The 3% Email Failure That Explains Echoworx's Quiet Enterprise Bet

A sensitive email leaves an insurance company. The employee has done everything right: the address is correct, the message is marked, the corporate gateway hands it to TLS. Then the recipient's system cannot complete the secure connection. In a public Echoworx customer account, that edge case affected 3 percent of deliveries. Three percent sounds tidy in a slide deck. Across millions of messages, it is a hole large enough to drive a compliance team through.

The repair was not another training session or a stern banner above the Send button. The company routed failed TLS deliveries automatically to a branded secure portal. Employees kept emailing. Recipients got a different safe path. The system dealt with reality.

That little failure explains the business Echoworx has been building since 2000. The Toronto company sells a managed encryption layer for enterprises that cannot control every inbox, certificate, country, device or human on the other end of a message. It does not ask a bank to abandon Microsoft 365, a hospital to replace Gmail, or a security team to throw out its gateway and data-loss-prevention rules. It inserts policy into the outbound journey and picks the delivery method that fits.

The product is the route

Think of Echoworx as air-traffic control after Send. Mail flows from an existing stack - Microsoft 365, Google Workspace, a secure email gateway or a DLP system - into a policy engine. Rules can inspect the sender, recipient domain, classification and content. The platform then sends through verified TLS, a web portal, an encrypted PDF, an encrypted Office or ZIP attachment, PGP or S/MIME. If the preferred runway is closed, policy can direct the message elsewhere.

The sender can be invisible to all this. An administrator can enforce policy, a subject-line keyword can trigger a rule, or optional Outlook and Gmail controls can expose an Encrypt button. The recipient might sign in with corporate SSO, OAuth, a passkey, a biometric, a verification code or a sender-provided secret. Low-risk use cases can use a tracked link without authentication. This is less a single lock than a locksmith's bench, packaged behind a fairly ordinary email.

Who buys the machinery

Echoworx is aimed at regulated, high-volume organizations: banks, insurers, healthcare networks, governments, telecom providers and companies moving personal or financial data beyond their own walls. Customer names are frequently withheld, which is unsurprising for a security vendor. The operating details are more useful anyway.

One top-50 global bank needed to encrypt more than 1.6 million statements every month across languages and business units. Another public customer account says a financial institution now processes more than 9 million encrypted messages monthly. Echoworx also says it migrated 5 million users to the cloud for a global financial group and delivers more than 100 million encrypted communications a year for a major international bank. These are company-reported figures, not audited market statistics, but they show the shape of the buyer: scale, regulation and awkward diversity.

Healthcare arrives through a different door. A 2021 purchasing agreement with Premier made Echoworx services available on negotiated terms to a network that included more than 4,100 American hospitals and roughly 200,000 other providers and organizations. In clinical work, the recipient may be a patient or caregiver outside the institution's identity system. A secure portal that speaks the right language and carries the provider's branding can matter as much as the cipher.

“Security should enable business, not obstruct it.”Echoworx's stated company commitment

What changed its mind

Echoworx grew up around public-key infrastructure, certificate authorities and hosted secure mail. Early distribution included white-label relationships: AT&T offered Echoworx-powered encryption in 2005, and British Telecom launched PKI-based secure-mail services in 2007. The company originally focused on small businesses before moving upmarket. That shift makes sense. Multiple languages, residency choices, dedicated tenants, audit streams and certificate fleets are enterprise problems with enterprise budgets.

The bigger strategic turn came in 2016. Echoworx announced that its platform would move onto AWS, beginning with Dublin. CEO Michael Ginsberg described the old constraint plainly: physical resources and infrastructure maintenance limited the company. Cloud deployment promised elastic capacity and easier geographic expansion at a moment when customers cared intensely about where data lived.

Today Echoworx describes the service as fully managed and deployed on AWS. Customers can choose multi-tenant, dedicated or region-specific arrangements. The stack can feed administrative and message events into SIEM systems in near real time. It uses AWS KMS and validated hardware security modules for key protection, and its Manage Your Own Keys feature lets a customer rotate or revoke keys under its own governance.

The cost nobody publishes

There is no public Echoworx price card. Buyers request a quote, buy through partners or, since February 2026, procure through AWS Marketplace. Current product material says all delivery methods come in one integrated license rather than as modular add-ons. That is useful, but it is not a total-cost figure.

The bill has at least two columns. One is the subscription and implementation: volume, tenancy, regions, onboarding, migration and support. The other is the machinery a customer can retire or avoid - appliances, PGP servers, certificate spreadsheets, manual renewals, delivery failures and specialist staff time. Echoworx's case studies claim lower ownership cost, but they do not publish enough contract detail to calculate a universal return. Any serious buyer should model both columns against its own message mix.

The managed-service part deserves attention. Echoworx assigns a technical engagement manager during onboarding, maps mail routes and integrations, provisions the environment, tests customer policies and branding, then runs acceptance testing before launch. Training and support follow. This is not swipe-a-card software for a two-person startup. It is closer to hiring a small specialist operation and receiving software as the interface. That helps explain the reported 98 percent retention: once routing, keys, portals, brands and compliance evidence are woven into daily communication, the relationship is operational as well as contractual.

The certificate factory

The newest layer is about making old cryptographic standards operationally tolerable. S/MIME can authenticate a sender and encrypt directly to a recipient, but large organizations must issue, find, renew and revoke certificates across thousands of people. One expired credential can stop a critical workflow. One wrong public key can create a more memorable afternoon.

Echoworx has integrated certificate issuance with DigiCert and SwissSign, automating trusted S/MIME credentials and renewals. In June 2026 it added AWS Private CA support, giving regulated enterprises another way to keep certificate authority operations under their AWS control. PGP receives similar treatment: keys can be found through directories, imported during migration or generated when required. The product advantage is not inventing new cryptography. It is industrializing the chores around proven cryptography.

Where Echoworx sits

The alternatives range from encryption already bundled into Microsoft and Google environments to broad email-security suites from Proofpoint, Mimecast and Cisco, specialist products such as Virtru and Zivver, and customer-run gateway or appliance stacks. Echoworx's pitch is breadth without replacement: keep the surrounding stack, then add delivery choice, branding, certificate automation and managed operations.

That position is also a dependency. Echoworx sits in a chain containing customer gateways, identity providers, certificate authorities, cloud infrastructure and recipient systems. Its own customer notice says third-party integrations can contribute downtime or delays outside Echoworx's responsibility. Interoperability is the selling point and the surface area.

The enduring idea is refreshingly modest: encryption does not win because it is mathematically impressive. It wins when the message arrives, the right person can open it, the wrong person cannot, and nobody has to phone the help desk. Echoworx has spent a quarter-century turning that mundane outcome into enterprise software. The 3 percent gap is not a footnote. It is the whole job.