UK-Sovereign Secure Exchange
The UK-sovereign, zero-knowledge alternative to Egress.
For UK organisations that chose Egress for security and now want their data to stay under UK jurisdiction. Hexiosec Transfer is UK-owned and UK-hosted, with zero-knowledge encryption even we can’t read. Secure email, web forms and workspaces, without a US parent.
- UK-Owned & UK-Hosted
- Zero-Knowledge
- No US Parent
- Cyber Essentials Plus
- Trusted by UK Government
The product may look the same. The ownership behind it changed.
Egress was founded and headquartered in London, and for years was the UK secure-email option many organisations defaulted to. It is now owned by KnowBe4, a US company, and Egress operates as a KnowBe4 company with a US parent. The product you use may look the same; the ownership behind it has changed.
Verified against public sources, May 2026. Corporate status can change.
The question is no longer just where your data is hosted, but whose laws can reach it.
Where a company is owned affects which legal system can compel access to the data it controls. A US parent company can bring data within reach of US legal process, such as the CLOUD Act, regardless of where that data is physically stored. For a UK organisation that handles regulated or OFFICIAL-SENSITIVE data, jurisdiction is not a technicality; it is often an explicit procurement and compliance requirement.
Stated carefully: a US parent can bring data within reach of US legal process, not that it will be read. The precise applicability to a UK subsidiary holding UK-hosted data depends on corporate structure and is a legal question. See our plain-English CLOUD Act explainer on the compliance page.
Egress says nothing has changed. Here’s the part that did.
Egress and KnowBe4 tell customers that the way data is encrypted, stored and accessed has not changed. We take them at their word; this is a claim about technical storage, and on that, they are likely right. But two things did change, and they are the things that matter for sovereignty.
Ownership, and therefore jurisdiction
A US parent can bring data within reach of US legal process, regardless of where it is hosted. Hexiosec Transfer is UK-owned and UK-hosted, with no US parent.
The deeper point: vendor access
Egress’s model means their software can access your data to deliver certain features. With Hexiosec’s zero-knowledge architecture, your data is encrypted on your device and we never hold the keys, so the jurisdiction question becomes moot. There is nothing readable for any jurisdiction to compel.
UK-owned and zero-knowledge. Two reasons the jurisdiction question doesn’t arise, not one.
UK-owned and UK-hosted
Hexiosec Limited is UK-registered with no US parent; data sits on Google Cloud Platform in London and is not subject to the US CLOUD Act.
Zero-knowledge
Encrypted on your device; we never hold the keys; the contents stay readable only to you. The double protection: UK jurisdiction and nothing readable to compel.
No recipient account required
The people you exchange with never sign up; they open a secure link in the browser.
One platform
Secure email, web forms and workspaces on one architecture, openly priced, with all modules on every tier.
Egress secure exchange, mapped to Transfer.
Egress Secure Web Form
Hexiosec Transfer Forms
Encrypted form collection, encrypted on the respondent’s device.
Egress Workspace
Hexiosec Transfer Spaces
Persistent encrypted workspaces and virtual data rooms.
Egress secure file sharing
Hexiosec Transfer Files
Secure links, no recipient account.
Egress secure email
Hexiosec Transfer Email
Secure email is on the roadmap; secure links via Files or the Outlook plugin cover this today.
Honest about scope: secure exchange, not anti-phishing.
Egress also provides inbound email threat detection (anti-phishing). Hexiosec Transfer is a secure-exchange platform, not an anti-phishing tool. If that is your primary Egress use, Transfer is not a like-for-like replacement for it. Where Transfer replaces Egress is secure exchange: sending, collecting and sharing sensitive data.
Low-risk, and timed to your trigger.
Nothing for recipients to migrate
They never had Egress accounts and won’t need Hexiosec ones; the people you exchange with just open a secure link.
Run in parallel
Start free, move workflows over at your pace, and keep Egress running until you’re confident.
Switch at your trigger
Most organisations move at a natural point: an Egress renewal, a Cyber Essentials Plus cycle, a post-merger tooling review, or a client request for proposal that asks who owns your provider.
Larger move? Request a demo and we’ll help you plan a guided migration.
Government and regulated-sector proof: the sovereignty thesis, evidenced.
Built by ex-government and defence-intelligence engineers, Cheltenham.
- DSIT Software Security Ambassador
- Cyber Essentials Plus
- UK-sovereign hosting
Transparent, published pricing. See the cost before you talk to anyone.
Our pricing is published: four tiers from a free account to Enterprise, all modules on every tier. You can see exactly what it costs before you talk to anyone.
FREE
£0
Files on the free tier
- 20 sends / month
- 1GB max file size
- 7-day expiry
TEAM
£45
Per month. Includes 3 users
- 50 sends / person / month
- 10GB file size
- Higher caps across modules
BUSINESS
£125
Per month. Includes 5 users
- 100 sends / person / month
- 50GB file size
- Branding
- Audit retention & admin
ENTERPRISE
Contact us
- SSO
- Signed DPA + UK residency
- Framework procurement
- 99.9% SLA
- Named CSM
We don’t state Egress’s prices; the contrast is transparent, published pricing. See full pricing →
Switching from Egress, answered.
Is Egress UK-owned?
Egress was founded in London and is now owned by KnowBe4, a US company.
Does that mean my data isn’t safe with Egress?
This isn’t about technical safety; Egress says encryption and storage are unchanged. It’s about jurisdiction: a US parent can bring data within reach of US legal process. For sovereignty-sensitive data, that matters.
How is Hexiosec different?
UK-owned and UK-hosted, and zero-knowledge, so even we cannot read your data and the jurisdiction question doesn’t arise.
Does Hexiosec replace everything Egress does?
It replaces Egress’s secure exchange: email, web forms and workspaces. It is not an inbound anti-phishing tool.
Is switching disruptive?
Recipients have nothing to migrate; you can run in parallel; and most organisations switch at a renewal or other natural trigger.
What about the CLOUD Act?
See the plain-English explainer at /transfer/compliance/.
What does it cost?
Published pricing, four tiers. See /transfer/pricing/.
Where is my data hosted?
The UK, on Google Cloud Platform in London, with no US parent. See /transfer/compliance/.
Keep your secure exchange in the UK.
Try Transfer free and run it alongside Egress until you’re confident. Switching at renewal, after an acquisition, or because a client asked who owns your provider? Request a demo and we’ll help you plan the move.