ZTmail Cryptographic Application Automation Gateway (Abbreviated as ZTmail Gateway) is an enterprise cryptographic gateway designed to automate email security, chat security and document security on an organizational scale. It handles the cryptographic functions that conventional email security gateways, instant messaging gateway, document management system are not designed to provide, while working together with existing email security systems and business systems related to document management to enhance cryptographic protection capabilities.
Core capabilities:
ZTmail Gateway handles cryptography. Existing infrastructure handles email security and document management.
ZTmail Gateway is offered in two deployment editions. Both use the same core cryptographic gateway architecture, but are optimized for different organization sizes and deployment economics.
One Gateway. One Automated Certificate Strategy. Three Trust Models: ZTmail Trust (ZT), Global Trust (GT) and Hybrid Trust (HT).
A dedicated organizational Sub CA certificate is built into the Hardware Gateway. The Sub CA operates under the organization's configured ZTmail Trust Root hierarchy and is protected by the Gateway's built-in PCIe HSM card.
The built-in CA can automatically issue and manage ZTmail-trusted S/MIME certificates and document certificates for employees and mailboxes at organizational scale without certificate type and quantity limit. The organization does not need to purchase a separate certificate for every employee simply to establish trust inside the ZTmail trust domain.
When a mailbox must present an S/MIME certificate global-trusted by external S/MIME clients outside that trust domain, a Public CA certificate can be supplied automatically through the configured certificate-supply service. When a document must present a document certificate trusted by external Document reader like Adobe Reader outside that trust domain, a Public CA certificate can be supplied automatically through the configured certificate-supply service, or using ZTmail cloud e-signing service for global trust.
Users can also choose Hybrid Trust. For email communication, a global-trusted MV S/MIME certificates and a ZTmail-trusted OV/SV S/MIME certificates can be auto-configured, allowing Outlook and other email clients to trust it while ZTmail App displays OV/SV validated identity. For document signing, a global-trusted cloud signing service and a ZTmail-trusted OV/SV document certificates, enabling global trust in Adobe and displaying OV/SV validated identity in ZTmail App. Hybrid trust combines ZTmail ecosystem identity display with global ecosystem trust, without requiring all certificates to be globally trusted, which helps reduce certificate costs.
Use ZTmail Trust at organizational scale. Use Global Trust or Hybrid Trust where it matters.
For organizations that require a self-contained cryptographic gateway with an integrated enterprise CA, the Hardware Gateway integrates all the functional modules needed for various services, such as email IMAP/SMTP proxy, document signing, document encryption, timestamp signing, key management etc., built-in CA services, ZTmail trusted organizational Sub CA certificate, dedicated hardware cryptographic protection (PCIe HSM card), security strategy module and autonomous AI access module.
The built-in CA can automatically issue ZTmail-trusted S/MIME certificates and document certificates for the organization's mailboxes and manage their lifecycle without per-mailbox & per-certificate limit. This changes the economics for large organizations: the investment is the cryptographic gateway infrastructure rather than an annual fee for every mailbox.
The Gateway deployments are designed around high availability, default using a redundant Gateway pair with load balancing and automatic failover. The organizational Sub CA private key is protected by Gateway’s integrated PCIe HSM card.
Key commercial principle: ZTmail-trusted enterprise S/MIME certificates and document certificates only set a limit based on hardware capacity, without charging certificate fees based on the actual number of email accounts. Document signing and encryption also don’t charge based on the number of signing or encrypting events.
Models are differentiated by throughput, concurrent connections, cryptographic performance, storage, and supported mailbox scale, the typical deployment is a redundant HA pair. The certificate trust domains (ZT or GT) composition can be customized by customers.
The Software Gateway is designed for smaller organizations that need automated S/MIME encryption without the infrastructure and operational complexity of a dedicated hardware appliance. It provides the same core cryptographic gateway functions while automatically supplying ZTmail trust and global trust certificates, but these certificates are automatically obtained from ZTmail Cloud Cryptography Service through the gateway system, rather than being locally issued like with a hardware gateway.
Gateway Models are differentiated by supported mailbox volume. The certificate type mix and trust domain allocation shown below are typical configurations provided as a reference for customers. Certificate types and trust domain allocation can be customized according to the customer's requirements.
For organizations with over 1,000 mailboxes can negotiate bulk custom pricing, but strongly recommend using a hardware gateway, as there are no longer any certificate fees or mailbox number limits.
Don't let encrypted email create a security blind spot. Deploy ZTmail Gateway to decrypt and verify inbound encrypted email before security inspection, and sign and encrypt outbound email only after it has passed your existing security controls.
No more documents without a trusted identity. Deploy ZTmail Gateway that automatically applies a trusted identity digital signature to every internal and external document, automatically encrypts all internal confidential documents, and attaches a timestamp to all archived documents.
REQUEST PRICING
Tell us your organization size and deployment requirements. We will recommend the appropriate Gateway model and certificate configuration strategy.