KnoxDefender
Sign inStart free trial

How it works

Every email takes the same trail

Checked before it reaches the inbox, copied outside Microsoft and Google, and recoverable with an approval trail. Here is what happens at each stop, and who sees what.

The message trail

Every email takes the same trail.
Most tools only watch one stop.

01

Inspect before delivery

Lookalike senders, payment-change requests, risky links and infected attachments are scored with reasons you can read, then delivered, tagged or held. Each person sees their own held mail.

02

Keep an independent copy

Daily encrypted backups of Exchange Online and Gmail, stored outside Microsoft and Google in immutable storage, with a key per organization.

03

Recover through approval

Staff request specific messages from a point in time. A different administrator approves, and they land in a new "Recovered" folder. Nothing is overwritten.

04

Prove it

Monthly test restores decide whether a mailbox counts as protected, and every search, release and restore is written to a tamper-evident audit trail.

Who sees what

The right view for each person

Access is enforced on the server for every request. Staff request restores; your administrators decide.

Company Admin

  • Chooses mailboxes, policies and retention
  • Releases or deletes held mail, manages allow and block lists
  • Approves or rejects restore requests (not their own)
  • Places legal holds and runs exports, all logged

Auditor

  • Read-only view of protection status, reports and the audit trail
  • Cannot open message content or change settings
  • Useful for boards, finance committees and insurers' questions

End User

  • Sees only their own mailbox's protection status
  • Reviews their own held mail and asks for release
  • Requests a restore; an administrator approves it
  • Reports phishing and completes short lessons

KnoxDefender staff run the platform but cannot open your mail by default. Support access needs a recorded reason, a fresh two-step check, expires, and appears in your audit log.

Small businesses and nonprofits

The days KnoxDefender is built for

Typical situations, described in general terms. Not customer stories.

Invoice fraud

A supplier's “new bank details” arrive

The message comes from a lookalike domain. The gateway holds it with the reasons listed, and finance never sees it in the inbox.

Deleted email

A grant folder is emptied by mistake

A program manager requests the messages from last week's restore point. The director approves, and they appear in a “Recovered” folder.

Compromised mailbox

An account starts forwarding mail outside

A new rule sends everything to a personal address. You get an alert with the rule, who created it and when.

Departing employee

Someone leaves, their licence is removed

Their backed-up mail stays under retention, searchable by administrators, and can be put on hold.

Preservation

A dispute needs email kept

Place a legal hold with a reason. Retention expiry stops until the hold is released, and every step is recorded.

Questions

Straight answers

Doesn't Microsoft or Google already keep deleted email?

For a while. In Exchange Online, deleted items are kept 14 days by default (an admin can raise it to 30). In Gmail, Trash is emptied after 30 days, and an admin can then restore messages for another 25 days. After that, or after an attacker or a departing employee deletes mail, getting it back depends on having your own copy. KnoxDefender keeps one, outside Microsoft and Google.

What permissions does KnoxDefender ask for?

Only what the features in your plan need, and we explain each one before your administrator approves it. Microsoft 365 uses an app your admin consents to in Microsoft Entra; Google Workspace uses a service account your super admin authorizes for specific scopes. The full list, with the reason for each permission, is in our documentation and on the consent screen.

Do I have to change my MX records?

Only for gateway filtering, which checks mail before it reaches the inbox. You point your MX record to KnoxDefender and we deliver clean mail to Microsoft 365 or Google Workspace. Backup, archiving, domain protection and training don't need any mail-flow change.

What is the difference between backup and archive?

A backup lets you put mail back after it is lost: a folder deleted by mistake, a wiped mailbox. An archive lets you find and preserve mail for a period, for example under a legal hold or after someone leaves. KnoxDefender's archive is built from backup snapshots, so it keeps what each backup saw; it is not a journal of every message ever sent.

Can staff restore their own email?

Staff can see their own mailbox backups and request a restore of specific messages. An administrator in your organization reviews exactly which messages, from which point in time, and where they will go, then approves or rejects. Restored mail lands in a new "Recovered" folder or label; nothing is overwritten.

When is a mailbox "protected"?

Only when its backup is current and a test restore from it has succeeded. A connected mailbox is not automatically protected, and a successful backup is not the same as a verified restore, so the console shows those states separately.

How long do you keep our email?

Your plan sets the retention options (for example 1, 3 or 7 years) and your administrator chooses. Legal holds keep mail past retention until they are released with a recorded reason. Ending the service never silently deletes retained email.

How does onboarding work?

We set up your organization, your administrator approves the connection for the features you chose, and you pick which mailboxes to cover. For gateway filtering we walk you through the domain check and the MX change step by step. Setup time depends on your mailboxes and DNS, so we don't promise a fixed number.

Keep exploring

Find out where your email is exposed.
Then close the gaps.

Answer a few questions and start a free trial in minutes, or grade your domain for free right now.

Start free trialFree domain check