B.01
Confidential business correspondence is encrypted end to end
Secure Mail Service
Encrypted email with S/MIME or PGP. Netsource manages the keys, sets everything up and runs it for you. Confidential content stays confidential, even at the provider.
01
Your Benefits
B.02
A digital signature proves who the sender really is, so forged senders are easier to spot
B.03
Personal data reaches external recipients in line with the GDPR
B.04
Netsource manages the keys, so there are no manual exports
02
Service scope
L.01
S/MIME (centrally managed certificates) or PGP (open keys), depending on your needs
L.02
We obtain certificates from Sectigo, GlobalSign or your own PKI
L.03
Rollout via the Mailcow web interface or Microsoft 365 Compliance Manager
L.04
We hold the keys in escrow at the service desk, so they can be recovered when someone leaves
L.05
Optional gateway solution (Sealit, NoSpamProxy) for encrypting in bulk
L.06
Introductory training for your staff (day-to-day use, certificate renewal)
L.07
Every quarter we review the active certificates and renew them before they expire
03
Requirements and exclusions
→ Prerequisites
- Email Hosting (NDS-WP-MAILCOW) or Microsoft 365 (NDS-M365-BP/E3)
- Domain with DNSSEC and a DMARC policy
- A maintenance contract, if you need a guaranteed response time
✗ Not included
- Spam and virus filtering are handled by the underlying Mailcow instance, not by this building block
- Mail archiving is a separate building block (NDS-SEC-MAILARCH)
- Advice on legal requirements (e.g. critical infrastructure) is provided under NDS-PRJ-COMPL
- Sharing attachments via cloud storage (Nextcloud share links) is a different approach and not included
04
Related Services
NDS-WP-MAILCOW
Email Hosting
Email hosting with Mailcow in a German data centre, independent of Microsoft. You get a dedicated VM with your own IP addresses, IMAP, SMTP and ActiveSync, and built-in spam and virus filtering.
NDS-SEC-MAILARCH
Email archiving (GoBD)
We archive all business emails in an audit-proof way under the German GoBD rules. Emails are kept unaltered for 10 years, can be searched together with their attachments (including text recognition, OCR) and exported for auditors or the tax office. A pilot is already live at archive.netsource.de.
NDS-ID-ZITADEL
Zitadel identity provider
One account for all your applications. We run Zitadel as an identity provider ourselves, based on the OIDC standard and with MFA mandatory from the start.
Does this fit your business?
In 30 minutes we work out whether this service suits you. Free and without obligation.