In short
To send secure email, protect the message itself, not just the connection. TLS encrypts mail between servers; message encryption, such as a secure portal, encrypted PDF, S/MIME or PGP, keeps the content readable only by the recipient. Microsoft 365 and Google Workspace include options in some plans, and services such as Echoworx add more.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
Secure email vs encrypted email
People often use the two terms interchangeably, but they are not the same thing.
Encrypted email means the content is scrambled so only someone with the right key, password or sign-in can read it. Secure email is the wider outcome: the right person receives it, they can trust it really came from you, nobody can read it on the way, and you keep some control once it has gone. In practice that means:
- Encryption in transit, so the message cannot be read between mail servers
- Encryption of the message itself for sensitive content, so it stays protected wherever it is stored
- Checks on the recipient, so personal data does not go to the wrong person by autocomplete
- Sender authentication (SPF, DKIM and DMARC), so recipients and their filters can trust that a secure-message notification is really from you
- Controls after sending, such as expiry, revocation or secure reply, depending on the method
Encryption is the core of it, but a secure message that lands in the wrong inbox, or looks like phishing to the recipient, has not done its job. Our email DLP guide covers misdirected mail, and email authentication covers the sender side.
The ways to send secure email, compared
| Method | What it protects | What the recipient does | Best for |
|---|---|---|---|
| TLS (opportunistic) | The connection between mail servers, when both support it | Nothing; the message arrives normally | A baseline for all mail |
| Enforced TLS | The connection, with delivery refused if TLS is not available | Nothing | Regular partners whose mail servers you know support TLS |
| Secure web portal | The message and attachments, held in a portal | Follows a link, signs in or enters a code, reads and replies securely | Clients, patients and the public on any email service |
| Encrypted PDF or attachment | The documents, protected by a password or code | Opens the file with the password in a normal app | Statements, payslips, contracts and reports |
| S/MIME | The message itself, end to end, using certificates | Seamless once both sides have certificates | Partners who already use S/MIME |
| PGP | The message itself, end to end, using key pairs | Needs PGP software or a service that manages keys | Technical teams and some regulated exchanges |
| Gmail confidential mode | Not message encryption: content is replaced with a link and sharing options are removed | Opens the link, sometimes with a passcode | Discouraging forwarding and downloading, with expiry and revocation |
TLS matters, but on its own it is not enough for sensitive content: it protects mail between servers, not once the message is stored, and ordinary TLS falls back to an unencrypted connection if the other server does not support it. The more reliable services use TLS where it is available and switch automatically to a portal or encrypted document where it is not, so a sensitive message is not sent in the clear.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Sending secure email from Microsoft 365
Microsoft 365 includes Microsoft Purview Message Encryption, the replacement for the older Office 365 Message Encryption.
- Sender choice: users encrypt from Outlook with options such as Encrypt-Only and Do Not Forward, or with a sensitivity label that encrypts
- By policy: administrators create Exchange mail flow rules that encrypt automatically, for example for certain recipients or keywords, and Purview DLP can find sensitive data that should be protected
- For recipients: people on Microsoft 365 read encrypted mail natively in Outlook; people on Gmail, Yahoo and other services get a link to an encrypted message portal and sign in with a Microsoft, Google or Yahoo account or a one-time passcode
- Advanced Message Encryption adds branding templates, automatic policies based on sensitive information types, expiry and the ability to revoke mail sent outside the organisation
Message Encryption is included in Microsoft 365 Business Premium, Microsoft 365 E3 and E5, and Office 365 E3 and E5. Business Basic and Business Standard can add it with Azure Information Protection Plan 1. Advanced Message Encryption comes with higher-tier licences such as Microsoft 365 E5 and the Microsoft Purview Suite. Our sister site's email encryption guide has the Outlook steps, and Forever Group's Microsoft licensing team can check what you hold.
Sending secure email from Google Workspace
Google Workspace protects every message with TLS where the receiving server supports it, and Gmail shows the level of protection with a lock icon. Beyond that, what you can do depends on your edition:
- Secure transport (TLS) compliance: an admin setting that requires TLS for the domains or addresses you list; mail that cannot use TLS bounces rather than being sent unencrypted
- Confidential mode: available in all Google Workspace editions; it sets an expiry date, lets you revoke access and removes the options to forward, copy, print and download, but it is a sharing control rather than end-to-end encryption
- Hosted S/MIME: listed by Google for Frontline Plus, Enterprise Plus and Education editions, and it needs the recipient to have S/MIME too
- Client-side encryption: listed for Frontline Plus, Enterprise Plus, Education Standard and Education Plus, with keys held outside Google
On Business Starter, Standard or Plus, the practical route to message-level encryption is usually a third-party service with a Gmail add-on. Our guide to sending secure email in Gmail explains each option step by step. We do not sell Google Workspace licences; we help you use the edition you have and add what it lacks.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Dedicated secure email services we supply
If the built-in options do not fit your recipients, these are the services we supply that send secure email:
| Service | How senders encrypt | How recipients read it | Mail platforms | Read more |
|---|---|---|---|---|
| Echoworx | By policy, when your DLP or gateway flags a message, or from an Outlook add-in or Gmail add-on | TLS, branded web portal with secure reply, encrypted PDF or attachment, S/MIME or PGP | Microsoft 365, Google Workspace or behind a gateway | Echoworx |
| IRONSCALES Email Encryption | Outlook add-in or a subject keyword; a DLP licence adds policy-based encryption | A secure recipient portal | Microsoft 365 only | IRONSCALES email encryption licensing |
| Proofpoint Essentials | Automatically by filter rules, or by the sender with a subject-line tag or an Outlook send securely button | Proofpoint's Secure Mail web portal, with secure reply | Cloud gateway in front of Microsoft 365 and other mail platforms | Proofpoint Essentials |
| Check Point Email Security (Complete Protect) | DLP policies that can encrypt sensitive email automatically | Confirmed at quote | Microsoft 365 and Gmail, by API | Harmony Email Complete Protect |
| Sophos Email with Portal Encryption | Through Sophos Email, with the Portal Encryption add-on | A web portal to read and reply; custom branding with the add-on | Microsoft 365 and Google Workspace | Sophos Email |
| Trend Micro Cloud Email Gateway Protection | Gateway encryption policies (Essentials and Pro packages) | Depends on the policy configured | Gateway in front of Microsoft 365 or Gmail | Trend Micro email security |
Proofpoint Essentials comes in several packages and not all of them include encryption, so we confirm the package at quote. Sophos Portal Encryption cannot exceed your Sophos Email licence count. If you already run one of these products for inbound protection, compare its encryption with what your Microsoft 365 or Google Workspace plan already includes before adding another tool.
Sending secure email to clients: a practical checklist
Most problems with secure email are not about cryptography. They are about recipients who cannot open the message, staff who forget to encrypt and notifications that look like phishing. This checklist avoids the common ones:
- Decide what counts as sensitive. Bank details, health information, payroll, identity documents and client files are the usual starting points.
- Pick a default method your recipients can open. A portal or TLS with fallback suits the public; S/MIME suits partners who already use it.
- Encrypt by policy, not memory. Use rules or email DLP so sensitive mail is protected even when the sender forgets.
- Check the recipient before it goes. External recipient warnings and DLP policy tips catch autocomplete mistakes.
- Make notifications trustworthy. Brand the portal, keep wording consistent and enforce DMARC on your domain so a genuine secure message is not mistaken for email spoofing.
- Tell clients what to expect. A short note on your website or engagement letter explaining how secure messages arrive reduces queries and stops recipients ignoring them.
- Test the journey. Send to a Gmail, Outlook.com and corporate address and open each on a phone before rolling out.
UK GDPR and sending personal data by email
UK GDPR requires organisations to protect personal data with security appropriate to the risk, and Article 32 names "the pseudonymisation and encryption of personal data" as an example of an appropriate measure. It does not require every email to be encrypted, but where you send sensitive personal data outside the organisation, encryption is the safeguard people expect.
Sending personal data to the wrong person can itself be a personal data breach, which you then have to assess and, where it is likely to result in a risk to people, report to the ICO within 72 hours of becoming aware of it. That is why secure email is as much about checking recipients and being able to revoke access as it is about encryption. Professional bodies, regulators and client contracts may set their own expectations on top; we help you map those to a method rather than interpret them for you.
How we help you send secure email
Forever Systems works with organisations on Microsoft 365, Google Workspace or both, and we supply several encryption options, so we can recommend the one that fits rather than the one we happen to sell. We can:
- Find out what you send, who to and under which client or regulatory expectations
- Check what your Microsoft 365 or Google Workspace licences already include, and set it up properly
- Recommend Microsoft Purview, a Gmail option, the encryption in your email security product or a dedicated service such as Echoworx
- Build policies that encrypt automatically, set up branding and recipient sign-in, and pilot with a small group
- Brief staff on when encryption applies and how recipients open messages
Pricing depends on the product, edition and number of users: ask us for a quote. Contact us to talk about sending secure email.
Explore Send secure email
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
How do I send a secure email?
Use message-level encryption for anything sensitive. In Microsoft 365, choose Encrypt in Outlook if your plan includes Microsoft Purview Message Encryption. In Google Workspace, use S/MIME or client-side encryption if your edition has them, or confidential mode to restrict sharing. Otherwise, a dedicated service such as Echoworx adds encryption from Outlook or Gmail.
What is the difference between secure email and encrypted email?
Encrypted email means the content can only be read by someone with the right key or sign-in. Secure email is the wider outcome: encrypted in transit and at the message level where needed, sent to the right person, authenticated as genuinely from you, and controllable after sending through expiry, revocation or secure reply.
Is TLS enough to send secure email?
TLS protects the connection between mail servers, which is a good baseline, but it does not protect the message once it is stored and ordinary TLS falls back to an unencrypted connection if the other server does not support it. For sensitive personal or financial information, use enforced TLS with known partners or message-level encryption such as a portal, encrypted PDF or S/MIME.
How do I send a secure email to a client?
Choose a method the client can open without special software, usually a secure portal or an encrypted PDF, and encrypt by policy so it does not depend on the sender remembering. Tell clients how secure messages will arrive, brand the notifications and make sure your domain has SPF, DKIM and DMARC so they are not mistaken for phishing.
Is sending secure email included in Microsoft 365?
Microsoft Purview Message Encryption is included in Microsoft 365 Business Premium, Microsoft 365 E3 and E5, and Office 365 E3 and E5. Business Basic and Business Standard can add it with Azure Information Protection Plan 1. Advanced Message Encryption, with expiry and revocation for external mail, needs higher-tier licences such as Microsoft 365 E5.
Can the recipient reply securely?
With a secure portal, yes: Microsoft Purview's encrypted message portal, Proofpoint Essentials' Secure Mail portal, Sophos Portal Encryption and Echoworx's portal all let recipients reply inside the protected channel. With TLS or an encrypted PDF, the reply is an ordinary email unless the recipient encrypts it themselves.
Still have a question about secure email for business?
Ask us and a member of our team will reply by email.
More email security guides
EchoworxPolicy-driven email encryption with TLS, branded portal, encrypted PDF and S/MIME or PGP delivery.Email authenticationSPF, DKIM, DMARC, MTA-STS and BIMI explained, in the order to deploy them for Microsoft 365 and Google Workspace.Small businessWhat a 5 to 250 person firm actually needs, in the order to do it.