How to Send a Secure Email in Gmail for Business

01Start with the protection your company needs

Several Gmail features get called “secure,” and they don’t do the same job. Confidential mode limits what a recipient can do with a message. Encryption is a separate set of features, and the stronger kinds depend on your Workspace edition. Google’s April 2025 announcement about end-to-end encryption is news, not a guide to what your account has.

So the first question isn’t which button to press. It’s what your company requires:

Sending a harmless test message before the real one is our recommendation, so you can see whether the recipient can open it. A test that opens isn’t proof the change order is protected.

02How to use Gmail’s confidential mode

According to Google’s computer help page, confidential mode can limit forwarding, copying, printing and downloading, and lets you set an expiration or remove access later. The steps on a computer:

1. Open Gmail and click Compose.
2. Click Toggle confidential mode.
3. Set the expiration from the menu.
4. Choose No SMS passcode or SMS passcode.
5. Click Save, then send.

Google’s admin page on confidential mode adds that these messages can’t be scheduled. The Admin console settings on that page are for your admin, not for whoever is sending.

These steps are for Gmail on a computer. Only use confidential mode if the button is there and it matches what your company requires.

What it does do: Gmail removes the message body and attachments from the recipient’s copy and replaces them with a link. Confidential mode is available in all Google Workspace editions, and an admin can turn it off.

Expiration, Remove access and the copies that survive

To cut off access early, open Gmail, click Sent, open the message and click Remove access.

That doesn’t make the message disappear everywhere. Google’s computer help page says recipients can still take a photo of the message, and that malicious programs may still copy or download it. The admin page says third-party apps may still copy it. To wipe every copy, the message would have to be deleted from your account and from the recipients’ accounts. So if the project manager already took a picture of the change order, Remove access won’t erase that photo, a screenshot or a file they already copied.

There’s an admin side too. According to the admin page, Google Vault (Google’s tool for keeping and searching company email) can hold, retain, search and export confidential messages sent by people in your domain, but it can’t read confidential messages sent into your domain by someone outside. Google doesn’t describe Remove access as deleting the Vault copy.

SMS passcodes and recipients who don’t use Gmail

The passcode choice decides how the recipient gets in:

• No SMS passcode. A Gmail user opens the message in Gmail. Someone who doesn’t use Gmail gets an email with a passcode.
• SMS passcode. The code goes by text to the recipient’s phone, so enter their number, not yours. Google lists these regions for SMS passcodes: North America, South America, Europe, Australia, and in Asia only India, Korea and Japan.

In another email app, the recipient clicks View the email, then Send passcode, and gets the code by text or email. The expiration and passcode settings control access to the message text and attachments, so think of the passcode as an access check, not encryption.

So if your project manager doesn’t use Gmail, the passcode setting decides how they open the message. It doesn’t meet an encryption requirement.

03TLS, hosted S/MIME, client-side encryption and Gmail E2EE are separate

Keep the names apart. Google’s encryption page compares transport encryption to a mail carrier and end-to-end encryption to a locked briefcase:

• TLS (standard encryption). The carrier. TLS (Transport Layer Security) is automatic for all Gmail accounts and shows a gray lock.
• Hosted S/MIME (enhanced encryption). Shows a green lock. It encrypts messages using certificates your admin sets up (see Google’s hosted S/MIME page). S/MIME stands for Secure/Multipurpose Internet Mail Extensions.
• Client-side encryption, or CSE (additional encryption). Shows a blue shield. Your organization holds the only copy of the key through an outside key service, so the encryption page says not even Google can open that briefcase.
• Gmail end-to-end encryption (E2EE). The name Google’s Assured Controls page uses for encryption that works with guest accounts. Google’s April 2025 blog post says it’s powered by CSE.

Confidential mode is none of these. It’s the access control described above.

Don’t go by a lock icon alone, because it isn’t proof of which control is in use. Check Message security while you’re writing the email. A red open lock means don’t send sensitive information.

What client-side encryption covers

When CSE is on, the message body, inline images and attachments get additional encryption in the browser before they’re stored. The subject line, timestamps and recipient list don’t. Confidential mode isn’t available while additional encryption is on, and attachments and inline images in that mode are limited to 5 MB. Gmail’s ordinary 25 MB sending limit, listed in Google’s Gmail feature comparison by edition, is a separate figure, not the CSE limit.

If Message security doesn’t show the control your company asked for, stop. Setting up CSE, from the key service to the identity provider, is admin work.

04Ask the admin; don’t guess your edition

Google names specific editions for each kind of protection. Here’s what its pages say as of October 2026:

The hosted S/MIME list comes from Google’s hosted S/MIME page. The client-side encryption list appears on both the CSE help page and the setup overview, and an admin has to turn CSE on. Gmail E2EE is on the Assured Controls page.

Google’s pages differ on whether that kind of mail is still in beta, so check with your admin before counting on it.

Business Starter, Business Standard and Business Plus aren’t named on any of those lists, and Google’s edition comparison has no S/MIME row and no client-side encryption row in its Business security table. Your admin can confirm what your edition actually has.

The April 2025 blog post announced a phased beta. It isn’t evidence that every Workspace account can send that kind of mail as of October 2026. If you can’t find client-side encryption, contact your admin. Whoever is sending doesn’t turn on CSE, upload certificates or buy Assured Controls.

05If the control you need is missing, stop

If your company needs encryption and your account doesn’t show it, stop and ask the admin. Don’t send the sensitive file in ordinary Gmail, and don’t use confidential mode as a substitute. A red open lock is the same stop. Ask the admin about access to the attachment too, and whether there’s an approved way to share the file securely.

From the sender’s seat, you can’t tell a license limit from an admin policy or from being signed in to the wrong Google account. That’s for the admin to work out.

If the harmless test fails, or the control you need isn’t there, don’t send the change order. And no setting recalls a screenshot.

Protecting one message is a small part of keeping business email safe. Our guide to email security best practices covers the everyday habits. If you’d like an outside administrator to look at your work mailbox alongside your admin, see our business email support for contractors.