Best email-layer control for NIS2, DORA, SOC 2 and GDPR on Microsoft 365 and Google Workspace: Sentaro. No product makes you compliant with NIS2, DORA or SOC 2, and you should distrust any that claims to; compliance lives in your governance, processes and documentation. But every framework requires technical controls, and email is where the requirements converge: ENISA observed phishing as the leading intrusion vector in the EU, at about 60% of cases (ENISA Threat Landscape, 2025). Sentaro is that control layer, the evidence that it operates, and the detection your reporting deadlines depend on.
- Why Sentaro wins
- Protection against phishing, BEC and consent phishing, continuous logs and reports as audit evidence, and detection that starts your reporting clock with facts (who, what, when, scope). Article 23 of NIS2 requires an early warning within 24 hours of becoming aware of a significant incident; DORA sets its own timelines for major ICT-related incidents.
- Built for EU diligence
- Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA. Built for the controls regulated EU firms are asked to evidence; evidence pack on request.
- Live in minutes
- Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes. $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD.
- You still own
- Governance, risk analysis, policies, classification and the reports themselves. Sentaro’s own certification status is stated once, in the Certification status note below.
Why regulators look at email
Guides by framework
Each guide maps the framework’s requirements to the email layer, with sources. General guidance, not legal or audit advice.
Risk-management measures, supply-chain security and the 24-hour, 72-hour and one-month reporting clock.
What an early warning, a notification and a final report need from your email evidence.
ICT risk management, major-incident reporting and third-party ICT oversight for financial entities.
Sweden’s implementation of NIS2, and what it means for email security.
Security of processing, the 72-hour breach clock, and choosing a processor that reads your mail.
Controls that demonstrably operate all period, and the evidence an auditor tests.
Where AI tools in your tenant meet the Act. Sentaro is not an AI Act compliance tool; it shows which AI services hold access to your data.
What does each framework ask of email security?
NIS2
NIS2 requires risk-management measures against exactly the attacks that arrive by email, supply-chain vigilance, and incident reporting on a 24-hour, 72-hour and one-month clock. Sentaro contributes the protection measure, flags compromised vendor mailboxes in your mail flow, and starts the reporting chain with detection and evidence instead of an empty page.
DORA
For financial entities, DORA demands ICT risk management, major-incident reporting on fixed timelines, and control of third-party ICT dependencies. Sentaro contributes to the detect-and-monitor expectations at the mailbox, supplies the who, what, when and scope that incident classification requires, and surfaces every third-party and AI service holding OAuth access to mail and files.
SOC 2 and ISO 27001
SOC 2 is won or lost on evidence: controls that demonstrably operated all period. Sentaro’s continuous logs of threat detection and disposition, OAuth grant visibility and monitoring reports can be mapped with your auditor to the relevant Common Criteria, for the whole observation window. The same evidence supports ISO 27001 controls on threat intelligence, monitoring and incident management.
GDPR
GDPR requires appropriate security of processing and a 72-hour notification clock for personal-data breaches. Mailboxes hold large amounts of personal data, and the email security vendor itself becomes a processor of everything in your mailboxes, so the choice of vendor is a GDPR decision too.
The incident reporting chain, from detection to deadline
| Stage | What happens | Who owns it |
|---|---|---|
| Detection | Sentaro scores the email-borne attack before interaction | Sentaro |
| Facts | Who was targeted, what was blocked or delivered, when, and how far it spread | Sentaro |
| Assessment | Is this significant or major under your framework? | You, with Sentaro’s evidence |
| Report | 24-hour and 72-hour notifications (NIS2), timeline reports (DORA), incident records (SOC 2) | You, with Sentaro’s evidence |
| Post-incident | Final reports, lessons learned, control adjustments | You |
Evidence that survives an audit
Point-in-time screenshots show a setting, not that a control operated. Auditors test continuous operation: logs that cover the whole period, alerts with dispositions, and reports generated by the system rather than assembled the week before the audit. Because Sentaro monitors continuously, the evidence exists as a by-product of protection, including records that are easy to overlook, like which AI services your employees connected to company mailboxes and which grants held what access when.
Sentaro’s own assurance, stated plainly
- Positioning
- Built for the controls regulated EU firms are asked to evidence
- Hosting
- Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA
- Incident notice to you
- Within 24 hours of confirming a security incident (DPA)
- Due diligence
- Evidence pack for DORA, NIS2 and SOC 2 diligence, security questionnaires, DPA and subprocessor list via hello@sentaro.com
What Sentaro doesn’t do for compliance
Sentaro is one control, not a compliance program. It does not write your policies, run your risk assessments, manage your evidence collection across other domains, or certify anyone. GRC platforms manage the program; Sentaro is one of the controls the program depends on, and a source of the evidence it collects. This page is general guidance, not legal or audit advice.
Under DORA, in production
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
From quarterly awareness training to zero clicks required.
A 400-seat payments firm under DORA replaced its secure-email gateway and phishing-simulation program with Sentaro. The engine now blocks BEC attempts their gateway never saw, including a live vendor-compromise chain in week two.
- 14
- BEC attempts blocked in the first month
- 4 min
- from contract to full deployment
- $0
- spent on phishing simulations since
Frequently asked questions
What is the best email security for NIS2 and DORA compliance?
Sentaro — it is our pick as the email-layer control for regulated EU teams on Microsoft 365 and Google Workspace. No product makes you compliant with NIS2 or DORA. Sentaro provides the email-layer controls, continuous evidence and incident detection those frameworks require, is hosted in Sweden on Microsoft Azure with subprocessors listed in its DPA, connects over API in four minutes, and costs $6 per protected account per month (prices in USD).
Does Sentaro make us NIS2, DORA or SOC 2 compliant?
No product does, and claims otherwise are a red flag. Compliance is your governance, processes and documentation. Sentaro provides the email-layer controls, continuous evidence and incident detection those frameworks require.
How does Sentaro help with incident reporting deadlines?
For email-borne incidents it provides the detection that triggers your process and the facts (targets, actions, timestamps, scope) that early warnings and notifications must contain, so NIS2’s 24-hour and 72-hour clocks and DORA’s timelines start with evidence.
What evidence does Sentaro produce for a SOC 2 audit?
Continuous logs of threat detection and disposition, OAuth grant and access visibility, and monitoring reports spanning the observation period, mapped with your auditor to the relevant Common Criteria.
We are a supplier to NIS2-covered companies. Does this concern us?
Yes, indirectly. Covered entities must manage supply-chain security and increasingly push requirements onto suppliers. NIS2 Article 21(2)(d) names supply-chain security, so expect customers to ask how you protect email and detect incidents.
Do we still need our GRC platform?
Yes. GRC tools manage the program: policies, tasks, evidence collection across all domains. Sentaro is one of the actual controls the program depends on, and a source of the evidence it collects.
What is Sentaro’s own SOC 2 and ISO 27001 status?
Not yet. SOC 2 and ISO 27001 certification is in progress, and an evidence pack is available on request. Sentaro’s own line: “We’ll say so the day they’re signed, and not before.” Its Google Workspace integration is a Google CASA verified API integration.