S/MIME for Gmail // CUI and CMMC ready

Encrypted email inside Gmail, for your whole team

Qanapi Flow orders, installs and renews S/MIME certificates for every user. $10 per user per month.

Create Estimate

FIPS-validated encryption · Runs inside native Gmail · Deploys domain-wide from one console

S/MIME for Gmail, ready for CUI and CMMC

Qanapi Flow orders, verifies, and installs S/MIME certificates for every user in your domain, then keeps them current. Your team signs and encrypts mail inside Gmail, exactly where they already work.

$10 per user per month

Create Estimate

FIPS-validated encryption · Runs inside native Gmail · Client-side encryption option · Deploys domain-wide from one console

Gmail supports S/MIME.
The certificates are the hard part.

Enabling S/MIME in Google Workspace is a checkbox. The work is everything after: ordering a certificate for every user, getting each one verified, uploading it to the right mailbox, and doing it again when people join, leave, or their certificate expires. At any real headcount that becomes a standing task that quietly fails, and a failed certificate means mail that will not sign or encrypt when it matters.

Qanapi Flow takes that lifecycle off your plate.

You select users, click enable, and Qanapi handles ordering, verification, and upload to Gmail. Disabling a user removes their certificate the same way.

Create Estimate
Dive into the documentation
Read the step-by-step setup guide

How S/MIME encryption works with Qanapi Flow

  1. Enable S/MIME across your domain. Turn on S/MIME in Google Admin once. Qanapi connects through the Google Admin and Gmail APIs.
  2. Provision certificates in bulk. In the Qanapi app, select the users you want protected and click enable. Qanapi orders each certificate, walks the user through email verification, and uploads the certificate to their Gmail automatically. Status moves from Pending Order to Active with no manual handling.
  3. Send signed and encrypted mail in Gmail. Users click the lock icon in the Gmail compose window to sign or encrypt. A green lock confirms Hosted S/MIME; a blue shield confirms CSE-wrapped S/MIME. No new app, no plugin to learn.
Create Estimate

Managed S/MIME vs the alternatives

Qanapi Flow
Secure Email
Do It Yourself
S/MIME in Gmail
Other Secure Portal Email Providers
Certificate ordering
and renewal
Automated, domain-wide
Manual
N/A
Where recipients
read mail
Native Gmail
Native Gmail
External log in
Keys secure, even
from Google
Yes when paired with Qanapi CSE
No
Vendor-held
Admin effort
at scale
One console, streamlined growth, run by you
Increased effort required as headcount grows
Requests to the vendor for each increase
Standards-based S/MIME
Yes
Yes
Vendor-proprietary

S/MIME email encryption FAQ

Does Gmail support S/MIME?

Yes. Google Workspace supports S/MIME for signing and encrypting Gmail, but it is off by default and requires certificates to be provisioned and uploaded for each user. Qanapi Flow automates that provisioning across your domain.

What is hosted S/MIME?

Hosted S/MIME means a provider orders and manages your S/MIME certificates and installs them into Gmail for you, rather than each user obtaining and uploading their own. In Qanapi Flow, hosted S/MIME shows a green lock icon on protected mail.

Compare every way to encrypt email in Gmail

How do you add S/MIME encryption to Gmail?

Enable S/MIME in Google Admin, then use Qanapi Flow to select users and provision certificates in bulk. Qanapi orders each certificate, handles verification, and uploads it to Gmail automatically. Users then sign or encrypt from the lock icon in the Gmail compose window.

See the step-by-step setup guide for Gmail and Google Workspace

What is the difference between hosted S/MIME and CSE-wrapped S/MIME?

Hosted S/MIME uses certificates Qanapi manages and shows a green lock. CSE-wrapped S/MIME routes encryption through Qanapi's client-side encryption key service, so Google cannot read the keys, and shows a blue shield. Both work inside native Gmail. Hosted S/MIME comes with Flow Secure Email at $10 per user per month. CSE-wrapped managed S/MIME is the upgraded form and comes with Flow Zero Trust at $15 and Flow Federal at $25 per user per month.

Is S/MIME enough for HIPAA, CMMC, or CUI email?

S/MIME email encryption is a strong, standards-based control for protecting sensitive email, and it supports requirements under HIPAA, CMMC, and CUI handling. It is one control within a broader compliance program, not a substitute for one.

Is there a FedRAMP High option?

Yes. Qanapi Flow Federal runs inside stackArmor's Armory on Google Cloud, a FedRAMP High authorized environment, and includes CSE-wrapped managed S/MIME, the upgraded form of hosted S/MIME. It is $25 per user per month. Federal deployments are scoped with our team, so we can confirm boundary fit, impact level, and contract vehicle before you commit.

Do recipients need Qanapi to read encrypted mail?

No. S/MIME is a standard. Once both parties exchange signed email to share public certificates, encrypted replies work between standard S/MIME-capable mail clients.

Is there a free trial for S/MIME?

No. Because each S/MIME license provisions a real certificate for a user, it is an immediate purchase rather than a trial. You can start with a small number of users and add more from the same console.

How much does Qanapi Flow S/MIME cost?

S/MIME is $10 per user per month. Because each license provisions a certificate, it is billed as an immediate purchase rather than a free trial, and you can start with a small group of users.

Create Estimate

Ready to cut through

Let's reshape your security. Start with a demo or talk to our team.

Schedule a DemoContact