Best email security for law firms on Microsoft 365 and Google Workspace: Sentaro. The attacks that hurt law firms are quiet: a changed account number before completion, a reply injected into a deal thread, a fake document-share page that harvests a partner’s password. Sentaro detects these in the firm’s own tenant. It cannot stop criminals emailing your clients while pretending to be you, and it does not replace calling a client to confirm payment details.
- Why Sentaro wins
- Behavioral detection of changed payment instructions, injected replies and credential lures, with reasoning on every verdict in the console, without a gateway project or a full-time security team. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.
- What Microsoft and Google already cover
- Microsoft documents built-in anti-malware, anti-spam and anti-spoofing for every cloud mailbox, and impersonation protection and Safe Links in Defender for Office 365 Plan 1. Google documents spoofing, link and attachment protections in Gmail. Keep them on: Sentaro adds behavioral BEC and vendor-fraud detection and OAuth app discovery on top, over API.
- Price and hosting
- $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD. Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA. Nobody at Sentaro reads your mail in the course of providing the service.
- Also plan for
- Impersonation of your firm towards clients. Alerts when lookalikes of your domain are registered are part of the Identity vector, due in Q4 2026.
- Be aware
- Sentaro has no named law-firm customer or legal case study published yet. Ask for a 30-minute walkthrough on your own live traffic.
At a glance
- Built for
- Business law firms, conveyancing and estate practices, in-house legal teams and legal service providers on Microsoft 365 or Google Workspace
- Threats covered today
- Payment-instruction fraud in matter threads, partner impersonation, lookalike domains at first contact, credential and data-room phishing, consent phishing
- Status
- Message and App vectors are live. Roadmap items are listed once, in the roadmap note on this page.
- Deployment
- Connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes.
- Pricing
- $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.
- Hosting
- Hosted in Sweden on Microsoft Azure. Subprocessors are listed in the DPA.
Why are law firms targeted by phishing and payment fraud?
Law firms combine three things attackers look for: money in motion, confidential documents and a culture of deadlines. In May 2025 Sveriges advokatsamfund, the Swedish Bar Association, warned its members that several law firms had recently been hit by fraud using forged emails made to look as if they came from a law firm, sent to companies, organizations and private individuals. It urged firms to report such fraud to the police.
Legal practices also feature in ransomware reporting. In the FBI’s Internet Crime Report 2025, legal services, such as law firms and estate planning, were the most reported industry among the more than 1,400 ransomware complaints IC3 received from organizations outside the US critical-infrastructure sectors, at 18%. The figure is US data and says nothing about how those firms were breached, but it shows how often legal practices appear among reported victims.
Workflows that create risk in a law firm
| Workflow | How it is attacked (typical case) | What Sentaro checks (live) |
|---|---|---|
| Client funds and completion payments | Days before completion, a message in the real matter thread gives “updated” account details for the purchase price or settlement | Payment-redirect intent; relationship and thread context; sudden banking-detail changes |
| Partner instructions | A partner “on a flight” asks an associate or the accounts team to release funds or send documents, confidentially | Display-name mismatch, sender infrastructure, the urgent-confidential pattern in any language |
| Data rooms and document sharing | A “shared document” or data-room invite leads to a credential page or an app that asks for mailbox access | Link destination analysis; consent-phishing lures blocked in mail flow |
| Opposing counsel and courts | A lookalike of the other side’s or a court’s domain sends a filing or a deadline notice | Newly registered lookalike domains detected at first contact |
| Firm invoices to clients | Your firm’s invoices are copied and re-sent with a new account | Outside your tenant: needs client communication and, from Q4 2026, domain-registration alerts |
What do professional secrecy, GDPR and NIS2 require of a law firm’s email?
In Sweden, Rättegångsbalken chapter 8, section 4 requires an advokat to keep confidential what they learn in their professional work when good advocacy practice requires it. Other EU member states have equivalent rules, and the obligation follows client information into every mailbox and connected app. Law firms are not listed as a sector in NIS2, but many of their clients are, and NIS2 Article 21(2)(d) requires those clients to manage security in their relationships with direct suppliers and service providers. That is why security questionnaires and contract clauses are reaching law firms.
| Obligation | What it means for email | How Sentaro supports it | Evidence produced |
|---|---|---|---|
| Professional secrecy (for example RB 8:4 in Sweden) | A taken-over mailbox or a rogue app with mail access exposes privileged material | Credential-phishing detection; OAuth-app inventory and one-click revocation of risky grants | App and grant inventory per user; verdicts with reasoning |
| GDPR Art. 32 and 33: appropriate security; breach notification within 72 hours | Client files hold personal data, and litigation may involve special categories or criminal-offence data | Detection at delivery and of internal mail from a compromised account | Who was targeted, what was delivered or blocked, when, and the spread |
| Client NIS2 supply-chain demands (Art. 21(2)(d)) | Clients ask how you protect their information and how fast you tell them about incidents | Behavioral email detection; Sentaro’s own DPA, 24-hour incident notice to you and evidence pack | Material for your answers to client security questionnaires |
Before connecting a tenant that holds privileged material, review Sentaro’s DPA with the partner responsible for risk: processing is automated, nobody at Sentaro reads your mail in the course of providing the service, and the DPA names the narrow exceptions and every subprocessor, including those outside the EU. No product makes a firm compliant. This is general information, not legal advice.
Completion-fund fraud, partner impersonation and fake data rooms: what Sentaro covers
Status as published by Sentaro on 18 October 2026.
| Capability | Sentaro | Vector |
|---|---|---|
| Live today | ||
| Changed account details in a matter or completion thread | YesVendor-compromise and thread-hijack detection | Message |
| Partner impersonation with no link or attachment | YesIntent analysis; a core design target | Message |
| Fake data-room and document-share pages | YesDestination analysis, not reputation lookups alone | Message |
| Apps requesting access to mail and files | YesConsent phishing blocked; grants inventoried and revocable | App |
| Outside Sentaro | ||
| Fraudsters emailing your clients as your firm | NoTheir inboxes are not in your tenant | — |
| Phone calls confirming fake details | NoSentaro cannot inspect a phone call | — |
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
A client-funds verification routine that works with any tool
Email security reduces how often a fake instruction reaches someone. This routine stops the ones that still do.
- 01
Tell clients at engagement
State in the engagement letter that your firm will never change its account details by email, and give the number to call.
- 02
Verify every change by phone
Any new or changed account for client funds is confirmed on a number from the file, never one in the email.
- 03
Two people release client funds
One prepares, another approves, and both see the verification note.
- 04
Slow down under pressure
Urgency, secrecy and a partner who cannot take a call are reasons to verify, not to skip it.
- 05
If money has gone
Call the bank for a recall, report to the police, preserve the emails with headers, and assess GDPR and client notification duties.
Law firms and email fraud, in numbers
Sovereignty and procurement facts
What a risk partner, a DPO or a client’s security questionnaire will ask about Sentaro.
- Hosting
- Hosted in Sweden on Microsoft Azure. EU-sovereign by design.
- Subprocessors
- Listed in Annex 3 of the DPA, with locations in the EU, the US and globally, including a US AI provider used for limited threat-signal analysis with no training on customer data. Review the list at /en/legal/dpa.
- Who reads mail
- Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service. The DPA sets out the narrow exceptions.
- Incident notice to you
- Without undue delay and in any event within 24 hours of confirming a security incident (DPA).
- Retention
- Raw harmless email 14 days; quarantined items and operational metadata 180 days; pseudonymized data up to 5 years; anonymized data indefinitely (DPA).
- Exit
- Return or deletion of customer data within 30 days of termination, with certification on request (DPA).
- Audit
- Customer audit through an independent third party, at most once per 12 months. Swedish law; SCCs for transfers.
- Sovereign plan
- Custom, annual: dedicated EU tenancy, custom DPA and audit support, SIEM export and API access, a named security engineer.
Frequently asked questions
What is the best email security for law firms?
Sentaro — it is our pick for European law firms on Microsoft 365 and Google Workspace. It flags changed payment instructions, injected replies in deal threads and fake document-share pages by behavior, shows its reasoning to partners and IT, and connects over API in four minutes. Nobody at Sentaro reads your mail in the course of providing the service. It costs $6 per protected account per month (prices in USD). Keep calling clients to confirm payment details.
What is the biggest email risk for a law firm?
Payment-instruction fraud around client funds and completions, followed by mailbox takeover through credential phishing. Both are quiet: the fraudulent message often sits in a genuine thread and carries no malware. Detection has to come from behavior, such as a sudden change of bank details, and a phone-verification routine has to back it up.
Does NIS2 apply to law firms?
Law firms are not a listed NIS2 sector. NIS2 still reaches them indirectly: covered clients must manage security risks in their relationships with direct suppliers and service providers under Article 21(2)(d), so they send law firms security questionnaires and contract clauses. A firm that provides managed IT or other listed services could be in scope directly.
Can Sentaro stop criminals pretending to be our firm?
Partly. Sentaro protects your tenant, so it catches lookalike domains and impersonation aimed at your own staff. It cannot see emails sent to your clients’ inboxes. Alerts when lookalikes of your domain are registered are part of the Identity vector, due in Q4 2026. Until then, tell clients you will never change account details by email.
Is it compatible with professional secrecy to let a vendor scan our email?
That is a judgment for your firm and, where relevant, your bar association’s rules. The facts to weigh: Sentaro’s analysis is automated, nobody at Sentaro reads your mail in the course of providing the service, raw harmless email is kept 14 days, and the DPA lists every subprocessor and the narrow exceptions to access. This is not legal advice.
How long does it take to deploy in a law firm?
An admin connects Microsoft 365 or Google Workspace over API in about four minutes. There is no MX change, no agent on lawyers’ laptops and no rules to migrate. Protection starts immediately and historical visibility follows within 15 minutes.
What does it cost for a 40-lawyer firm?
Pro costs $6 per protected account per month, or $68 per account per year, and the first account is free. Shared aliases and distribution lists do not count. For 40 protected accounts paid monthly, that is 39 paid accounts at $6, or $234 per month. Prices in USD, exclusive of taxes.
Sources and method
- Sveriges advokatsamfund: Advokatsamfundet varnar för bedrägerier via e-post (20 May 2025)
- Rättegångsbalk (1942:740), chapter 8, section 4, Riksdagen
- FBI IC3 Internet Crime Report 2025
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- ENISA Threat Landscape 2025 (October 2025)
- Microsoft Learn: Built-in security features for all cloud mailboxes (EOP)
- Microsoft Learn: Why do I need Microsoft Defender for Office 365?
- Google Workspace Admin Help: Advanced phishing and malware protection
- Sentaro Data Processing Agreement (subprocessors, retention, incident notice)