Know who's really behind every email, even a supplier's.
Safemarker checks the sender's account inside their own Microsoft 365, then puts the verdict on the email in yours. Compromised suppliers get caught before anyone replies.
- Microsoft 365
- No MX changes
- Start with one side
One email, two organisations
Your supplier's Microsoft 365
- Sent from Sarah's own mailbox
- Sign-in from a country she never works from
- New inbox rule hides replies
Only the result crosses. Logs and mailbox stay private.
Your Outlook
Re: Can you resend the signed contract?
sarah@supplier.example
Illustration. The people and companies are fictional.
Your email security can't see a supplier's compromised account.
The email is technically genuine: real servers, real address, a thread you already trust. The evidence that something is wrong sits inside the supplier's Microsoft 365, where your tools can't look.
SPF, DKIM and DMARC results
The email's headers
Visible. They pass. The email really did come from the supplier's mail system.
Content, links and attachments
The email itself
Visible. Often nothing to find: no link, no attachment, a normal reply in a real thread.
Who signed in, from where, how
The supplier's sign-in logs
Invisible. Another organisation's logs are out of reach.
New inbox rules or forwarding
The supplier's mailbox settings
Invisible. A common sign of takeover, invisible from outside.
Whether the email left their mailbox
The supplier's mailbox
Invisible. Only the sending side can observe this.
Safemarker closes the gap: the sending side checks its own account, the receiving side gets the verdict.
Evidence from the sending side. A verdict on the receiving side.
Safemarker runs inside each organisation's own Microsoft 365, so it can use what only that organisation can see.
- 01
Each organisation connects its own Microsoft 365
An admin approves Safemarker for their tenant through Microsoft's API. No MX change, no gateway, no rerouting, on either side.
- 02
Every sent email is recorded at the source
Which message, from whom, to whom and when. The subject and body are never stored.
- 03
The sending account is checked for takeover
Risky sign-ins, changed sign-in methods, suspicious inbox rules: the signs a takeover leaves behind.
- 04
The email is verified on arrival
Matched to the sender's record, the reader sees Trusted, Caution or High Risk, with the reasons.
A result crosses, not your data.
The receiving organisation gets a verdict about an email it received, never the sender's sign-in logs, mailbox contents or settings. A sender's record only counts for an email that passed DMARC and was addressed to the mailbox that received it.
What happens when only one organisation participates.
You don't need your suppliers on board to start. Each partner that joins adds sender-side evidence for the email you exchange.
Sender and recipient use Safemarker
Both organisations
The email is checked against the sender's own record and the state of the sending account.
- Trusted means the email left the sender's own mailbox, addressed to you, with no sign of takeover.
- If the supplier's account shows takeover signs, the label on your side reflects it.
- All receiving-side checks still run on every email.
You receive, the supplier has not joined
Only your organisation
No view inside the supplier's Microsoft 365, so no sender-side record to check against.
- Every incoming email is still assessed from your side: authentication, lookalikes, history, links, QR codes, invites.
- That supplier's email is never marked Trusted on origin alone. It gets a neutral label, or Caution or High Risk when something is off.
- Email between your own colleagues is verified against your own sending record.
The supplier uses Safemarker, you do not
Only the other organisation
Your mailboxes are not connected, so no label appears in your Outlook.
- The supplier is protected at the source: takeover signs in their accounts reach their security team.
- You get no verdict on the email you receive from them.
- Once you connect as well, their email can be verified against their sending record.
What is cross-organisational email identity verification?
Each organisation connects its own Microsoft 365. When someone sends an email, Safemarker records it at the source and checks the sending account for takeover signs. When that email arrives at another participating organisation, it's matched to the sender's record and labelled Trusted, Caution or High Risk.
Why don't SPF, DKIM and DMARC detect a compromised supplier account?
They confirm which servers may send for a domain, and a compromised account sends from the real servers. They say nothing about who is using the account.
Do my suppliers have to use Safemarker?
No. You can start alone: every incoming email is still assessed from your side, and email between your own colleagues is verified against your own sending record. Each supplier that joins adds sender-side evidence.
What does the other organisation learn about us?
A verdict about a specific email, never your sign-in logs, mailbox contents or settings. A record only counts for an email that passed DMARC for your domain and was addressed to the mailbox that received it.
Does this replace our existing email security?
No. Safemarker runs alongside it. Your filters keep checking content, links and attachments; Safemarker adds the one thing they can't see: the state of the sender's account.
Which email platforms are supported?
Microsoft 365, on both sides. There's no MX change, gateway or rerouting involved.
Put a clear verdict on every email.
Start with a pilot group and see verdicts the same day. Turn it off any time — your mail keeps working as before.
Same-day replyEvery working day
On your own tenantAgainst real traffic
European UnionEU company, hosting and law