The proven solution to protect defense data around the world.
Proven end-to-end encrypted email and file sharing, trusted by 3,000 organizations across the globe. Save up to 75% on compliance, with a solution that’s easy to deploy and use.
End-to-End Encrypted Email & File Sharing Trusted by Customers in the US, UK, Japan, India, Denmark, Germany and Canada
3,000
Defense Contractors
25+
Countries
100,000
Users
100+
Achieved CMMC
Meet US & Local Compliance Requirements
If you supply the DoD or a US prime, CMMC and ITAR obligations apply to you wherever you are based. Microsoft’s GCC High isn’t sold outside the US. PreVeil is available worldwide and works alongside your local laws.
With PreVeil, every file and message is encrypted end-to-end. Only your users hold the keys, so PreVeil and the cloud provider can’t decrypt your data. Choose from any of AWS's 39 regions, including AWS GovCloud for US CUI.
Use PreVeil, Wherever You Are
GCC High isn’t sold outside the US. PreVeil is. It's currently used by companies in 25 countries, across North America, Europe, Asia, and the Pacific.
Add a Compliant Enclave Only Where You Need It
Your CUI lives in a separate, encrypted PreVeil enclave. The rest of your company stays on the tools it already uses.
Share ITAR Data Across Borders Without It Counting as an Export
Under 22 CFR 120.54, end-to-end encrypted technical data sent or stored outside the US isn’t an export. PreVeil meets that standard.
Meet Multiple Data Sovereignty Laws Using the Same Platform
One deployment keeps CUI in AWS GovCloud and local data in-region, so US and local requirements don’t conflict.
How PreVeil Works
Encrypted File Sharing + Email
Protects CUI without overhauling existing systems. Integrate with Microsoft 365, Google Workspace, Outlook, and Exchange.
CMMC Compliance Accelerator
Pre-filled, customizable documentation built on NIST 800-171 standards, the foundation of many international regulatory frameworks.
Network of Trusted Partners
Access our network of C3PAO and consultants to refine your documentation & streamline your assessment.
Bruce McLaren
IT & Compliance Lead
Camcor Industries Ltd. Ontario, Canada
"We needed a proper method of containing CUI. We looked at other solutions but the cost was prohibitive. Then we found PreVeil and liked that it was much more reasonably priced.
We rolled it out at our sister company and then at Camcor. And then it really caught on because the people there found it easy to use, costs were good and it created an enclave for us.”
"European defence and manufacturing sectors are increasingly connected to international supply chains, where cybersecurity and regulatory compliance are essential to doing business.
Our partnership with PreVeil combines secure collaboration technology with ContrailRisks' local cybersecurity and compliance expertise, helping European organisations protect sensitive information and confidently navigate US defence contracting requirements.”
Fabrizio Di Carlo
Managing Director
ContrailRisk
Frankfurt, Germany
PreVeil Supports International Compliance Frameworks
1. Built on NIST 800-171
NIST SP 800-171 is the US standard for protecting sensitive, unclassified defense information, and several allies have adopted it or draw from it. Because the controls overlap, the PreVeil technology and documentation you put in place for one framework carry over to the others.
| Country | Framework | NIST basis | How PreVeil helps | |
|---|---|---|---|---|
| United States | CMMC | Level 2 = 800-171 Rev 2 | Required across the DoD supply chain to protect CUI, worldwide. | |
| Canada | CPCSC | ITSP.10.171, Canada's version of 800-171 Rev 3 | Host in AWS Canada or in US-GovCloud. | |
| Japan | MOD Defense Industry Cybersecurity Standard | Controls at the same level as 800-171 | CMMC Level 2 and the MOD standard in one environment. | |
| United Kingdom | DCC (DEFSTAN 05-138) | Partly: draws on NIST, ISO 27001 and Cyber Essentials | MOD requires DCC Level 0 by 31 Dec 2026. | |
| South Korea | K-CMMC | Expected to mirror CMMC | Get ahead on CMMC Level 2 now. | |
| Australia / NZ, India | CMMC flow-down | Via US contracts | Meet the CMMC requirements your primes flow down. |
2. Written around end-to-end encryption
Some rules treat encryption as the line between compliant and not, like ITAR’s carve-out for end-to-end encrypted data and Germany’s VS-NfD encryption requirements. PreVeil encrypts every file and message end to end by default, and meets the ITAR carve-out.
| Country | Framework | Encryption rule | How PreVeil helps | |
|---|---|---|---|---|
| United States | ITAR | Carve-out: end-to-end encrypted technical data sent or stored abroad isn't an export (22 CFR 120.54) | Share ITAR data across borders with FIPS-validated end-to-end encryption. | |
| Germany | VS-NfD | Requires encryption with BSI-approved products for transmission and mobile storage | Protect the US-controlled data you hold alongside your VS-NfD processes. |
3. Separate national frameworks
Some countries set their own requirements. PreVeil protects the controlled data you share and covers any US CMMC or ITAR obligations alongside it.
| Country | Framework | How PreVeil helps | |
|---|---|---|---|
| France | RMC (DGA) | Own 21-requirement baseline. PreVeil covers the US CMMC and ITAR obligations you carry alongside it. |
Frequently Asked Questions
Yes. PreVeil serves defense contractors in 25+ countries, both directly and through partners. You don't need a US entity.
Yes. CMMC applies to any company handling CUI under a DoD contract, wherever it's based.
No. CMMC requires safeguarding CUI, not a specific product. Data residency requirements might mean GCC High is not an option.
Yes. Encryption and access limited to authorized users keep ITAR data away from unauthorized foreign persons.
Often, yes. We'll map your requirements on a call.
No. Only the people who handle CUI or ITAR data use PreVeil. Everyone else can stay on your current Microsoft 365 or Google Workspace.
Yes. PreVeil works with the email and file tools your team already uses.
Yes. Host Canadian data in AWS Canada or keep CUI in AWS US-GovCloud, all in one deployment.
No. DCC is based on DEFSTAN 05-138 and covers your organization's overall security. CMMC focuses on protecting CUI. Many UK suppliers to US primes need both.
An authorized C3PAO (third-party assessment organization). We can introduce you to partners who work with international clients.
Yes, in most countries. US export rules restrict encryption software only in a small number of sanctioned destinations. Tell us where you're based and we'll confirm.
Any cloud service that stores CUI must meet DFARS 252.204-7012, including the requirement that it’s FedRAMP Moderate or equivalent, which PreVeil meets. PreVeil has been proven in over one hundred CMMC assessments with perfect 110/110 scores.
Ready to get started with PreVeil?
PROUDLY MADE IN THE USA
PreVeil is 100% Designed & Developed in the USA