Send encrypted emails and files directly from Outlook, without the recipient needing an account.
Secure email in Outlook means that your message and attachments are encrypted, reach only the intended recipient, and cannot be read by anyone else while in transit or in storage. By default, Outlook does not do this automatically. Microsoft 365 secures the connection between mail servers with TLS whenever possible, but once a message arrives, it appears in plain text in mailboxes, can be freely forwarded, and you have no control over who opens it. Microsoft also offers its own encryption options, but these depend on your license and must be configured by an administrator. FileCap adds secure email directly to Outlook. You compose your email as usual, choose to send it securely, and the recipient opens it after verification. The recipient doesn’t need an account, and your data remains in Europe.
Email was never designed to be confidential. The underlying protocol, SMTP, sends messages in plain text unless something else protects them. In Microsoft 365, that "something else" is usually TLS.
TLS protects only the route, not the message. TLS encrypts the connection between two mail servers. This often works on an ad hoc basis: if the receiving server does not support it, the message may be delivered unencrypted, unless your administrator has enforced TLS on a connector. Once delivered, the email is in plain text in the recipient’s mailbox, in backups, and on any device that syncs with it.
By default, there is no end-to-end encryption. Outlook for Microsoft 365, Outlook 2019, and the new Outlook for Windows can all work with S/MIME, but only if both the sender and the recipient have a certificate installed. In practice, few external recipients have one.
Microsoft Purview Message Encryption depends on your license. Not every Microsoft 365 subscription includes it, and it requires configuration through mailflow rules and confidentiality labels. As a result, it’s an IT project—not a button that every employee can rely on.
Human error remains the biggest risk. Autocomplete might select the wrong recipient, a message might be forwarded to someone outside the organization, or a sensitive attachment might be sent to a personal email address. Outlook’s recall feature only works in limited situations, usually within the same Exchange organization. Read more in “Recall an Email in Outlook? There’s a Smarter Way.”
Attachment limits lead to unsafe workarounds. Exchange Online limits message size, typically around 35 MB and up to 150 MB. If a file is too large, users resort to consumer-grade tools that the organization has no control over.
With the FileCap add-in, secure emailing becomes part of your regular workflow in Outlook.
Business rules can also alert users or automatically enforce secure transmission if an email contains sensitive data, such as a social security number or IBAN. Learn more about DLP business rules.
Microsoft's own options are useful, and for some organizations, they are sufficient. This comparison shows where each option fits.
When is built-in encryption sufficient? If you already have a Microsoft 365 subscription with Purview Message Encryption, primarily share with other Microsoft 365 organizations, and rarely send large files, then the built-in option may be sufficient. S/MIME remains the strongest choice for true end-to-end encryption between organizations that both manage certificates, such as government agencies.
When does FileCap add value? When you share files with many different external parties, send large files, want to provide recipients with a consistent experience, or want to host your data outside of the major U.S. cloud providers. The two approaches can also work side by side. Learn more in “Email Encryption in Microsoft 365 and Outlook.”
Sources: Microsoft Learn, " Email Encryption in Microsoft 365," and " S/MIME in Exchange Online."
For B2B organizations and the public sector, secure email is not only best practice but also a legal requirement.
GDPR. Article 32 lists encryption as an appropriate technical measure to protect personal data. It also applies if something goes wrong. According to Article 34, you may not be required to notify data subjects of a data breach if the data was encrypted and unreadable to the recipient. Access logs also help you demonstrate accountability.
NIS2. Article 21 requires essential and important entities to have policies in place for cryptography and, where appropriate, encryption, as well as for access control. Encrypted email with verified access is a concrete way to demonstrate to auditors that these policies are being applied in day-to-day operations. Learn more about NIS2.
Industry standards. Financial institutions must comply with DORA. Dutch healthcare providers follow NTA 7516 for secure email exchange.
FileCap is ISO 27001-certified, hosts data in Europe, and never uses customer data for AI training.
You can use S/MIME, Microsoft Purview Message Encryption, or a secure email add-in such as FileCap. With FileCap, you compose your email as usual, select the option to send it securely, set up an authentication method, and send it.
Only in transit, and only partially. Microsoft 365 uses TLS between mail servers whenever possible, but messages are not end-to-end encrypted and are stored in a readable format in mailboxes.
S/MIME uses certificates on both ends and provides end-to-end encryption, but it is complex to set up. Purview Message Encryption is centrally managed by your administrator and works for recipients without certificates, but it depends on your Microsoft 365 license.
Yes. You can use S/MIME certificates or a third-party solution such as FileCap, which works with Outlook for Microsoft 365, the new Outlook, Outlook on the web, and the classic Outlook for Windows.
The recipient receives a notification with a secure link, verifies their identity with a password or code, and reads the message in a secure portal. FileCap does not require an account or software for this.
Yes. The FileCap add-in works in the new Outlook and in Outlook on the web. Learn more about the new version of Outlook and the FileCap integration.
Encryption and access control are measures explicitly mentioned in the GDPR. Whether you are compliant also depends on where data is stored and who has access to it. Therefore, choose a solution with European hosting and clear logging.
The FileCap add-in makes sending a secure email or sensitive files child's play. Check out how it works below:
Invite someone to send you large files or a message securely with FileCap. Fast and simple!
Choose one of four available authentication methods: password, code via email, code via SMS or a company password. Sending extra sensitive information? Simply use a second verification.
Customize your FileCap portal with a large background, your company logo and, of course, matching colors. The emails that you send with FileCap will also automatically receive your house style. Very familiar for your customers.
By taking advantage of the additional security options, business rules to monitor the content of emails and messages and the ability to retract sent messages, you reduce the likelihood of data breaches.
Try FileCap free for 30 days, with no obligation and no restrictions. Install the Outlook add-in and send your first secure email in just a few minutes.
Start your free trial
