You don't really have too many assurances when it comes to e-mail. Anyways most of the major 3rd party are compliant with the many privacy acts that have been instituted. Postini is EU Safe Harbor compliant and I'm pretty sure HIPAA (for their TLS services at least), etc. They also "proxy" SMTP somewhat and scan the messages in-line. The only time they would be storing e-mails is when a message gets quarantined or when their connection to your data center goes down.
One such Medical institution that requires HIPAA compliance that has signed up for Postini: http://www.postini.com/news_events/pr/pr032807.php They provide services for several law firms and financial institutions. If you've ever talked to a lawyer about attorney-client privilege then you know how hard they can be to convince. If you or your customers are truly concerned with the data being passed between each other, then you should be doing end-to-end encryption or S/MIME. This should be the case whether you're using a 3rd party for anti-spam or not. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mayo, Bill Sent: Friday, August 03, 2007 3:46 PM To: Exchange Discussions Subject: RE: Spam Appliance Suggestions What you are saying is true. However, having every single message handily delivered to someone is different than someone doing packet capture (or whatever). I am speculating to a degree, but I can hear some of our clients asking how we can be sure that everything is being delivered and nothing is being kept by the 3rd party. We also do have law enforcement and health agencies associated, and while we really stress that email is as secure as a postcard, there is always the possibility that sensitive information is being sent via email and would be alarmed at the proposition that it was going through a 3rd party. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Aaron Brasslett Sent: Friday, August 03, 2007 3:35 PM To: Exchange Discussions Subject: RE: Spam Appliance Suggestions Funny you should say "I think there would be some concerns in our organization about mail going through someone else" because that is exactly what senior management said here when we were considering Postini. I have never understood the concern... Besides, doesn't all inbound email "go through someone else"? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mayo, Bill Posted At: Friday, August 03, 2007 8:51 AM Posted To: Exchange Mailing List Conversation: Spam Appliance Suggestions Subject: Re: Spam Appliance Suggestions Thanks to John and everyone else for the great discussion. We are presently using MailEssentials, and it is not effective at all for us. The other big problem with it is that all the mail still comes into the Exchange store, which is bloated immensely as a result (like most, a very high percentage of our external mail is spam). I don't discount the notion of a hosted service offhand, but I think there would be some concerns in our organization about mail going through someone else. The appliances are attractive because it has the advantage of centralized management by the provider, but the mail is not being routed by an outside entity. Also, most of the appliances don't have a per user charge. The info on Barracuda is interesting, because that was looking like an attractive option in my research (I have been looking at info on the appliances listed at http://www.spamhelp.org/appliances/). In regards to IronPort, it appears to be available from multiple places (Secure Computing, CipherTrust, etc)...is there any difference based on from where you purchase? Also, I didn't see any pricing info available (without contacting sales). Do you know if the pricing is roughly equivalent to the Barracuda? Bill Mayo Pitt County MIS -----Original Message----- Subject: Re: Spam Appliance Suggestions From: John B <[EMAIL PROTECTED]> Date: Thu, 2 Aug 2007 05:00:52 -0700 (PDT) X-Message-Number: 2 Bill, I've been working in the message practice for over 10 years. The only product that I've found to be worth anything is Ironport C-series. It's an appliance that sits on the edge and handles all AV/SPAM filtering for you. The last company I was consulting for had a Barracuda which wasn't do a good job and people were complaining left and right about SPAM coming through. I even had two of their Sr. SE's look over our configuration to make sure we didn't do anything wrong setting it up. Everything checked out fine but the SPAM was still coming in at an alarming rate. So we dropped an Ironport into their environment and the SPAM disappeared and everyone was happy. I would highly recommend the Ironport solution because for one you don't have spend everyday you walk in babysitting the product and even if you want to get really tricky with the product you have that level of granularity that will allow you to do so. I've been running these appliances for a good while now, so if you have any questions please feel free to contact me. ________________ John Bowles ----- Original Message ---- From: "Mayo, Bill" <[EMAIL PROTECTED]> To: Exchange Discussions <[email protected]> Sent: Wednesday, August 1, 2007 4:05:08 PM Subject: Spam Appliance Suggestions We are looking to implement an anti-spam appliance. We need something that is mostly hands-off as we have limited staff. I am trying to compile a list of possible alternatives and was hoping you kind folks might be willing to share your suggestions or experiences. It's quite all right with me if you prefer to respond off list. Thanks in advance! Bill Mayo Pitt County MIS _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
