Position Paper

Executive Summary

This position paper demonstrates why XQ Message provides a superior solution to PreVeil for organizations seeking CMMC Level 2 compliance. Key advantages include XQ’s Security Protection Asset (SPA) designation, eliminating FedRAMP requirements, superior data sovereignty through tenant-based architecture, significant cost savings, and enhanced usability. While PreVeil relies on FedRAMP Moderate Equivalency—a framework facing potential phase-out—XQ’s innovative approach provides a more sustainable, secure, and cost-effective path to compliance.

1. Cost-Benefit Analysis

XQ’s Economic Advantages

The cost benefits are simple

Preveil – $4,999 / year for 3 users

XQ – $774 / year for 3 users

XQ offers up to 75% cost savings versus migrating to GCC High, with deployment possible in hours within your existing Microsoft 365 instance and flexible licensing without long-term commitments. The cost benefits include:

• No FedRAMP Premium: Elimination of FedRAMP-related costs and administrative overhead
• Existing Infrastructure Utilization: Works within existing Microsoft 365 environments
• Reduced Migration Costs: No need to move to specialized cloud environments
• Lower Ongoing Costs: Minimal additional infrastructure requirements
• Flexible Licensing: Monthly licensing options without long-term commitments

PreVeil’s Cost Structure

PreVeil-Pass costs $4,999/year for 3 users —and organizations still pay for third-party hosting and compliance support. PreVeil’s FedRAMP Moderate Equivalency and hosted solution model creates higher costs:

• FedRAMP Premium: Additional costs associated with FedRAMP-equivalent infrastructure and compliance
• Migration Expenses: Potential costs for moving data and workflows to PreVeil’s platform
• Vendor Dependency: Ongoing subscription costs with limited alternatives
• Compliance Maintenance: Ongoing costs for maintaining FedRAMP equivalency status

2. Regulatory Compliance Architecture

XQ’s SPA Advantage and Industry Recognition

XQ operates as a Security Protection Asset (SPA), which is defined as assets that provide security functions or capabilities within the scope of the assessment. This classification is crucial because SPAs do not require FedRAMP authorization, significantly simplifying the compliance landscape for organizations. XQ’s SPA status enables it to provide encryption and security services without the overhead and limitations associated with FedRAMP requirements.

AWS Zero Trust Architecture Validation: XQ’s credibility and technical superiority are further validated by its inclusion in the AWS Zero Trust Accelerator for Government – Integrated (ZTAG-I) reference architecture. ZTAG-I is a reference architecture that aligns with federal zero trust guidance and integrates solutions from AWS, CrowdStrike, Okta, Zscaler, Splunk, and XQ, bringing together capabilities in identity management, endpoint protection, and network security to address all zero trust pillars. In the data protection pillar, AWS and XQ Message combine their strengths to protect data at multiple levels, with AWS offering encryption services for stored data, while XQ adds encryption for sensitive information and communications.

This inclusion in ZTAG-I demonstrates that XQ has been vetted and validated by AWS and the federal government as a best-in-class solution for zero trust data protection. The fact that XQ is part of a reference architecture designed to meet DoD and CISA zero trust objectives provides significant social proof of its technical capabilities and regulatory alignment.

PreVeil’s FedRAMP Dependency Risk

PreVeil has achieved DoD FedRAMP Moderate Equivalency, which presents several concerns:

• Phase-out Risk: FedRAMP Equivalency is increasingly scrutinized and may be phased out as DoD moves toward stricter cloud service requirements
• Compliance Overhead: FedRAMP equivalency requires extensive documentation, regular assessments, and ongoing compliance maintenance
• Vendor Lock-in: Organizations become dependent on PreVeil’s ability to maintain FedRAMP equivalency status

CMMC Coverage Comparison

XQ directly addresses CMMC Level 2 (NIST 800-171) compliance, supporting approximately 71% of controls in shared responsibility with Microsoft, and implements the rest via its zero-trust capabilities, chain-of-custody logging, DLP, and permission enforcement tools. PreVeil similarly offers documentation and support for all 110 controls, often achieving full 110/110 scores in assessments—but it depends on integration with their platform rather than your core tenant.

3. Data Sovereignty and Security Architecture

XQ’s Zero-Trust Data Protection

XQ’s fundamental architecture ensures that sensitive data never leaves the customer’s control:

• Tenant-Based Architecture: All data remains within the customer’s own Microsoft 365 tenant
• Zero-Knowledge Encryption: XQ never has access to unencrypted customer data
• No Data Hosting: XQ does not store or host customer information, eliminating a significant security liability
• Enclave Protection: XQ enclaves emails and files directly within M365, maintaining data sovereignty

PreVeil’s Data Hosting Liability

PreVeil’s architecture creates inherent security risks:

• Centralized Data Storage: PreVeil hosts customer data on their infrastructure, creating a high-value target for attackers
• Third-Party Risk: Organizations must trust PreVeil’s security controls and infrastructure protection
• Compliance Burden: Shared responsibility model requires ongoing monitoring of PreVeil’s security posture
• Data Breach Exposure: Any compromise of PreVeil’s infrastructure potentially affects all customers

4. Usability and Implementation

XQ’s Seamless Integration and User Experience

XQ’s approach prioritizes user experience and organizational efficiency with documented advantages:

Microsoft 365 Native Integration Benefits

• Embedded Compliance: Files and email handled in Outlook, SharePoint, etc., with embedded controls, minimizing friction and ensuring consistent compliance enforcement
• Zero Workflow Disruption: Unlike PreVeil’s separate applications, XQ works seamlessly within existing Microsoft 365 workflows
• Transparent Encryption: Encryption processes are transparent to end-users, eliminating the learning curve
• No Parallel Systems: Users don’t need to learn or switch between different applications, reducing compliance gaps in high-pressure situations
• Quick Deployment: Streamlined onboarding and installation process through Microsoft AppSource with deployment possible in hours
• Microsoft Certification: XQ Secure Email is Microsoft 365 App Certified with comprehensive security and compliance validation

Proven User Experience Advantages

• No Platform Switching: Unlike PreVeil’s requirement for separate applications and platforms, XQ works within existing email clients
• Consistent Experience: No cross-platform compatibility issues or platform-specific limitations
• Reliable Performance: No reported issues with file corruption, synchronization problems, or system instability
• Administrative Simplicity: No complex device approval processes or support dependencies for basic functionality

PreVeil’s Usability Challenges

While PreVeil claims to be trusted by over 1,500 defense contractors and markets itself as “easy to use”, actual user feedback reveals significant usability concerns documented in app store reviews and user testimonials:

Critical User Complaints from Review Platforms

• File Corruption Issues: “Very buggy software that corrupts files … files with a size of 0 KB. Terrible synchronization.” (SourceForge user review)
• System Reliability Problems: “When it works it works… when it doesn’t you have to wait for support… unstable.” (SourceForge user review)
• Platform Limitations: “Misleading support documentation on using the drive client (which platforms are supported, out of date walkthroughs & screenshots). The downloads work often, but not always and for large files either not at all or freezes the drive window until a force refresh.”
• Overall User Dissatisfaction: “Overall the app feels severely incomplete and neglected. Like the kind of tech that ceases development after the minimum viable product is published. I can honestly say I’ve never disliked an app or service as much as this one.”

Documented User Experience Issues

• Workflow Disruption: PreVeil introduces a parallel workflow (separate app for email/files) that users often avoid in high-pressure situations, creating compliance gaps
• Bolt-on System Risks: Separate systems are easily bypassed in fast/panic scenarios when users default to familiar tools
• Cross-Platform Inconsistency: Device approval processes require switching between different platforms and applications
• File Handling Problems: Frequent file synchronization problems and documented file corruption issues
• Administrative Complexity: Users report having to wait for support when system issues occur

Strategic Considerations

XQ’s Future-Proof Approach

The DoD is tightening FedRAMP requirements and pushing zero-trust mandates through 2025 and beyond. XQ’s SPA designation, tenant-based architecture, and validation through AWS ZTAG-I provide several strategic advantages:

• Regulatory Resilience: Not dependent on evolving FedRAMP requirements
• Zero-Trust Alignment: XQ’s SPA model and patent-backed zero-trust data protection align directly with emerging DoD standards
• AWS Partnership Validation: Inclusion in AWS Zero Trust Accelerator for Government demonstrates technical excellence and regulatory alignment
• Federal Recognition: Part of a reference architecture designed to meet DoD and CISA zero trust objectives
• Scalability: Can grow with organizational needs without infrastructure constraints
• Flexibility: Works with various Microsoft 365 configurations and deployment models
• Innovation: Continuous improvement without regulatory approval delays
• Industry Leadership: Selected as part of AWS’s curated set of best-in-class security partners

PreVeil’s Strategic Risks

Several factors create long-term strategic concerns with PreVeil:

• Regulatory Dependency: Success tied to maintaining FedRAMP Equivalency status, which may be vulnerable to future DoD policy changes
• Equivalency Phase-Out Risk: PreVeil’s reliance on FedRAMP equivalency may be vulnerable as DoD requires full ATO in Federal environments
• Single Vendor Risk: Heavy dependence on PreVeil’s continued operation and compliance
• Limited Flexibility: Constrained by FedRAMP requirements and PreVeil’s platform capabilities
• Market Evolution: Potential obsolescence as DoD requirements evolve toward stricter zero-trust mandates

5. Risk Assessment

XQ Risk Profile: Low

• Technical Risk: Minimal, leverages existing Microsoft infrastructure
• Compliance Risk: Low, SPA designation provides regulatory clarity
• Vendor Risk: Reduced due to tenant-based architecture
• Data Risk: Minimal, data never leaves customer control

PreVeil Risk Profile: Moderate to High

• Technical Risk: Moderate, dependent on PreVeil’s infrastructure reliability
• Compliance Risk: High, dependent on maintaining FedRAMP Equivalency
• Vendor Risk: High, significant dependency on single vendor
• Data Risk: High, centralized data storage creates attractive target

6. Recommendations

Based on this analysis, XQ Message provides superior value for CMMC Level 2 compliance:

1. Immediate Implementation: Organizations should prioritize XQ for new CMMC compliance initiatives
2. Migration Planning: Existing PreVeil users should evaluate migration to XQ to reduce long-term risks and address documented usability issues
3. Cost Optimization: Finance teams should quantify the 75% potential cost savings with XQ
4. Risk Mitigation: Security teams should assess the reduced risk profile of XQ’s architecture
5. User Experience: IT teams should consider the documented user satisfaction advantages of XQ’s seamless M365 integration versus PreVeil’s reported usability challenges

Conclusion

XQ Message’s innovative approach to CMMC Level 2 compliance offers superior security, cost-effectiveness, and strategic positioning compared to PreVeil. The combination of SPA designation, tenant-based architecture, significant cost savings, and seamless integration makes XQ the clear choice for organizations serious about sustainable CMMC compliance.

The inclusion of XQ in AWS’s Zero Trust Accelerator for Government – Integrated (ZTAG-I) reference architecture provides compelling social proof of XQ’s technical excellence and regulatory alignment. This validation by AWS and federal zero trust frameworks demonstrates that XQ is recognized as a best-in-class solution for data protection in zero trust environments.

While PreVeil’s FedRAMP Equivalency may provide short-term compliance, XQ’s forward-looking approach ensures long-term success in an evolving regulatory landscape. Organizations choosing XQ benefit from enhanced data sovereignty, reduced vendor risk, lower costs, and a compliance solution designed for the future of cybersecurity regulation.

The strategic advantages of XQ’s approach position organizations for success not just in meeting current CMMC requirements, but in adapting to future regulatory evolution while leveraging a solution that has been validated by leading cloud providers and federal agencies.

This position paper is based on publicly available information and current regulatory frameworks as of August 2025. Organizations should conduct their own due diligence and consult with compliance professionals before making final technology decisions.