Retarus Renews Highest-Level Certification Under Spain’s National Security Scheme (ENS)

August 25, 2026 //

Retarus has renewed its “Esquema Nacional de Seguridad” (ENS) certification at the highest security level. The ENS is a mandatory security framework for electronic public administration services and the protection of Spain's public sector IT systems. The renewal extends the certification’s validity through May 2028 and underlines Retarus’ position as a leading provider of email security in the Spanish market.

“Any provider entrusted with ensuring the security of critical communications for public sector organizations or highly regulated industries, such as financial institutions, not only needs to provide high-performance technology but also to substantiate its level of security independently and continuously. Having our ENS certification renewed in the highest category confirms that we consistently meet these requirements,” emphasizes Yeray Fraga, Head of Sales in Spain.

Top ENS category for systems requiring high levels of protection

The ENS defines the underlying principles, minimum requirements, and security measures that need to be met by public sector organizations and the private entities working with them. It also classifies information systems into three security categories – low, medium, and high – based on the impact an incident would have on the confidentiality, integrity, availability, authenticity, and traceability of the information being handled.

“The ‘high’ category is reserved for systems whose failure may cause very serious or irreparable damage to an organization’s core functions, its assets, or any citizens affected by its unavailibilty. It demands the highest levels of robustness, availability, and advanced control mechanisms. This underscores Retarus’ ongoing strategic focus on the Spanish market and its unique requirements,” adds Fraga.

Retarus first attained ENS certification in the “high” category in 2024. To maintain this security standard, the company regularly has to undergo increasingly rigorous audits and continuously demonstrate that its risk management, incident prevention and response, and service availability meet the required standards.

Data sovereignty in Europe

Data sovereignty has become one of the key technological and regulatory priorities in Europe. In addition to having a verifiable level of security, it is crucially important for government agencies and highly regulated companies to know where and on what legal basis their business-critical data is processed. To this end, Retarus continuously invests in its own high-performance infrastructure and operates its services without relying on U.S. cloud providers.

A fully European company headquartered in Munich, Germany, Retarus operates its own data centers in the EU. The company places compliance with legal requirements for data storage and processing – as well as certifications such as ENS, GDPR, and the ISAE 3000 SOC 2 Type II standard – at the heart of its strategy.

“Especially when it comes to the public sector, security and digital sovereignty need to go hand in hand. With our ENS certification and our own infrastructure in Europe, we at Retarus offer our customers the trust and long-term security they need to digitalize their critical communication processes securely, independently and in compliance with applicable regulations,” Fraga concludes.