofpoint vs Libraesva (deployment options)
  6. Libraesva: Email Security (detection, local processing)
  7. Retarus: Email Security (accessed 2026-10-21)
  8. Retarus docs: Email Security data center operations (Munich and Frankfurt)
  9. Microsoft Learn: Why do I need Microsoft Defender for Office 365? (accessed 2026-10-18)
  10. Microsoft: Defender for Office 365 pricing (accessed 2026-10-18)
  11. Microsoft Learn: EU Data Boundary (accessed 2026-10-18)
  12. Mailinblack: Home page (accessed 2026-10-21)
  13. NoSpamProxy: Home page (accessed 2026-10-21)
  14. NoSpamProxy Cloud (accessed 2026-10-21)
  15. Hornetsecurity: 365 Total Protection (accessed 2026-10-21)
  16. Proofpoint: Proofpoint completes acquisition of Hornetsecurity (December 2025)
  17. Vade: Email security for Microsoft 365 (accessed 2026-10-21)
  18. GovInfoSecurity: Hornetsecurity buys Vade (2024)
  19. SEPPmail: Home page (accessed 2026-10-21)
  20. SEPPmail: SEPPmail.cloud flyer (Swiss and German data centres)
  21. GLIMPS: Home page (accessed 2026-10-21)
  22. GLIMPS: Microsoft 365 email protection
  23. eBuilder Security: Home page (accessed 2026-10-18)
  24. EUR-Lex: GDPR Regulation (EU) 2016/679
  25. EUR-Lex: NIS2 Directive (EU) 2022/2555
RelatedEuropean email security alternativesEU-sovereign email securitySentaro DPA and subprocessorsNordic email security providersBest BEC protection toolsSentaro vs HornetsecurityNIS2Pricing

Read our DPA, then try Sentaro

Hosted in Sweden on Microsoft Azure. API connection in four minutes; the first account is free.

Speak to salesStart free