An ordinary email is like a postcard. The connection between two mail servers is usually protected by TLS today, but on the servers themselves the messages are readable. And whether TLS applies at all also depends on the recipient’s server. For payslips, tax documents, medical reports or contracts, that is not enough.
The Swiss Federal Act on Data Protection requires personal data to be protected by appropriate technical measures. Anyone sending sensitive data or data covered by professional secrecy by email therefore needs real encryption of the content.
Three ways to protect email
- Transport encryption (TLS). Protects the connection between servers, not the message itself. It is essential, but only the foundation.
- End-to-end encryption with S/MIME or OpenPGP. The message stays encrypted all the way to the recipient. Every person needs a certificate or key, and setting this up on every device is too much for many teams.
- Encryption gateway. A central server encrypts and signs email automatically according to fixed rules. Staff write as usual in Outlook or webmail.
For SMEs, a gateway is usually the most practical route because it needs no software on the workstations.
What CipherMail is
CipherMail is an encryption gateway from a Dutch vendor. It sits in the mail flow between your mail server and the internet. There is an open-source edition and a commercial version with additional features such as the webmail portal. CipherMail works with any mail server that speaks SMTP: Exchange, Microsoft 365, Google Workspace or Zimbra.
How the encryption works
CipherMail picks the right method for each recipient:
- S/MIME or OpenPGP if the recipient has a certificate or key. This is the case for many authorities, banks and larger companies.
- Password-protected PDF if the recipient has no encryption of their own. The message and attachments arrive as an encrypted PDF. The recipient gets the password by text message or from the sender. Replies can be encrypted too.
- Webmail portal, in the commercial version. The recipient reads the message in a protected portal in the browser.
Outgoing email can also be digitally signed. The recipient can then see that the message really comes from you and was not altered on the way. This also helps against fake invoices.
Rules instead of clicks
The biggest advantage of a gateway: nobody has to remember. Typical rules are:
- Messages with the word “confidential” in the subject are always encrypted.
- Messages from HR or accounting to external recipients are always encrypted.
- Certain recipients, such as a fiduciary or a laboratory, only ever receive encrypted email.
- Content matching certain patterns can be checked before sending and held back if needed.
What encryption does not protect
Even with CipherMail, the sender, recipient and time of an email remain visible, and with S/MIME and OpenPGP usually the subject as well. Confidential details therefore belong in the body or attachment, not the subject line. And encryption does not replace a spam filter: against phishing and malware you still need a filter such as Proxmox Mail Gateway and properly configured SPF, DKIM and DMARC records.
Who benefits
- Fiduciaries handling payslips, tax returns and annual accounts
- Medical and therapy practices that also need to communicate securely outside closed networks
- Law firms and counselling services bound by professional secrecy
- HR departments of any size
More on the legal requirements in our article on IT measures under the Swiss Data Protection Act.
How we implement CipherMail
- Clarify needs. Which messages must be encrypted, to whom, and which methods do your key partners use?
- Set up the gateway. CipherMail runs on a server in Switzerland, on your premises or in our infrastructure, and is integrated into the mail flow.
- Rules and certificates. We define the rules, obtain certificates and configure PDF encryption.
- Training. A short introduction shows staff when encryption applies and how recipients can reply.
CipherMail complements our other email building blocks: Zimbra as the mail server, Proxmox Mail Gateway as the filter and MailStore for archiving. More under email security.
Frequently asked questions
Do recipients need to install anything?
No. Without a certificate they receive a password-protected PDF that opens in any PDF reader, or they read the message in the webmail portal.
Does CipherMail work with Microsoft 365?
Yes. The gateway is integrated into the Microsoft 365 mail flow. Staff keep working in Outlook.
What about incoming encrypted email?
CipherMail can decrypt incoming S/MIME and OpenPGP messages and verify the signature before they reach the mailbox.
Isn’t Microsoft 365 encryption enough?
Microsoft 365 offers its own encryption features, but they depend on the licence level and on Microsoft. A dedicated gateway works with any mail server, and the keys stay with you.
