One of the World's Largest Banks Scales Encrypted Email to 300,000 Users with Virtru

The Result

• Cut encryption-related support tickets by approximately 90%, while protecting roughly 150,000 emails per day (more than 2 million in the first weeks after go-live).

• Removed decisions from users on both sides of the exchange. Bank employees choose only whether to encrypt; every policy applies automatically. External recipients confirm their identity and read the message in a browser, with no account to create and no software to install.

• Established central policy enforcement and audit visibility across email and line-of-business applications, including automatic expiration, disabled forwarding, and revocation — with a record of who accessed what, and when.

One of the world's largest banks handles some of the most sensitive data any organization exchanges: mortgage applications, tax returns, passports, pay stubs, wealth transfers, and retirement account records. Nearly all of it moves through email, sent by bank employees to customers, partners, and regulators who sit entirely outside the bank's control.

The bank had encryption in place. What it didn't have was a good recipient experience its customers — and that was beginning to cost the financial institution valuable relationships. After a rigorous assessment of the market, the bank selected Virtru and deployed the Virtru Data Protection Gateway across 400 applications, 300,000 users worldwide, and three data centers.

"Our Current Solution Is Terrible."

The project began not with a compliance gap or a data breach, but with customer complaints about the encrypted email experience.

"The impetus for this particular organization working with us started from 'Our external customer's experience with our current solution is terrible,'" said Dana Morris, SVP of Engineering at Virtru, in an episode of the Hash It Out podcast. "I mean, those were their words. Their surveys from their customers, their reviews on app stores and other things — the technology that those customers were interacting with was universally poor."

That feedback eventually escalated into a business risk the bank could not ignore. According to Morris, the tipping point came when several very large, high-net-worth clients told the bank directly that they were leaving. "They basically gave feedback and said they were going to move on from that bank to another bank because they hated the experience."

The bank's prior tool was not failing at encryption. Employees could protect a message easily enough, and compliance requirements were being met. The breakdown was on the receiving end, where recipients who had never asked to install anything were expected to navigate a portal to read a document about their own mortgage.

"Anyone can encrypt information," said Matt Howard, SVP and Chief Marketing Officer at Virtru. "It's making it really elegant and really simple for someone to receive encrypted information and to decrypt it without any hassle. That's part of the ultimate value we're bringing to the table for this organization."

Compliance Requirements Meet User Experience

Once the bank had addressed the external experience with Virtru, it turned inward, to the 300,000 employees who would be sending protected messages every day.

That balance drove three to four months of planning before any production change, and it shaped how the policies were written. "That was kind of the crux of their focus," Morris said, "just planning in terms of, 'How can we make the policies simple enough and scalable enough to really protect the bank, but do it in a way that the users really don't have to do much at all, and really kind of do that centrally?'"

The resulting policy set is deliberately uncomplicated. Rather than building elaborate conditional logic, the bank applied consistent controls to everything leaving the organization: a defined expiration period after which recipients can no longer access the content, and disabled forwarding so a thread stays between two parties instead of proliferating into inboxes the bank never authorized. Revocation is available when something needs to be pulled back.

For the employee, the decision is binary. "If they want to trigger the encryption, all they're really deciding is an 'on' or 'off'," Morris explained. "And then the policies take hold at that point. And then externally the same kind of thing — here are the policies we've defined for our interactions with our customers, and we're not really going to ask the customer to make any decision either, other than to just reply back."

Because messages route centrally through the server-side Gateway, the bank gained something its previous edge-deployed tool could not offer: visibility. "It gives them a lot of control centrally," said Morris. "And then also they can audit — they know what's happening with the data, who's accessing it, how successful that process is."

More Than Just Email: Customer Trust

The bank's deployment covers email, but it's also about so much more: Brand consistency, productivity, and risk management.

"I've never liked the idea of just calling it email encryption, sort of calling out email and just focusing on the type," he said. "It would be like calling Salesforce a database. Yes, it is a database. But the data that they're writing there is incredibly valuable. It's data about your customers."

He points to a mortgage application as the clearer way to think about it. "I don't really care if it's an email message to me. It's a mortgage application, supporting documentation, it's my passport, my pay stubs, my tax returns. If that data falls into the wrong hands, basically somebody can steal my identity."

That distinction matters for where the Gateway was applied. Across the bank's 400 applications, the majority of use cases involve its highest-value data. Email simply happens to be the exchange format — and because email relies on established standards, Virtru can apply encryption and policy control without interrupting the normal flow for senders or recipients.

The Proof is in the Support Queue

Within weeks of going live, the bank was averaging roughly 150,000 protected emails per day, and had passed 2 million protected messages in total. Across all of it, ticket volume to Virtru's help desk came to approximately 1,000 — a support-contact rate of about 0.05%, or one ticket for every 2,000 protected messages.

"The ticket volume is incredibly low, considering how much data we are protecting," Morris said, "and across so many different organizations and humans."

The scale of that recipient population is part of why the number is meaningful. As Howard put it: "A bank is probably sending encrypted email to people that are teenagers that have their first credit card account, possibly all the way up to advanced senior citizens who are 80-plus and dealing with retirement accounts. The massive breadth there of people and devices is pretty staggering."

The tickets that did come in were the kind any deployment sees at scale: Unusual browser and caching behavior on older systems, but nothing structural.

400 Applications, No Disruptions

For a migration of this size, the encryption layer was not the risk. The networking was.

"The bigger risk for the rollout on the customer side was simply a lot of the networking changes that happen when you go live and you switch email traffic and routing from one place to another," Morris said. "That's always just inherently risky."

That transition went through without a hitch, and the policy configuration presented no real challenges. The work that did surface came from an unglamorous place: years of custom line-of-business applications that had been formatting email slightly incorrectly and getting away with it. Because Virtru's Gateway adheres strictly to the relevant standards, those applications were suddenly held to spec.

"Maybe there was some app that wrote an email incorrectly and was getting away with it," Morris said. "And now that they've switched to the Virtru system and it's following the standard strictly, perhaps they're finding that the app has a little bit of an interruption."

The bank's teams worked through them quickly. "In most cases, you're talking about them seeing an issue, correcting it within 24 hours, and very little interruption to their workflow, to the business unit, or to the customer."

For an organization protecting its highest-value customer data at this volume, the outcome is a security posture that got stricter while the experience got simpler — for the 300,000 people inside the bank, and for the millions of customers outside it who never had to think about encryption at all.

Ready to see what this looks like for your organization? Book a demo to see how the Virtru Data Protection Gateway applies automated encryption and policy controls across email and your line-of-business applications.