S/MIME Email Encryption for Google Workspace, Without the Certificate Headache

Qanapi Flow orders, verifies, and installs S/MIME certificates for every user in your domain, then keeps them current. Your team signs and encrypts mail inside Gmail, exactly where they already work.

$10 per user / month. Predictable, frictionless security where you need it most.

Buy S/MIME for your domain
Get the exact instructions for your Workspace Admin
x

FIPS-validated encryption · Runs inside native Gmail · Client-side encryption option · Deploys domain-wide from one console

Gmail supports S/MIME.
The certificates are the hard part.

Enabling S/MIME in Google Workspace is a checkbox. The work is everything after: ordering a certificate for every user, getting each one verified, uploading it to the right mailbox, and doing it again when people join, leave, or their certificate expires. At any real headcount that becomes a standing task that quietly fails, and a failed certificate means mail that will not sign or encrypt when it matters.

Qanapi Flow takes that lifecycle off your plate.

You select users, click enable, and Qanapi handles ordering, verification, and upload to Gmail. Disabling a user removes their certificate the same way.

Dive into the documentation

How S/MIME encryption works with Qanapi Flow

  1. Enable S/MIME across your domain. Turn on S/MIME in Google Admin once. Qanapi connects through the Google Admin and Gmail APIs.
  2. Provision certificates in bulk. In the Qanapi app, select the users you want protected and click enable. Qanapi orders each certificate, walks the user through email verification, and uploads the certificate to their Gmail automatically. Status moves from Pending Order to Active with no manual handling.
  3. Send signed and encrypted mail in Gmail. Users click the lock icon in the Gmail compose window to sign or encrypt. A green lock confirms Hosted S/MIME; a blue shield confirms CSE-wrapped S/MIME. No new app, no plugin to learn.
Buy S/MIME for your domain

Managed S/MIME vs the Alternatives

Qanapi Flow
Secure Email
Do It Yourself
S/MIME in Gmail
Other Secure Portal Email Providers
Certificate ordering
and renewal
Automated, domain-wide
Manual
N/A
Where recipients
read mail
Native Gmail
Native Gmail
External log in
Keys secure, even
from Google
Yes when paired with Qanapi CSE
No
Vendor-held
Admin effort
at scale
One console, streamlined growth, run by you
Increased effort required as headcount grows
Requests to the vendor for each increase
Standards-based S/MIME
Yes
Yes
Vendor-proprietary

S/MIME Email Encryption FAQ

  • Does Gmail support S/MIME?Yes. Google Workspace supports S/MIME for signing and encrypting Gmail, but it is off by default and requires certificates to be provisioned and uploaded for each user. Qanapi Flow automates that provisioning across your domain.
  • What is hosted S/MIME?Hosted S/MIME means a provider orders and manages your S/MIME certificates and installs them into Gmail for you, rather than each user obtaining and uploading their own. In Qanapi Flow, hosted S/MIME shows a green lock icon on protected mail.
  • How do you add S/MIME encryption to Gmail?Enable S/MIME in Google Admin, then use Qanapi Flow to select users and provision certificates in bulk. Qanapi orders each certificate, handles verification, and uploads it to Gmail automatically. Users then sign or encrypt from the lock icon in the Gmail compose window.
  • What is the difference between hosted S/MIME and CSE-wrapped S/MIME?Hosted S/MIME uses certificates Qanapi manages and shows a green lock. CSE-wrapped S/MIME routes encryption through Qanapi's client-side encryption key service, so Google cannot read the keys, and shows a blue shield. Both work inside native Gmail.
  • Is S/MIME enough for HIPAA, CMMC, or CUI email?S/MIME email encryption is a strong, standards-based control for protecting sensitive email, and it supports requirements under HIPAA, CMMC, and CUI handling. It is one control within a broader compliance program, not a substitute for one.
  • Do recipients need Qanapi to read encrypted mail?No. S/MIME is a standard. Once both parties exchange signed email to share public certificates, encrypted replies work between standard S/MIME-capable mail clients.
  • Is there a free trial for S/MIME?No. Because each S/MIME license provisions a real certificate for a user, it is an immediate purchase rather than a trial. You can start with a small number of users and add more from the same console.
  • How much does Qanapi Flow S/MIME cost?S/MIME is $10 per user per month. Because each license provisions a certificate, it is billed as an immediate purchase rather than a free trial, and you can start with a small group of users.
Buy S/MIME for your domain

Ready to cut through

Let's reshape your security. Start with a demo or talk to our team.

Schedule a DemoContact