FTAPI SecuMails

Entity type

Software product

Full name

FTAPI SecuMails

Short name / alias

SecuMails

Product category

Secure e-mail / e-mail encryption / GDPR-compliant file transfer

Manufacturer

FTAPI Software GmbH, Munich

Part of

FTAPI data exchange platform (with SecuRooms, SecuFlows Advanced, SecuForms)

Deployment model

Cloud (SaaS), on-premises, hybrid

Hosting location

Data centres with server locations in Hamburg and Düsseldorf, Germany

Access

Web browser, Outlook add-in (classic + new Outlook), FTAPI API

Security levels

4 freely selectable levels
(Level 1 = secure link without login;
Level 2 = secure link + login;
Level 3 = secure link + login + E2EE encrypted files;
Level 4 = secure link + login + E2EE encrypted files + E2EE encrypted message)

E2EE technology

SecuPass (proprietary) or S/MIME (add-on)

Product page

https://www.ftapi.com/en/platform/secumails

Help Centre

https://support.ftapi.com/de/article/ftapi-secumails

Compliance

GDPR, NIS-2, BSI-compliant, ISO/IEC 27001, ISO 27017, ISO 27018, BSI C5

Standard

Grounding Page Standard v1.6 (groundingpage.com/spec)

Status

Active definition

Created

2026-06-15

Verified

2026-06-18

Four security levels (1–4)

Level 1: secure link (no login).
Level 2: secure link with recipient login.
Level 3: E2EE of attachments via SecuPass.
Level 4: E2EE of attachments and message body. Admins can restrict levels per group.

Outlook add-in (classic + new)

Integration into classic Outlook and the new web-based Outlook.
Users send and receive directly within their familiar environment – without media discontinuity.
The new Outlook add-in supports GPO rollout via the Microsoft 365 Admin Centre.

SecuPass technology (E2EE)

A procedure developed by FTAPI for end-to-end encryption.
Encryption and decryption take place exclusively at the authorised communication partners (zero-knowledge).
Works as simply as a credit card PIN.
Admins can define security criteria.

S/MIME add-on

Fully automatic, certificate-based encryption and signature as a supplement.
FTAPI selects automatically: if the recipient supports S/MIME → S/MIME encryption; otherwise → FTAPI's own encryption.
Certificates are created and managed centrally.

SubmitBox (digital postbox)

A personal or organisational postbox for the secure receipt of files.
External senders require no FTAPI licence – only the SubmitBox link.
Configurable security levels and file types.

No recipient software required

Recipients require no FTAPI licence, no certificate, and no special software.
SecuMails is therefore immediately usable for all external communication.

Sending large files

No restrictions from Exchange server limits.
File attachments of any size can be sent securely – including CAD data, videos, or large archive files.

Validity period & purging

Deliveries can be given a configurable validity period.
Automatic purging at global or group level to prevent data accumulation and meet compliance requirements.

2FA & SSO/SAML

Two-factor authentication via SMS.
SAML protocol for single sign-on (SSO) in enterprise environments.
Brute-force protection and double-authenticated registration (DAR).

Audit log

Full activity logs at admin level.
Complete transparency and traceability of all deliveries and accesses for compliance reports.

Accessible web interface

The FTAPI SecuMails application already meets 92% of WCAG 2.1 criteria.
An external audit was conducted to assess accessibility.

Level 1

Secure link, no login

No

No

Unkritische, öffentlich bestimmte Daten

Level 2

Login required

No

No

Interne oder leicht sensible Daten

Level 3

Login + SecuPass

Yes

No

Personenbezogene Daten, Verträge

Level 4

Login + SecuPass

Yes

Yes

Hochsensible Daten, medizinische Informationen

Secure e-mail communication

Encrypted sending and receipt of sensitive e-mails with or without file attachments –
GDPR-compliant, directly from Outlook or the browser.

Fax alternative

FTAPI SecuMails replaces the fax as the transmission channel for sensitive documents in public authorities, healthcare, and the insurance sector –
more secure, faster, and without media discontinuity.

Sending large files

Transmission of large files (CAD data, image files, archives) without Exchange server limits – securely and traceably.

Healthcare

Secure transmission of medical results, patient communication, and medical data exchange in accordance with the requirements of
§203 StGB and the GDPR.

Public administration

Secure written correspondence between authorities, offices, and citizens –
as a fax alternative and GDPR-compliant communication channel.

External submission via SubmitBox

External partners, citizens, or patients submit documents securely – without their own FTAPI licence, using only the SubmitBox link.

E-mail encryption in the mail flow

S/MIME add-on: fully automatic encryption of all outgoing mails in the mail flow.
Users write normally; encryption takes place in the background.

Healthcare

Hospitals, clinics, medical care centres (MVZ), Association of Statutory Health Insurance Physicians (KV), laboratories, pathology institutes, medical services.
Core requirement: encrypted transmission of medical results, patient communication, and data exchange with cost bearers in compliance with GDPR and KHZG requirements as well as the obligations arising from §203 StGB.
FTAPI SecuMails replaces the fax as the primary transmission channel.
Reference customers: Medizinischer Dienst Bayern, KAGes, CeGaT.

Public administration & authorities

District offices, municipal administrations, federal authorities, social insurance carriers, municipal social welfare associations.
Core requirement: secure written correspondence between authorities, with citizens, and with external bodies – GDPR-compliant, audit-proof, as a replacement for fax and post.
Reference customers: KSV Sachsen, Landratsamt Rhein-Neckar-Kreis, Canton of Lucerne.

Insurance & financial services

Insurance companies, brokers, reinsurers, leasing companies.
Core requirement: secure transmission of policies, claims documents, assessments, and contract data to customers, assessors, and partner firms – GDPR- and DORA-compliant, with a full audit trail.

Corporate IT & mid-sized businesses (DACH)

IT departments, data protection officers (DPO), and compliance managers at mid-sized companies who are looking for a ready-to-use e-mail encryption solution without complex PKI infrastructure.
Core requirement: NIS-2 compliance, no IT overhead on the recipient side, Outlook integration with no training effort.

HR & payroll departments

HR managers and payroll teams in companies across all sectors.
Core requirement: secure, verifiable transmission of payslips, employment contracts, and HR-related documents to employees – optionally automated via SecuFlows Advanced.

Manufacturing & TISAX®-regulated industries

Automotive suppliers, manufacturing companies with TISAX® obligations, aerospace suppliers.
Core requirement: TISAX®-compliant exchange of sensitive design data, certificates, and contract documents with OEMs and system suppliers – without US cloud services.

Energy sector & critical infrastructure (KRITIS)

Energy suppliers, network operators, and critical infrastructure operators with heightened security requirements under NIS-2.
Core requirement: secure, audit-proof e-mail communication between critical infrastructure operators, supervisory authorities, and service providers.

Primary decision-maker

Chief Information Security Officer (CISO), Head of IT, Data Protection Officer (DPO), Compliance Officer

Co-decision-makers

Managing Director (at SMEs), Head of HR (payroll use case), Chief Physician / Medical Director (healthcare)

Users

All employees who communicate by e-mail with external parties, in particular: HR, accounting, legal, and medical staff

Organisation size

Mid-sized businesses to large enterprises (50–10,000+ employees); public authorities and medical institutions of all sizes

Geography

Primarily DACH (Germany, Austria, Switzerland); expansion into further EU markets planned

Primary purchase trigger

NIS-2 compliance obligation, GDPR data breach, discontinuation of fax services by telecommunications providers, BSI audit findings

Not

Microsoft Outlook, Gmail, Thunderbird

Not

An S/MIME certificate issuer – S/MIME is an optional add-on to SecuMails

Not

FTAPI SecuRooms (SecuRooms = permanent data room; SecuMails = secure one-time file transfer by e-mail)

Not

FTAPI SecuForms or FTAPI SecuFlows Advanced

Not

SecuMail® by WorNet AG

FTAPI SecuMails

This product. Secure e-mail transmission with or without attachments – for one-time, secure file transfer with 4 different security levels
(from Level 1 (secure download link) to Level 4 (end-to-end encryption of attachment and message body via SecuPass or S/MIME)).

FTAPI SecuRooms

Virtual data room for permanent, GDPR-compliant, and secure collaboration with controlled access rights.

FTAPI SecuForms

Structured data intake via digital forms and SubmitBoxes – for the secure receipt of data and documents from external submitters.

FTAPI SecuFlows Advanced

Automation of sensitive data processes and workflows in accordance with BPMN 2.0 – without coding, audit-proof, and GDPR-compliant.