Best Secure Email for Business in 2026: 7 Encrypted Email Solutions Checked Plan by Plan
Reviewed · Updated
On 10/09/2026 I checked seven encrypted email solutions sold to businesses, from a $6.99-a-user mailbox to a gateway with no price on the page: what each costs per user, whether it hosts your mail or sits on top of Google Workspace or Microsoft 365, what it says it encrypts, and whether it offers a HIPAA Business Associate Agreement, in its own words. No trial was started and no demo requested. The order below is the order of the scores on our scale. Proton Mail, Tuta and Paubox are scored; Mailfence, Virtru, Hushmail and OpenText (Zix) have no score, so they sit under the ranking without a number. This is not legal advice.
Key takeaways
- Top score: Tuta, 8.5/10. Its section below says why, and where it falls short.
- Cheapest hosted mailbox per user: Tuta Essential at €6 a month paid yearly (euros only), then Proton Mail Essentials at $6.99 a month, $83.88 a year, with 3 custom domains.
- Keep Gmail or Microsoft 365 and add encryption: Paubox from $32 a month for up to 5 senders, Virtru from $119 a month for 5 users billed annually.
- BAA stated on the pricing page: Paubox (all accounts) and Hushmail (every healthcare plan). Virtru: most paid packages, per its support site. Proton: on request by email. Tuta, Mailfence: no BAA page found. OpenText: not on the product page.
- No published price: OpenText Core Email Encryption, the product that was Zix.
- Not verified by us: Mailfence’s prices and terms, because its site refused our connection on 10/09/2026; every admin console, because no trial was started.
Quick comparison
| # · Service | Score | Best for | Free storage / aliases | Custom domain | Price/yr (renewal) | Cancel | Data asked | Support | Try |
|---|---|---|---|---|---|---|---|---|---|
| 1 Tuta | 8.5/10 | Subjects encrypted; euro pricing | No free business plan | 3 on Essential; 10 on Advanced; unlimited on Unlimited | €72/user/yr (EUR only)Essential, €6/user/month paid yearly, taxes excluded; auto-renews | Terms §5: cancel in the account or in writing; business terms have a one-month notice | Business customers must give full name and address (terms §6.1); form not opened | Email support; hours not published | no review yet |
| 2 Proton Mail | 8.1/10 | Per-user price, BAA on request | No free business plan; 14-day trial not seen | 3 on Mail Essentials; 15 on Workspace Standard | $83.88/user/yrMail Essentials, $6.99/user/month, “Billed at $83.88 every 12 months”; taxes may apply | Settings → Subscription → Cancel (help center); 30-day money-back | Business sign-up not opened; consumer sign-up asks username and password | Support form; our consumer question of 10/09/2026 unanswered when written | Visit Proton Mail |
| 3 Paubox | 8.0/10 | Every email encrypted, BAA included | 14-day free trial; no free plan | Uses your existing domain | $384/yr (as $32/month)Email Suite Standard, “$32/month, Up to 5 senders”; monthly/annual toggle showed the same figure; our math: $32 × 12 | Not captured: not on the pricing page | Trial sign-up not opened | U.S.-based phone and email (claim); hours not published | no review yet |
| — Mailfence | pending | OpenPGP, IMAP, mixed tiers | 500 MB free plan, web only | Paid plans (KB) | €90/user/yr (EUR, from its blog)Pro €7.50/user/month per Mailfence’s blog (10/21/2025); site unreachable 10/09/2026 | Not captured: site unreachable | Not captured: sign-up page unreachable | Email support@mailfence.com (KB) | no review yet |
| — Virtru | pending | Encrypts existing Gmail/M365 | No free plan on the packages page | Uses your existing domain | $1,428/yrStarter, “$119/month, Includes 5 Users (billed annually)”; demo required | Not captured: sales contract | Demo request form | “Online support” on Starter; hours not published | no review yet |
| — Hushmail | pending | Solo practice, BAA, forms | 14-day trial; no free plan | Yes, on every plan | $131.89/yrHealthcare Basic, $11/month, “$131.89 billed yearly”, 1 month free; 10 GB | Not captured: not on the pricing page; help URLs 404 | Trial sign-up not opened | Email and scheduled callback on Basic; hours not published | no review yet |
| — Zix (OpenText Core Email Encryption) | pending | Enterprise, DLP-driven, price on request | No free plan | Uses your existing mail system | Price on requestNo price on the product page; “Book a demo” only | Not captured: enterprise contract | Demo request form | OpenText support portal; hours not published | no review yet |
Affiliate link · how it works →
Ranking by our scale · Prices verified 10/09/2026 · Cancel: path from each help center or terms, not tested
How we built this ranking
Every participant got a desk review on 10/09/2026: the business pricing page in US dollars where one exists, the page that says what is encrypted and how recipients open mail, the terms where reachable, and the page that answers the HIPAA question. Proton also has our consumer run from the same day (a free account and the Mail Plus checkout to the card field), which is why it is the only service here with anything seen from inside. Mailfence’s main site returned nothing to our network, so its entry rests on its knowledge base and a blog post dated 10/21/2025.
HIPAA is handled one way throughout: I quote whether the vendor says it offers a Business Associate Agreement and on which plans, with the page and date, and nothing more. Whether a product makes your practice compliant is a question for your compliance officer or lawyer. This is not legal advice.
The score combines six parts: Results 30% · Price & value 20% · Checkout honesty 15% · Data handling 15% · Ease of use 10% · Support 10%. A service is ranked once it has a run and a score. Six of the seven have no affiliate program with us, so they have no button, only a plain link.
The order of this table is the order of the scores. Whether a company pays us a commission or nothing at all doesn’t move a single row.
1. Tuta — best overall
For freelancers and small teams that want subject lines and calendars encrypted on their own domain, and can pay in euros.
- Checkout
- Plan
- Cancel
- Your data
- Eligibility
- Support
- Inside
8.5/10: for a freelancer or small team that wants subject lines, calendars and contacts encrypted, not just bodies, from €6 per user a month. No BAA page was found on tuta.com, and prices are in euros only.
Tuta’s business page on 10/09/2026 listed Essential at €6 per user a month paid yearly, “Excludes taxes,” with 50 GB, 15 extra addresses and 3 custom domains; Advanced at €8 with 500 GB, 30 addresses and 10 domains; and Unlimited at €12 with 1,000 GB and unlimited domains. The page states that all plans “automatically renew at the end of the chosen subscription period.” Tutao GmbH is in Hanover, Germany, and its terms require business customers to give a full name and an address suitable for legal service. Business contracts with a fixed term can be ended with one month’s notice before the term ends; otherwise they renew for the same term.
The encryption claims are the same as on the personal plans: emails “including subject lines and all attachments,” calendars with their metadata, and contacts are encrypted, and the clients are open source. Mail to people outside Tuta is encrypted only with a shared password. Tuta doesn’t offer IMAP, so a team uses its web, desktop and mobile apps.
A search of tuta.com for “HIPAA” and “business associate” on 10/09/2026 returned no page, so we can’t say whether Tuta signs a BAA; ask before relying on it for health data. This is not legal advice.
Where it falls short: no IMAP or SMTP for existing tools, no published BAA, and no US dollar price. The sign-up form was not submitted, so the admin console and the team settings are described from Tuta’s pages, not from our screen.
- Results9.5
- Price & value7.0
- Checkout honesty9.5
- Data handling9.5
- Ease of use7.0
- Support7.0
2. Proton Mail — for encrypted email with a BAA on request
For small businesses that want encrypted mail, calendar and drive with custom domains, a published price per user, and a BAA they can request by email.
- Checkout
- Plan
- Cancel
- Your data
- Eligibility
- Support
- Inside
Paid from $83.88/yr · verified 10/09/2026
8.1/10: for a small business that wants encrypted email on its own domain at a published per-user price, $83.88 a user a year, and a BAA it can request by email. Encryption between Proton users is end to end; to everyone else it needs a password.
Proton for Business, on 10/09/2026, showed three self-serve tiers in US dollars with yearly billing: Mail Essentials at $6.99 per user a month, “Billed at $83.88 every 12 months,” with 15 GB per user and 3 custom email domains; Workspace Standard at $12.99, $155.88 a year, with 1 TB, 15 domains, meetings, VPN and a team password manager; and Workspace Premium at $19.99, $239.88 a year, with 3 TB, 20 domains and data retention policies. Enterprise is “Let’s talk.” Each card says “Taxes may apply,” and the pricing page promises a 30-day money-back guarantee. The comparison table lists 20 email addresses per user, catch-all addresses, email groups, SMTP for external tools and support for Outlook, Thunderbird and Apple Mail on the Workspace plans.
On HIPAA, Proton’s BAA page (last modified 07/17/2026) says its compliance statement “is not intended to take the place of a Business Associate Agreement” and that a signed BAA is requested by emailing privacy@support.proton.me with the subject “HIPAA BAA.” A model BAA is linked as a PDF. The healthcare page lists a “Do you provide a business associate agreement?” FAQ. We didn’t request one, so the turnaround and any plan requirement are not known to us. This is not legal advice.
Where it falls short: mail to customers outside Proton is only encrypted end to end if you set a password or they use PGP; otherwise it travels with TLS like any other mail. Subject lines aren’t end-to-end encrypted. The BAA is by email request, not a checkbox at checkout. We saw the consumer checkout, not the business one, so the business order screen and the renewal line are not verified.
- Results9.5
- Price & value7.0
- Checkout honesty7.0
- Data handling9.5
- Ease of use7.0
- Support7.0
3. Paubox — for automatic encryption with a BAA on every account
For healthcare senders on Google Workspace or Microsoft 365 who want every outbound email encrypted without portals, and a BAA included from day one.
- Checkout
- Plan
- Cancel
- Your data
- Eligibility
- Support
- Inside
14-day free trial · paid from $32/mo · verified 10/09/2026
8.0/10: for a clinic or practice that wants every outbound email encrypted automatically from its existing Google or Microsoft mailbox, with a BAA on every account, from $32 a month for up to five senders.
Paubox’s Email Suite pricing page on 10/09/2026 showed Standard at $32 a month for up to 5 senders, “HIPAA compliant email + forms,” with a 14-day free trial; Plus at $65 with inbound protection against spam and phishing; and Premium at $75 with archiving and data loss prevention. The page has a monthly and an “Annually (Save 30%)” toggle, and both views we clicked displayed $32, so the exact annual figure should be confirmed at checkout. Under “Every plan includes,” Paubox lists U.S.-based phone and email support, encrypted forms, “Paubox includes a BAA with all accounts,” HITRUST certification and free setup, all as its own claims. The BAA page links the agreement as a download.
The product works as a layer on Google Workspace or Microsoft Outlook: Paubox says every outbound email is encrypted automatically and recipients need no portal or password. We didn’t start the trial, so the setup and the admin screens are not something we saw. This is not legal advice.
Where it falls short: pricing is per block of five senders, so one sender pays the same $32. The annual price didn’t change when we toggled billing, which leaves the “Save 30%” figure unverified. Cancel and refund terms aren’t on the pricing page, and we didn’t read the help center for them.
- Results7.0
- Price & value7.0
- Checkout honesty9.5
- Data handling9.5
- Ease of use9.5
- Support7.0
Not ranked. We checked these services from their public pages and documents only, so they get no score and sit below the ranking.
Mailfence — for OpenPGP on your domain with IMAP
For teams that want OpenPGP, IMAP/SMTP and shared documents on their own domain under Belgian law, and can mix plan tiers per user.
- Checkout
- Plan
- Cancel
- Your data
- Eligibility
- Support
- Inside
Score pending: for a team that wants OpenPGP on its own domain with IMAP and SMTP, and can mix cheaper and pricier seats. Our facts are from Mailfence’s knowledge base and blog, because mailfence.com refused our connection on 10/09/2026.
Mailfence’s blog post on secure business email hosting (10/21/2025) prices its own tiers at €2.50 per user a month for Entry, €7.50 for Pro and €25 for Ultra, and describes mixing plans so that an admin on Pro can manage users on Entry; its worked example puts one Pro admin plus ten Base users at €414 a year. The same post also quotes Entry at €3.50 a month, so the live pricing page is the place to confirm. The knowledge base confirms custom domain addresses on paid plans, explains that a domain and a subdomain count as two domains, and documents SMTP sending limits by plan.
What a team gets, by Mailfence’s own pages: OpenPGP encryption and signatures in webmail, password-encrypted mail to outsiders, aliases, IMAP and POP, calendar, contacts and documents, under Belgian law and GDPR. Nothing is end to end unless PGP is used. We found no HIPAA or BAA page on mailfence.com in a site search on 10/09/2026; this is not legal advice.
Where it falls short: the pricing page, terms, sign-up and cancel path were not reachable from our network (mailfence.com didn’t respond on 10/09/2026), so prices here are from a blog post a year old and in euros. No BAA page was found.
- Results—
- Price & value—
- Checkout honesty—
- Data handling—
- Ease of use—
- Support—
Virtru — for encrypting Gmail or Outlook you already have
For companies on Google Workspace or Microsoft 365 that want end-to-end encrypted email and attachments without changing providers, and need a BAA.
- Checkout
- Plan
- Cancel
- Your data
- Eligibility
- Support
- Inside
Paid from $1,428/yr · verified 10/09/2026
Score pending: for a company that keeps Gmail or Microsoft 365 and adds end-to-end encryption on top, from $119 a month for five users billed annually. You buy through a demo, and the BAA comes with most paid packages.
Virtru’s packages page on 10/09/2026 listed Starter at “$119/month, Includes 5 Users (billed annually),” Business at $219, Compliance at $499 and Enterprise at custom pricing, each with a “Book a Demo” button rather than a checkout. Starter covers end-to-end encrypted email and attachments for Microsoft 365 and Google Workspace, expiration dates and revocation, no accounts or passwords for recipients, and “Signed Business Associate’s Agreement (BAA) helps meet HIPAA compliance obligations.” Business adds encrypted file sharing, branding and audit data for SIEM tools; Compliance adds CMMC, ITAR and FedRAMP items and FIPS 140-3 validated encryption, by Virtru’s list.
Virtru’s support article on HIPAA says it “offers a signed BAA with most of its paid packages,” that BAAs are not available to unpaid Personal Privacy users, and that a countersigned BAA can take one to two weeks. The article describes client-side encryption in the plugin and identity through your existing Google or Microsoft login. This is not legal advice.
Where it falls short: the entry price is for five users, so a solo practice pays $1,428 a year, and there is no self-serve purchase. Virtru’s own HIPAA pages for the product returned 404 at the URLs we tried; the support article covered it. Cancel and renewal terms sit in a contract we didn’t see.
- Results—
- Price & value—
- Checkout honesty—
- Data handling—
- Ease of use—
- Support—
Hushmail — for a solo practice with a BAA at $11 a month
For therapists, dentists and other solo practitioners who want a new encrypted mailbox on their own domain, a BAA and e-signable forms.
- Checkout
- Plan
- Cancel
- Your data
- Eligibility
- Support
- Inside
14-day free trial · paid from $131.89/yr · verified 10/09/2026
Score pending: for a one-person practice that wants an encrypted mailbox on its own domain with a BAA for $131.89 a year, and secure intake forms on the next tier up.
Hushmail’s pricing page on 10/09/2026, with Healthcare selected and yearly billing, listed Basic at $11 a month, “$131.89 billed yearly” with one month free, for one user with 10 GB, encrypted email, a Business Associate Agreement, an email archive and a custom domain; Essentials at $13.75 a month, $164.89 a year, with 15 GB, three HIPAA forms, templates and scheduling; and Growth at $16.50, $197.89 a year, with 35 GB, 25 forms, e-signatures and branding. Each plan offers a 14-day trial. The page also offers a path that keeps your current email and sends secure messages and forms from it.
The comparison table marks HIPAA and the Canadian provincial health privacy laws as covered on every healthcare plan, as Hushmail’s claim. Recipients open encrypted messages through a secure web page, by its description. We didn’t start the trial, so the mailbox and the form builder weren’t seen. This is not legal advice.
Where it falls short: 10 GB on Basic is less than Proton Mail Essentials’ 15 GB per user, forms start on Essentials, and the small-business and help pages we tried returned 404, so cancel and refund terms are not captured. The pricing page gives support on Basic as email and a scheduled callback.
- Results—
- Price & value—
- Checkout honesty—
- Data handling—
- Ease of use—
- Support—
Zix (OpenText Core Email Encryption) — for policy-based encryption on request
For larger organizations that want outbound mail encrypted by data loss prevention rules and are ready to buy through a sales demo.
- Checkout
- Plan
- Cancel
- Your data
- Eligibility
- Support
- Inside
Score pending: for an organization that wants outbound email scanned and encrypted by policy and expects a sales process, not a price list. Zix is now OpenText Core Email Encryption, and the page shows no price.
OpenText closed its purchase of Zix Corporation in 2021, per its investor press release, and zix.com now redirects to a page headed “Zix is now part of OpenText Cybersecurity,” with links for existing customers to the Secure Cloud, Zix Central and Message Center logins. The product page for OpenText Core Email Encryption, read 10/09/2026, says it “scans outbound messages in real time using content filters and DLP rules” and encrypts automatically to help with HIPAA, FINRA and GLBA requirements, and offers “Request a demo” and “Book a demo” buttons. No tier, user count or price appears on it, and the old opentext.com product URLs for Zix returned 404.
Because there is no self-serve plan, this entry is here as a reference point for what an enterprise gateway costs to evaluate: a demo, a quote and a contract. We found no public BAA text for the product on the pages we read. This is not legal advice.
Where it falls short: no published price, no trial, no plan page, and the product name has changed, so older reviews under the Zix name may describe something different. Everything here is from OpenText’s own pages; nothing was tested.
- Results—
- Price & value—
- Checkout honesty—
- Data handling—
- Ease of use—
- Support—
What we don’t recommend (and why)
No business email product is on our list of what we don’t recommend yet. What I’d avoid:
- “HIPAA compliant” on a pricing card with no BAA behind it. A BAA is the contract; the badge is marketing. Paubox and Hushmail put the BAA on the plan card, Virtru and Proton describe how to get one, and the rest don’t say.
- Buying a five-seat block for one person. Virtru’s Starter and Paubox’s Standard price five users or senders at once. A solo practitioner pays the same as a team of five.
- A euro price you convert yourself. Tuta and Mailfence show euros to our connection, and Tuta says the final amount can vary with fees and exchange rates. Check the checkout in dollars before you budget.
- A reseller’s price for a product that has none. OpenText publishes no price for Core Email Encryption; any figure you see elsewhere is a quote, not a list price.
How to choose: buying guide
Do you keep your current mail system?
If your business runs on Google Workspace or Microsoft 365 and you want to stay there, Virtru and Paubox add encryption as a layer, and OpenText’s gateway encrypts by policy. If you want mail hosted by a company whose business is encryption, Proton, Tuta, Mailfence and Hushmail host the mailbox on your domain. Moving mailboxes is the bigger project; adding a layer is the bigger per-user bill at Virtru.
Do you need a BAA?
If you handle protected health information, yes, and the vendor has to sign it. On 10/09/2026, Paubox said a BAA comes with all accounts, Hushmail listed it on every healthcare plan, Virtru offered a signed BAA on most paid packages with one to two weeks to countersign, and Proton asked for an email with the subject “HIPAA BAA.” No BAA page was found at Tuta or Mailfence. Google and Microsoft have their own BAAs for Workspace and 365, which Virtru’s blog discusses. This is not legal advice.
What happens when a customer gets your encrypted email?
Hosted services encrypt automatically to users of the same service and send outsiders a password-protected link (Proton, Tuta, Mailfence). The add-ons promise no password for recipients: Virtru verifies identity through the recipient’s Google or Microsoft login, Paubox says mail arrives like normal mail, Hushmail opens on a secure web page. Decide how much friction your customers will tolerate before you choose.
Per user or per block?
Proton, Tuta, Mailfence and Hushmail price per user. Virtru and Paubox start at five users or senders. For two or three people, the per-user services cost less; at five, Paubox’s $32 a month is $6.40 a sender, under Proton Mail Essentials’ $6.99.
What about the free tools you already have?
Gmail’s client-side encryption needs Enterprise Plus, and end-to-end mail to any address needs an add-on priced through sales, by Google’s pages. Our Gmail encryption page and Outlook page go through what each does without a third-party product. For personal use, our secure email providers page compares the consumer plans of Proton, Tuta and Mailfence.
What we checked
- Proton for Business: plans page in USD (Workspace and Mail tabs), business mail page, BAA page (last modified 07/17/2026), healthcare page and HIPAA blog post, data processing agreement — read 10/09/2026; consumer free account and Mail Plus checkout from our run the same day
- Tuta: business pricing page (EUR), encryption and security pages, terms; a site search for HIPAA and business associate returned no page — 10/09/2026, no account
- Mailfence: mailfence.com returned no response on 10/09/2026; knowledge base (custom domains, aliases, sending limits, downgrade) and blog posts of 10/21/2025, 09/15/2025 and 08/17/2025 read; a site search for HIPAA found no vendor page — third-party by our rules
- Virtru: packages and pricing page, support article on HIPAA compliance and BAAs; two product HIPAA URLs returned 404 — 10/09/2026, no demo
- Paubox: Email Suite pricing with both billing toggles, product page, BAA page, HIPAA guide — 10/09/2026, no trial
- Hushmail: pricing page with Healthcare selected and yearly billing, healthcare plan page; small-business and help URLs returned 404 — 10/09/2026, no trial
- Zix / OpenText: Core Email Encryption product page, the Zix legacy page, OpenText’s 2021 acquisition press release via search; three old opentext.com product URLs returned 404 — 10/09/2026
- No card entered, no trial started, no BAA requested; cancel paths from help pages and terms, not tested. This is not legal advice
- Where the run stopped: before any purchase. Proton: business plan pages, BAA page and healthcare page; consumer account from the same day. Tuta: business page and terms. Mailfence: knowledge base and blog (site unreachable). Virtru, Paubox, Hushmail, OpenText: pricing and HIPAA pages, no trial started, no demo requested.
FAQ
What is the best encrypted email solution for a small business?
It depends on whether you keep your current mail system. If you stay on Google Workspace or Microsoft 365, Virtru (from $119 a month for 5 users) and Paubox (from $32 a month for up to 5 senders) add encryption on top, by their pricing pages on 10/09/2026. If you want a new encrypted mailbox on your domain, Proton Mail Essentials was $83.88 per user a year and Tuta Essential €6 per user a month. None of this is legal advice.
Which secure email providers offer a HIPAA BAA?
By their own pages on 10/09/2026: Paubox says a BAA comes with all accounts; Hushmail lists a BAA on every healthcare plan from $11 a month; Virtru offers a signed BAA with most paid packages; Proton offers a signed BAA on request by email. We found no BAA page at Tuta or Mailfence, and OpenText’s product page doesn’t mention one. A BAA is a contract, so read the one you’re offered. This is not legal advice.
Is secure email hosting the same as a secure email gateway?
No. Hosting means the provider runs your mailboxes (Proton, Tuta, Mailfence, Hushmail). A gateway or add-on sits in front of the mail system you already have and encrypts or filters messages (Virtru, Paubox, OpenText Core Email Encryption). The first group changes where your mail lives; the second group doesn’t.
How much does encrypted business email cost per user?
On 10/09/2026, the published per-user prices were Proton Mail Essentials $6.99 a month billed as $83.88 a year, Workspace Standard $12.99 a month, Tuta Essential €6 a month, Mailfence Pro €7.50 a month per its blog, and Hushmail Healthcare Basic $11 a month billed $131.89 a year. Virtru and Paubox price in blocks of five users or senders, $119 and $32 a month. OpenText publishes no price.
Does encrypted email mean my customers need an account?
Usually not, but they may need a password or a web page. Proton, Tuta and Mailfence send outsiders a link to a page that asks for a password you shared. Virtru says recipients need no usernames or passwords; Paubox says no portals or passwords; Hushmail opens messages on a secure web page. Mail to another user of the same service is encrypted without any of that.
Can I use my own domain?
Yes on every hosted service here: Proton Mail Essentials includes 3 custom domains and Workspace Standard 15; Tuta Essential 3 and Unlimited unlimited; Mailfence on paid plans per its knowledge base; Hushmail on every plan. Virtru, Paubox and OpenText work on the domain your existing mail system already uses.
What about Gmail or Outlook’s built-in encryption?
Google lists client-side encryption only on Workspace Enterprise Plus and a few education and frontline editions, with end-to-end mail to anyone needing the Assured Controls add-on, by its help pages. Microsoft 365 has its own message encryption on business plans. Our Gmail and Outlook pages go through both without a third-party tool.