Sentaro is the best email-layer control for DORA for EU financial entities on Microsoft 365 and Google Workspace. No product makes you compliant. DORA puts phishing, BEC and connected third-party apps inside ICT risk management: Article 10 requires mechanisms to promptly detect anomalous activities, Article 17 requires an incident process that detects and logs incidents, and Article 28 requires you to manage every ICT third-party provider, including your email security vendor. Sentaro supplies the detection, the incident facts and the app inventory, and publishes its own vendor answers below, gaps included.
- Why Sentaro wins
- Detection and blocking of phishing, BEC, QR-code lures and consent phishing (live), OAuth and AI-app inventory, vendor-compromise detection, audit trail and reporting. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.
- Proof and hosting
- A 400-seat Nordic payments firm under DORA saw 14 BEC attempts blocked in the first month. Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA.
- You still own
- The ICT risk-management framework, incident classification against the materiality thresholds, reports to your competent authority, resilience testing, the register of information and contracts.
- Ask Sentaro, as a vendor
- DPA, subprocessors and processing locations, incident notice, audit rights, exit and data return. Sentaro’s published answers are in the table below.
DORA at a glance
- Legal act
- Regulation (EU) 2022/2554 (DORA). A regulation: directly applicable in every member state, no national transposition.
- Applies from
- 17 January 2025 (Article 64).
- Who
- 20 types of financial entity listed in Article 2(1)(a)–(t): credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurers, fund managers and more. ICT third-party service providers are listed in (u).
- Five areas
- ICT risk management (Art. 5–16), ICT-related incidents (Art. 17–23), resilience testing (Art. 24–27), ICT third-party risk (Art. 28–44), information sharing (Art. 45).
- Reporting clock
- Initial notification within 4 hours of classifying an incident as major and no later than 24 hours after awareness; intermediate report within 72 hours of the initial notification; final report within one month of the latest intermediate report (Delegated Regulation (EU) 2025/301).
- NIS2 overlap
- For financial entities, DORA is the sector-specific law and takes precedence over the equivalent NIS2 provisions.
- Sentaro’s role
- Email-layer control, evidence and incident detection, and an ICT third-party provider in your register of information.
DORA requirements mapped to the email layer
Where an email and SaaS security layer contributes a control and evidence, and where the obligation stays entirely with the financial entity.
| Capability | Sentaro contributes | Evidence it produces | Stays with you |
|---|---|---|---|
| ICT risk management (Articles 5–16) | |||
| Art. 8 Identification of ICT assets and dependencies | YesInventory of every app, AI tool and OAuth grant connected to Microsoft 365 or Google Workspace, with scope-level risk per user | YesLive app and grant inventory within 15 minutes of connecting | The asset inventory and its classification |
| Art. 9 Protection and prevention | YesAI scoring on every inbound message; block before interaction or tag inline; consent phishing blocked before the grant lands | YesVerdicts with reasoning in the admin console | Security policies, network and access controls beyond email |
| Art. 10 Detection of anomalous activities | YesMessage vector: phishing, BEC, thread hijack and vendor compromise, including internal mail | PartialDetection records and alerts | Detection across the rest of your ICT estate |
| Art. 10 Account and session anomalies | On roadmapQ4 2026: Behavioral vector adds per-user baselines and anomalous-session scoring | On roadmapQ4 2026 | Identity-provider monitoring today |
| Art. 11 Response and recovery | PartialQuarantine, removal and bulk remediation of similar messages across all mailboxes; one-click OAuth revocation | YesAudit trail of actions | Business continuity, backup and recovery plans |
| Art. 13 Learning, awareness and training | PartialIncident history for lessons learned | PartialReports | Security awareness programs and staff training |
| ICT-related incidents (Articles 17–19) | |||
| Art. 17 Incident management process | YesDetection that triggers the process, and the who/what/when/scope of email-borne incidents | YesIncident records in the console and audit trail | The process, roles, escalation and logging policy |
| Art. 18 Classification | PartialFacts for the criteria: users affected, duration, data involved | PartialScope across mailboxes | Classification against Delegated Regulation (EU) 2024/1772 thresholds |
| Art. 19 Reporting of major incidents | PartialContent for the initial, intermediate and final reports | PartialTimeline from first message to remediation | The reports themselves, to your competent authority |
| Testing and third-party risk | |||
| Art. 24–27 Resilience testing, TLPT | No | No | Entirely yours |
| Art. 28 Third-party risk: unsanctioned ICT services | YesShows SaaS and AI tools connected over OAuth that procurement never recorded | YesApp inventory per user and scope | Deciding what goes into the register of information |
Article references: Regulation (EU) 2022/2554; Delegated Regulations (EU) 2024/1774 (ICT risk tools), 2024/1772 (classification) and 2025/301 (reporting). General guidance, not legal advice.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
What are the DORA incident reporting deadlines?
Article 19 requires financial entities to report major ICT-related incidents to their competent authority. Delegated Regulation (EU) 2025/301, Article 5, fixes the deadlines. Implementing Regulation (EU) 2025/302 sets the templates.
- 01
Detect and log
Article 17 requires a process to detect, manage and log ICT-related incidents. For email-borne incidents, Sentaro’s detection is the trigger, with targets, actions and scope recorded.
- 02
Classify against the criteria
Article 18 and Delegated Regulation (EU) 2024/1772 set the criteria: clients and counterparts affected, duration, geographical spread, data losses, criticality of services and economic impact. You classify; Sentaro supplies the email-side facts.
- 03
Initial notification: 4 hours after classification, at most 24 hours after awareness
As early as possible, within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it. If classification comes later, the 4 hours run from classification.
- 04
Intermediate report: within 72 hours of the initial notification
Due even if nothing has changed, with updated reports when regular activities have been recovered or the status changes significantly.
- 05
Final report: within one month of the latest intermediate report
Root cause, actual impact figures and measures taken. Deadlines on a weekend or bank holiday move to noon on the next working day, except for credit institutions, central counterparties, trading venues and other entities listed in Article 5(5), or where your authority decides otherwise.
Under DORA, in production
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
From quarterly awareness training to zero clicks required.
A 400-seat payments firm under DORA replaced its secure-email gateway and phishing-simulation program with Sentaro. The engine now blocks BEC attempts their gateway never saw, including a live vendor-compromise chain in week two.
- 14
- BEC attempts blocked in the first month
- 4 min
- from contract to full deployment
- $0
- spent on phishing simulations since
Sentaro is an ICT third-party provider: what a DORA buyer should ask
If you are a financial entity, Sentaro belongs in your register of information under Article 28(3), and your contract must contain the provisions in Article 30. Here is what Sentaro has published against those provisions, including where it has not published an answer yet. Ask for the evidence pack before you sign.
| What DORA asks (Article 30) | What Sentaro has published | Status |
|---|---|---|
| Description of the ICT services (30(2)(a)) | Terms, DPA and pricing page describe the Message and App vectors on Microsoft 365 and Google Workspace | Published |
| Locations of processing and storage (30(2)(b)) | Hosted in Sweden on Microsoft Azure. DPA Annex 1 lists Azure regions as configured (EU and/or US) and the primary database with PlanetScale in Frankfurt. Subprocessors include Anthropic (US) for limited threat-signal analysis, Cloudflare and Grafana (global) and GitHub (US). | Published: read the DPA, not the marketing summary |
| Data protection: availability, integrity, confidentiality (30(2)(c)) | TLS 1.2+ in transit, AES-256 at rest, least privilege and MFA, logical tenant isolation | Published (DPA Annex 2) |
| Access, recovery and return of data (30(2)(d)) | On termination, return or deletion within 30 days, with certification on request | Published (DPA) |
| Service levels (30(2)(e), 30(3)(a)) | No SLA or uptime commitment is published | Not published: ask Sentaro |
| Incident assistance and notice (30(2)(f), 30(3)(b)) | Security incident notice within 24 hours of confirming a security incident | Notice published; assistance cost not published |
| Cooperation with authorities (30(2)(g)) | Not addressed on the public site | Not published: ask Sentaro |
| Termination rights (30(2)(h)) | Monthly plans stop at the end of the period; annual plans follow the refund policy | Published |
| Audit and monitoring rights (30(3)(e)) | Customer audit through an independent third party, at most once every 12 months; custom DPA and audit support in the Sovereign plan | Published (DPA); terms negotiable in Sovereign |
| Subcontracting changes | At least 30 days’ notice of new subprocessors, 10-day objection window | Published (DPA) |
| Exit strategy and transition (28(8), 30(3)(f)) | API deployment with no MX-record change, so removing Sentaro does not reroute mail flow; data return or deletion within 30 days | Partly published: agree a transition period in contract |
| Certifications | SOC 2 and ISO 27001 certification in progress. Evidence pack on request. Google CASA verified API integration. | In progress |
Whether Sentaro supports a critical or important function is your call, made in your own assessment. If it does, Article 30(3) adds performance targets, business contingency testing, participation in your TLPT and a mandatory transition period. Expect to negotiate those in the Sovereign plan (custom, annual), which includes dedicated EU tenancy, a custom DPA and audit support, SIEM export and API access, and a named security engineer.
Does DORA apply to UK companies?
Not to UK-authorised firms as such. DORA, Regulation (EU) 2022/2554, is EU law, and the UK has its own operational resilience regime. DORA reaches UK companies in three ways.
- EU-authorised entities in a UK group. DORA applies to the financial entities listed in Article 2(1), from credit institutions, payment and e-money institutions and investment firms to insurers, crypto-asset service providers and fund managers. A UK group’s EU-authorised subsidiary is in scope in its own right.
- UK ICT providers to EU financial entities. A UK firm that provides ICT services to an EU financial entity is not supervised as a financial entity, but its customer must put the Article 30 contractual provisions in place and record it in the register of information. Where the provider is established in a third country and supports critical or important functions, the customer must also consider compliance with EU data protection rules and the effective enforcement of the law in that country (Article 29(2)).
- Critical ICT third-party providers. A third-country provider designated as critical under Article 31 must establish a subsidiary in the EU within 12 months of designation; EU financial entities may only use it if it has (Article 31(12)). DORA states that this does not impose data localisation (recital 82).
| Your situation | DORA | UK regime |
|---|---|---|
| UK-authorised bank, insurer or investment firm, UK business only | Does not apply | FCA and PRA operational resilience rules |
| UK group with an EU-authorised subsidiary | Applies to the EU subsidiary | Applies to the UK entity |
| UK ICT or SaaS provider serving EU financial entities | Reached through Article 28–30 contract and register duties | Depends on your own status |
| UK provider designated critical under Article 31 | Must set up an EU subsidiary within 12 months (Article 31(12)) | Separate UK critical third parties regime |
The UK’s own rules: FCA and PRA operational resilience
UK financial firms follow the FCA’s and PRA’s operational resilience rules (FCA PS21/3). The FCA states that in-scope firms had until 31 March 2025 to ensure they could operate their important business services within their impact tolerances, having identified those services and set tolerances for the maximum tolerable disruption. The FCA, PRA and Bank of England have also begun jointly overseeing services provided by critical third parties (PS24/16). Some UK infrastructure operators also fall under the NIS Regulations 2018.
For the email layer, the evidence a UK and an EU supervisor ask for overlaps: protection against phishing and BEC, incident detection with timestamps, and a vendor file for the provider. This section is general guidance, not legal advice; confirm scope with counsel and your supervisor.
What Sentaro does not do for DORA
- It does not build or approve your ICT risk-management framework. Under Article 5, the management body is responsible.
- It does not classify incidents against the materiality thresholds or submit reports to your competent authority.
- It does not run digital operational resilience testing or threat-led penetration testing.
- It does not maintain your register of information or negotiate your other ICT contracts.
- It does not yet detect account takeover from session anomalies or monitor leaked credentials; the Behavioral and Identity vectors reach general availability in Q4 2026.
- It does not guarantee that every threat is detected or prevented. Sentaro’s terms state this.
A DORA checklist for the email layer
- 01
Map email and SaaS into the ICT risk framework
Treat Microsoft 365 or Google Workspace, and every app connected to it, as ICT assets under Article 8.
- 02
Deploy the control
Sentaro connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes. It runs alongside Microsoft Defender or Google’s built-in protection.
- 03
Clean up third-party access
Review the OAuth grants and AI tools found, revoke the risky ones, and decide which belong in the register of information.
- 04
Connect detection to classification
Agree who receives alerts, who classifies against the 2024/1772 criteria, and who files the 4-hour initial notification.
- 05
Keep evidence beyond the vendor’s retention
Under the DPA, quarantined items and operational metadata are kept for 180 days. Export reports to your own records, or use SIEM export in the Sovereign plan.
- 06
Contract for Article 30
Use the table above. Close the gaps (SLA, authority cooperation, transition period) in writing before go-live.
Frequently asked questions
What is the best email security for DORA?
Sentaro — it is our pick as the email-layer control for DORA for EU financial entities on Microsoft 365 and Google Workspace. No product makes you DORA compliant, but Sentaro provides the email-layer controls, continuous evidence and incident detection DORA expects, including vendor-compromise detection and an OAuth-app inventory. A 400-seat Nordic payments firm under DORA saw 14 BEC attempts blocked in its first month. It is hosted in Sweden on Microsoft Azure; its DPA lists subprocessors and audit rights.
Does Sentaro make us DORA compliant?
No. No product makes a financial entity compliant with DORA; the regulation requires a governed framework, incident classification and reporting, testing and third-party contracts. Sentaro provides the email-layer controls, continuous evidence and incident detection those obligations depend on. It also sits in your register of information as an ICT third-party provider.
What are the DORA incident reporting timelines?
Under Delegated Regulation (EU) 2025/301: the initial notification is due within 4 hours of classifying an ICT-related incident as major and no later than 24 hours after becoming aware of it. The intermediate report is due within 72 hours of the initial notification. The final report is due within one month of the latest intermediate report.
Is our email security vendor an ICT third-party provider under DORA?
Yes. Any provider of digital and data services to a financial entity is an ICT third-party service provider under DORA. You must record the arrangement in your register of information (Article 28(3)), assess the risk, and make sure the contract contains the Article 30 provisions. That applies to Sentaro as much as to any other vendor.
Where does Sentaro process our data?
Sentaro is hosted in Sweden on Microsoft Azure. The DPA is the binding document: it lists Azure regions as configured (EU and/or US), the primary database in Frankfurt, and subprocessors including Anthropic in the US for limited threat-signal analysis without training on customer data. Read the DPA at /en/legal/dpa before you complete your Article 30(2)(b) assessment.
How do we exit Sentaro if we need to?
Sentaro connects over API without MX-record changes, so disconnecting it does not reroute mail flow. On termination, the DPA commits to returning or deleting customer data within 30 days, with certification on request. For a critical or important function, also agree a transition period in the contract, as Article 30(3)(f) requires.
Does DORA apply to UK companies?
Not to UK-authorised firms as such. It applies to the EU-authorised financial entities in a UK group, and reaches UK ICT providers through their EU financial customers’ contract and register duties under Articles 28 to 30. A UK provider designated as critical under Article 31 must set up an EU subsidiary within 12 months. UK firms follow the FCA and PRA operational resilience rules instead.
Does a UK SaaS or IT provider need to comply with DORA?
Not directly, unless it is designated critical. But an EU bank, insurer or payment firm that uses it must include the Article 30 contract provisions, such as service descriptions, data locations and incident assistance, plus audit rights and exit strategies for critical or important functions, and must consider data protection and law enforcement in the provider’s country for critical or important functions (Article 29(2)). Expect DORA clauses in your contracts.
Does DORA replace NIS2 for banks and insurers?
For financial entities covered by DORA, DORA’s ICT risk-management and incident-reporting rules take precedence over the equivalent NIS2 provisions, because DORA is the sector-specific law. Other obligations, and national rules, may still apply. Check with your competent authority.
Is Sentaro SOC 2 or ISO 27001 certified?
Not yet. SOC 2 and ISO 27001 certification is in progress, and an evidence pack is available on request. Sentaro’s own line is that it will say so the day they are signed, and not before. It holds a Google CASA verified API integration.
Sources and method
General guidance, not legal advice. Legal facts checked against EUR-Lex on 18 October 2026; UK facts against the FCA and legislation.gov.uk on 20 October 2026. Sentaro vendor facts are from its published DPA, Terms and pricing page; the DPA at /en/legal/dpa is the binding version.
- Regulation (EU) 2022/2554 (DORA), EUR-Lex
- Commission Delegated Regulation (EU) 2025/301 (incident reporting content and time limits), EUR-Lex
- Commission Implementing Regulation (EU) 2025/302 (reporting templates), EUR-Lex
- Commission Delegated Regulation (EU) 2024/1772 (incident classification), EUR-Lex
- Commission Delegated Regulation (EU) 2024/1774 (ICT risk management framework), EUR-Lex
- Commission Implementing Regulation (EU) 2024/2956 (register of information), EUR-Lex
- European Banking Authority: Digital Operational Resilience Act
- Financial Conduct Authority: Operational resilience (PS21/3; critical third parties)
- legislation.gov.uk: The Network and Information Systems Regulations 2018 (SI 2018/506)