Echoworx email encryption

What is Echoworx?

Echoworx provides a cloud encryption platform for outbound email, and for secure replies and inbound encrypted mail. It does not replace your mail system or your inbound filtering. Instead, the messages that need protecting are routed to Echoworx over standard SMTP, encrypted according to your rules and delivered to the recipient, while everything else carries on as normal.

Echoworx says it reinforces the security stack you already run rather than replacing it: it works with Microsoft 365, Google Workspace, existing secure email gateways and DLP tools, and mail routes back through your established systems so journaling, spam filtering and inspection keep working. It runs as a cloud-native service on AWS, so there is no appliance or software for you to maintain.

It suits organisations that regularly send personal or confidential information to clients, patients, customers or partners on every kind of email service, such as accountants, solicitors, financial advisers, insurers, healthcare providers, HR and payroll teams and public bodies. If you are weighing it against other approaches, our guide to how to send secure email compares the options.

How Echoworx decides how to deliver each message

The distinctive part of Echoworx is that the delivery method is chosen by policy, per message, rather than by each sender. Echoworx describes the sequence like this:

1. Send. The user writes and sends as normal; no new client behaviour is required.
2. Route. Mail flows through Microsoft 365, Google Workspace or your gateway, then to Echoworx over SMTP.
3. Evaluate. The policy engine checks sender identity, recipient domain, data classification and message content against your rules.
4. Select a method. Based on that and what the recipient can handle, Echoworx picks certificate-based encryption, TLS, the web portal, an encrypted PDF or an encrypted attachment.
5. Resolve credentials. Certificates, keys, passwords or verification steps are retrieved or generated in real time.
6. Brand and deliver. Your branding and localised wording are applied and the message is sent.

Because the decision is made centrally, staff do not need to know which method a particular recipient needs, and if TLS is preferred but the recipient's server cannot accept it, the message falls back to the portal or an encrypted document rather than going out unprotected.

Echoworx delivery methods

Echoworx states that all of these delivery methods ship within one integrated platform with no modular costs, so you can start with one method and add others later. Your branding is applied across every delivery method, and notifications and portal pages can be localised into the languages Echoworx supports. For portal messages, senders can request delivery and read receipts, set an expiry period and recall a message.

Recipient sign-in and the Echoworx login

People searching for an "Echoworx login" are usually recipients trying to open a secure message. Recipients reach the secure portal from the link in the notification email, and the portal carries the sending organisation's branding rather than a generic Echoworx page. If you have received a secure message and cannot open it, use the link in that message or contact the organisation that sent it.

For organisations choosing Echoworx, the sign-in options are a big part of the recipient experience. Echoworx lists:

• Federated identity: recipients reuse credentials from major providers through OpenID Connect and OAuth
• Enterprise single sign-on: governed sign-in through your existing customer portal, with Microsoft Entra ID and Okta integration
• Passkeys: biometric or PIN-backed sign-in for supported recipients, with no shared secret
• Text message verification: a one-time code sent to the recipient's mobile as a second step
• Voice verification: the verification step delivered by voice call for recipients who cannot receive texts

Echoworx also aligns password recovery with sign-in strength, so account recovery is not a weaker way in. We help you choose the options that suit your recipients: simpler for members of the public, stronger for high-value financial or legal exchanges.

How Echoworx works with Microsoft 365, Google Workspace and gateways

Echoworx is fully hosted and connects at the mail-routing level rather than through deep platform integrations:

• Microsoft 365: a simple Exchange rule sends only the outbound mail that needs encrypting to Echoworx. There is no MX record change and no Microsoft 365 API integration, so inbound mail flow is untouched.
• Google Workspace: Gmail routes the relevant outbound mail to Echoworx over SMTP in the same way, so Google Workspace is supported on any edition, including those without Google's own S/MIME. See sending secure email in Gmail.
• Sender add-ins: a web-based, cloud-hosted Outlook add-in that follows the user across Outlook on Windows, Mac and the web, and a Gmail add-on that an admin can install organisation-wide from the Google Workspace Marketplace.
• Secure email gateways: Echoworx is gateway-agnostic and layers into your existing gateway topology, so inbound hygiene, journaling, filtering and archiving stay as they are. See secure email gateway.
• DLP: when an upstream DLP engine flags sensitive content, Echoworx encrypts it automatically. See email DLP.
• Inbound encrypted mail: S/MIME and PGP messages sent to you can be decrypted by Echoworx using keys held securely in the platform, once your gateway routes them there.
• Deployment model: multi-tenant, dedicated, or provisioned in a specific AWS region where data residency matters. We confirm the hosting arrangement with you at quote.

We usually pilot with a small group before rules apply to everyone.

Echoworx or Microsoft Purview Message Encryption?

Many organisations on Microsoft 365 already own Microsoft Purview Message Encryption, so it is worth being clear about what Echoworx adds:

If most recipients use Microsoft 365 and you hold Business Premium or E3, start with Purview, because it is already in your licence. Echoworx earns its place when many recipients are members of the public, you send documents in volume, partners require S/MIME or PGP, recipients need stronger or simpler sign-in options, or you use Google Workspace. Our sister site's email encryption guide compares the approaches in more detail.

Echoworx editions and licensing

Echoworx Email Encryption is listed in our distributor catalogue in two editions, Standard and Advanced, licensed per user, meaning the staff who send encrypted email. Echoworx's own website describes every delivery method as part of one platform with no modular costs, so we confirm exactly what your licence includes when we quote rather than rely on the catalogue description.

• Per user: recipients do not need a licence or any software
• Minimum user numbers may apply, confirmed on your quote
• Pricing: depends on edition, users and term, so ask us for a quote

Full licensing detail is on our licensing site's Echoworx Email Encryption licensing page.

How we help with Echoworx

Forever Systems supplies Echoworx alongside the email security platforms we support, so we can fit encryption around the filtering, DLP and mail platform you already run. We can:

1. Map who sends sensitive email, to whom, and what your clients, regulators or contracts expect
2. Compare Echoworx with Microsoft Purview, Gmail's options and the encryption in your existing email security product
3. Set up the routing from Microsoft 365, Google Workspace or your gateway, your encryption policies, branding and recipient sign-in
4. Deploy the Outlook add-in or Gmail add-on and pilot with a small group
5. Brief staff and test the recipient journey on desktop and mobile

Contact us to talk about Echoworx.