Self-hosted · built to HIPAA safeguards · no recipient accounts

Self-hosted HIPAA email gateway.

Secure Message sits in front of the mail you already run. The first useful session is inbound filtering on the box — spam scoring, DNSBL, and SPF, DKIM and DMARC. The one-time-code recipient portal is Professional.

Get a free license Buy licenses

Community: one domain, one administrator, node-locked. Evaluate on your MX host.

The Secure Message admin dashboard, v1.5.8 Enterprise: system status, resources, and service health. Account chip and certificate details are redacted. — Admin dashboard. v1.5.8, Enterprise.

1 domain

Community · one administrator

Your keys

Encryption at rest

Portal

Professional · one-time code

Self-host

Debian host you run

What you get

Inbound filtering first. Portal on Professional.

Community is inbound filtering for one domain and one administrator. Professional adds the encryption portal, ClamAV, recipient verification, advanced rules, and backups. Enterprise adds Autopilot, eDiscovery, DLP, and unlimited users and domains.

Inbound filtering on the box

Community starts here: Postfix content filtering and reinjection, spam scoring and DNSBL, and SPF, DKIM and DMARC checks — before mail reaches a mailbox.

Quarantine & mail log

Review held mail, release false positives, and keep the mail log in one admin console. Admin MFA is included on Community.

Encryption at rest

Every stored message and attachment is encrypted with AES / Fernet keys you hold, so data on the appliance is unreadable if a disk is ever exposed.

One-time-code recipient portal

Professional. Recipients open protected messages in a branded web portal using a one-time code sent to their inbox. No account, no password, no app to install.

Outbound message protection

Professional. Rule-based policies scan outbound mail and can encrypt, redirect, or block sensitive messages — including hold-for-portal — before they leave your domain.

Recipient verification

Professional. Reject mail to non-existent users at the edge via SMTP callout, LDAP, or directory lookups — cutting backscatter and wasted load.

Scheduled encrypted backups

Professional. Automated, encrypted backups of configuration, quarantine, and message stores keep you recoverable without ever exposing plaintext.

Autopilot, eDiscovery & DLP

Enterprise. AI Autopilot tuning (off by default; Overseer unless you turn Autopilot on), eDiscovery and archive search, DLP and disclaimers, and unlimited users and domains. Professional already includes non-AI anti-phishing.

Audit logs & compliance export

Every admin action and message decision is logged and exportable to CSV. Archive search and eDiscovery are Enterprise.

Enterprise

Autopilot, eDiscovery and DLP

Professional already includes non-AI anti-phishing. Enterprise adds AI Autopilot tuning, eDiscovery and archive search, DLP and disclaimers, and unlimited users and domains. The inbound classifier is one Enterprise signal, off by default.

AI Autopilot tuning

Enterprise. Off by default. The advisor stays in Overseer — proposals wait for an administrator — unless you turn Autopilot on. A classifier hit alone does not quarantine at defaults.

eDiscovery, DLP & unlimited scope

Enterprise adds eDiscovery and archive search, DLP and disclaimers, and unlimited users and domains. Professional already includes non-AI anti-phishing and spoof defense.

On-box, or a model you point at

The inbound classifier is Enterprise and off by default. Inference can run against a model inside your network. A hosted AI provider is opt-in only. See /docs/ai.

Autopilot and the classifier stay off until you enable them. Enterprise-licensed. A hosted provider is opt-in — see /docs/ai.

How it works

From MX record to a filtered inbox

Community starts when inbound mail hits the gateway. The one-time-code portal is Professional. No mailbox migration and no client software.

Point your MX at the gateway

Route inbound mail through Secure Message and relay outbound through it as a smart host. Deploy the Debian appliance on a host you control — no mailbox migration, no client software.

Filter inbound, protect outbound

Inbound mail is authenticated and scored (SPF, DKIM, DNSBL and heuristics). Professional can hold matching outbound mail for the portal. Enterprise Autopilot and the inbound classifier stay off until you enable them.

Recipients read securely — no account

Professional. Protected messages arrive as a notification with a secure link. The recipient enters a one-time code and reads or replies in the portal, while everything stays encrypted at rest.

Secure Message mail flow on appliance v1.5.8: Community inbound filtering from MX through Postfix and the content filter to quarantine or the downstream mail server. The one-time-code portal is Professional. Enterprise Autopilot and the inbound classifier stay off until you enable them. No mailbox migration. — Appliance v1.5.8. Community inbound filtering. The one-time-code portal is Professional. Enterprise Autopilot and the inbound classifier stay off until you enable them. No mailbox migration.

The console

The operator console on the appliance you run

Operator console, appliance v1.5.8.

The Secure Message admin dashboard, v1.5.8 Enterprise: system status, CPU memory disk and network, service health for postfix postgresql nginx and the console, and a mail-queue warning. Account chip and certificate details are redacted. — Admin dashboard. v1.5.8, Enterprise.

The Spam and filtering page under Threat Protection: inbound spam filtering enabled, threshold 8, action quarantine, and scored checks for the local block list, SPF, DKIM, content intelligence, and DNSBL. — Inbound spam and filtering. You set the weights, the DNS lists, the threshold, and what happens when mail goes over — on the gateway.

The Mail flow log under Monitoring: TIME and EVENT columns with delivered, spam scan, and processed events, Export CSV, and sender and recipient columns redacted. — Monitoring → Mail flow log. Event times and types stay visible; sender and recipient columns are redacted. Export CSV is on the page.

The Encryption Rules page under Mail Flow: one enabled subject-regex rule matching [secure] or [encrypt], and the form to add a new subject-line rule. — Mail Flow → Encryption Rules. A subject regex [secure]|[encrypt] protects matching outbound mail. No rules ship by default.

The Quarantine page under Threat Protection: held-mail list with received time and spam score visible, Release selected, and sender and recipient columns redacted. — Threat Protection → Quarantine. Held mail with received time and score; senders and recipients are redacted. Release or delete from the list.

On your host

Your mail, your keys, your infrastructure

Most secure-email services decrypt and scan your mail on their servers. Secure Message keeps encryption at rest under a key that only ever exists on your host, and runs entirely inside your own perimeter.

Encryption at rest with your keys

Messages, attachments, and quarantine are encrypted with AES / Fernet keys that never leave your deployment — plaintext is never written to disk.

Authenticated inbound mail

SPF, DKIM, and DNSBL reputation checks reject spoofed and forged senders before any content is evaluated, cutting phishing at the door.

Enterprise Autopilot, eDiscovery & DLP

Enterprise adds AI Autopilot tuning (off by default), eDiscovery and archive search, and DLP and disclaimers. Professional already includes non-AI anti-phishing. The inbound classifier is optional and off by default.

Admin MFA & role-based access

TOTP multi-factor for administrators, granular roles, and full audit logging of every configuration change and message decision.

No third-party data path

Self-host the gateway and no message — inbound or outbound — is ever processed on someone else’s servers. Your mail stays inside your perimeter.

Self-hosted

The gateway runs on a host you own

Mail is encrypted at rest with a key that stays on that host. Nothing in the mail path depends on us. Enterprise Autopilot and the classifier stay off until you turn them on.

Self-hosted

One Debian host. Your keys, your storage, your retention.

One Debian host inside your own perimeter
Your keys, your storage, your retention
Nothing in the mail path depends on us
You decide where the data lives

Enterprise AI

Autopilot and the classifier stay off until you enable them. Point them at a model on your network, or opt into a hosted provider.

Filtering runs on the host
Enterprise Autopilot stays off until you enable it
Use a model on your network, or a hosted provider you opt into
Message content need never leave your network

Who it’s for

Teams that keep the gateway on their own host

Regulated industries

Healthcare, finance, and legal teams that want inbound filtering on a host they run. The Professional portal holds the message when PHI should not land in a third-party inbox.

MSPs & IT providers

Professional is licensed per domain. Enterprise covers unlimited domains when you run one gateway for many clients.

Internal IT teams

Put Community in front of Microsoft 365 or your own mail server. No mailbox migration. Outbound hold-for-portal is Professional.

Compliance-driven orgs

Audit logs ship with the gateway. Encrypted backups are Professional. eDiscovery is Enterprise.

Free companion

Office PDF Sign, free with Secure Message

Fill, sign and flatten a PDF on the workstation, then send it through the gateway. No extra cloud account. Free download; no subscription required.

Download for Windows Download for Mac

Pricing

Annual license per protected domain, on infrastructure you own

Community is the core inbound gateway for one domain and one administrator. Professional adds the one-time-code recipient portal, ClamAV, recipient verification, advanced rules, and backups. Enterprise adds Autopilot, eDiscovery, DLP, and unlimited users and domains.

Community

The core gateway, free for a single domain and one administrator.

Free

One domain · one administrator

1 domain · up to 1 users

Postfix content filtering & reinjection
Spam scoring + DNSBL
SPF, DKIM & DMARC checks
Quarantine & mail log
Admin MFA
Community support

Get a free license

Professional

Full inbound protection and the encryption portal for growing teams.

$690 / domain / yr

≈ $58/mo · billed annually

10 domains · up to 10 users

Everything in Community
Anti-phishing & spoof defense
Anti-malware (ClamAV)
Recipient verification
Advanced filtering rules
Secure message portal (encryption)
Scheduled backups
Business-hours support

Buy Professional

Enterprise

Compliance, automation and priority support for regulated orgs.

$1490 / domain / yr

≈ $124/mo · billed annually

Everything in Professional
AI Autopilot tuning
eDiscovery & archive search
DLP & disclaimers
Unlimited users & domains
Node-bound license management
Priority support & SLA

Buy Enterprise

Prices in USD, billed annually. Enterprise includes unlimited users and domains. Hosted or managed operation is request-only — not a catalog plan. Compare plans.

Stand the gateway in front of the mail you already run.

Install on a Debian host you control. Start with Community on one domain, or request a scoped trial with engineering. See the install guide.

Get a free license Buy licenses