Sensitive emails deserve better protection.
Protect business email, keep control of your data, and give recipients a simpler way to access protected messages. No mailbox migration required.
Just want to try it? Get started free with Community: one domain, no card.
- Runs on a host you control
- Works with your existing email
- Your encryption keys
- Spam score1.4 / 8
- DNS blocklistsclean
- SPFpass
- DKIMpass
- DMARCpass
- Outbound message matches a ruleSubject contains [secure]
- Recipient gets a notificationA link, no content, no attachment
- One-time code to their inbox7 digits · valid 15 minutes
- Read & reply in the portalNo account, no app
Illustration of the mail path · sample content
Email security shouldn’t make communication harder.
Most teams aren't looking for another complicated platform. They want sensitive mail handled properly, threats filtered out, and recipients who don't need a manual.
“This attachment has client details in it. Is regular email really okay?”
Sensitive information needs a safer path than an ordinary inbox-to-inbox send.
“Was that invoice email actually from our supplier?”
Spam, spoofed senders and suspicious links create real risk, and they arrive every day.
“Our last security tool needed a specialist just to change a setting.”
Email security shouldn't take a dedicated team to run. Clear controls beat clever dashboards.
“Our patients won't create another account just to read one message.”
Recipients want to open the message, not sign up for something. And you want control of where your data lives.
Everything around your email, in one place.
Each part runs on the same gateway you host. The labels show which plan includes it.
- Spam filteringCommunity
- DNS blocklistsCommunity
- SPF · DKIM · DMARCCommunity
- QuarantineCommunity
- Secure portalProfessional
- Mail logsCommunity
- Your keysEvery plan
- AI tuningEnterprise
Protect the email you already use.
Secure Message works with your existing email environment, helping you filter incoming threats and protect sensitive communication without replacing your mailboxes.
It's one part of your email security, not all of it: a gateway that sits in front of the mail system you already trust, on a host you run.
Before
With Secure Message
- Incoming mail
- Secure Message gatewayFiltered on your host · your keys
- Your existing mail systemSame mailboxes, same email clients
Better email protection. A simpler process.
Steps one to three are what you get with the free Community edition. Step four is Professional.
- 1
Deploy
Install Secure Message on a supported Debian host you control.
Community and up - 2
Connect
Route mail through the gateway without migrating mailboxes.
Community and up - 3
Protect
Filter incoming messages and manage suspicious email.
Community and up - 4
Share Securely
Protect selected outbound messages with a recipient portal and one-time access code.
Professional
Everything you need to feel more confident about email.
Real screenshots from the admin console on a running appliance, plus labelled illustrations where a screen doesn't apply. Every feature shows the license it needs.
Inbound Filtering
CommunitySpam scoring, DNS blocklists and SPF, DKIM and DMARC checks run on your gateway before mail reaches a mailbox. You set the weights and the threshold.
Learn more about Inbound Filtering
Quarantine Management
CommunityReview held mail by time and score, search it, and release false positives to the original recipients in a click.
Learn more about Quarantine ManagementEnter your one-time code
Sent to j••••@example.org
Open messageSecure Recipient Portal
ProfessionalHold a sensitive outbound message on your gateway and let the recipient open it with a one-time code. No account, no app.
Learn more about Secure Recipient Portal![The Encryption Rules page under Mail Flow: one enabled subject-regex rule matching [secure] or [encrypt], and the form to add a new rule.](/assets/img/encryption-rules.webp)
Outbound Protection
ProfessionalRules match a subject tag or a header and protect matching outbound mail before it leaves your domain. No rules ship by default.
Learn more about Outbound Protection
Mail Monitoring
CommunityA searchable mail flow log with event filters and CSV export, plus health checks for queues, disk and certificates.
Learn more about Mail Monitoring- Secure messagesEncrypted
- Quarantined mailEncrypted
- eDiscovery archiveEncrypted
- Stored credentials & MFA seedsEncrypted
- Envelope metadata (sender, recipient, subject)Stored in the clear so search works
From the security documentation. No key escrow: back the key up off-host.
Encryption at Rest
Every planStored messages, quarantine and archive are encrypted with a key generated on your host. It never leaves it.
Learn more about Encryption at RestAI-Assisted Security
EnterpriseAn optional classifier and a tuning advisor. Both are off by default, and proposals wait for an administrator unless you turn on Autopilot.
Learn more about AI-Assisted Security- Outbound · card number detectedLuhn-checked · held by DLP rule
- Outbound · disclaimer appendedExternal recipient
- Archive read · re-authenticated10-minute grant · audited
eDiscovery & DLP
EnterpriseArchive search with separated access, plus outbound content inspection with checksum validation and disclaimers.
Learn more about eDiscovery & DLPSecure messages. No extra accounts.
With Secure Message Professional, recipients can open protected messages through a secure portal using a one-time code sent to their inbox.
You have received a secure message from Northbrook Family Practice.
Open it in your browser. You won't need an account or a password.
Open secure messageProtected by Secure Message. The content is not included in this email.
Secure message for
j••••@example.org
We'll email a one-time code to this address. Codes expire after 15 minutes.
Send my codeEnter your one-time code
We sent a 7-digit code to j••••@example.org.
Open message5 attempts · resend available after 60 seconds
Hi Jordan, here are the prep notes for Tuesday's visit. Please bring your insurance card and arrive ten minutes early.
visit-prep.pdfYour email. Your keys. Your control.
The gateway runs inside your own perimeter, next to the mail system you already have.
Encryption at rest isn’t end-to-end encryption, and no product guarantees compliance. Read exactly what is and isn’t encrypted.
- Self-hosted deployment
The gateway runs on a Debian host inside your network. Nothing in the mail path depends on Rubix being reachable.
- Customer-controlled keys & encryption at rest
A master key is generated on install and never leaves the host. Stored messages, quarantine and archive are encrypted with it.
- Your existing mail infrastructure
Mailboxes and email clients stay as they are.
- Administrator access controls & audit logging
MFA, roles, network allowlists, and an audit log of every change.
- Master key generated at install, never leaves the host
- Encrypted store for secure messages, quarantine and archive
- Admin access MFA, roles and allowlists
- Audit log every change, exportable
Built for businesses where communication matters.
Healthcare
Help protect sensitive patient communications while keeping email workflows familiar.
Healthcare solutionsFinancial Services
Support secure handling of sensitive financial correspondence.
Financial servicesLegal Teams
Give confidential communication an added layer of protection.
Legal solutionsManaged Service Providers
Deliver email security capabilities to client environments.
MSP solutionsInternal IT Teams
Manage email filtering and security from infrastructure you control.
IT team solutionsFlexible protection for the way you work.
Annual licenses for a gateway you run. Prices in USD, from the live Rubix Hub catalog.
Community
The core gateway, free for a single domain and one administrator.
- Postfix content filtering & reinjection
- Spam scoring + DNSBL
- SPF, DKIM & DMARC checks
- Quarantine & mail log
- Admin MFA
- Community support
Professional
Full inbound protection and the encryption portal for growing teams.
- Everything in Community
- Secure recipient portal (one-time code)
- Outbound message protection rules
- Anti-phishing & spoof defense
- Anti-malware (ClamAV)
- Recipient verification
- Advanced filtering rules
- Scheduled encrypted backups
- Business-hours support
Enterprise
Compliance, automation and priority support for regulated organizations.
- Everything in Professional
- AI Autopilot tuning (off by default)
- eDiscovery & archive search
- DLP & disclaimers
- Node-bound license management
- Priority support & SLA
Managed hosting is available by request. It isn’t a catalog plan. Compare every feature
Questions we hear a lot.
What is Secure Message?
A self-hosted email security gateway. It sits in front of the mail system you already use, filters inbound mail on a host you control, and, on Professional, lets you protect sensitive outbound messages with a secure recipient portal. It's email, not a chat app, and not a hosted mailbox provider.
Does it replace my current email provider?
No. Your mailboxes, mail server and email clients stay exactly where they are. You point your MX record at the gateway and relay outbound mail through it as a smart host. No mailbox migration.
Do recipients need an account?
No. With Professional, recipients of a protected message open a link and enter a one-time code sent to the inbox they already use. No account, no password, no app to install.
What's included in the free version?
Community is free for one domain and one administrator, licensed for up to 10 users. It includes inbound filtering (spam scoring, DNS blocklists, SPF, DKIM and DMARC checks) plus quarantine, the mail log and admin MFA. The secure recipient portal is not part of Community; it's a Professional feature.
Can Secure Message work with Microsoft 365?
Yes. It's a gateway in front of the mail you already run, including Microsoft 365: inbound mail flows through the gateway before it reaches your mailboxes, and outbound mail can relay through it as a smart host. Administrators can also sign in to the console with Microsoft Entra SSO. The exact connector setup depends on your tenant, so check the DNS, TLS & mail records guide or ask us.
Is Secure Message HIPAA compliant?
No email product can be HIPAA certified, and we don't claim it is. Secure Message is built to support HIPAA safeguards: encryption at rest under your keys, audit logs, access controls and a message path on infrastructure you own. Compliance depends on how you configure and operate it, and on your own policies and agreements.
Do I need my own server?
Yes. Secure Message installs on a Debian 13 server or VM that you control (2 vCPU and 4 GB RAM is a good start) with ports 25, 80 and 443 reachable. If you'd rather not run it yourself, managed hosting is available by request.
What does the Professional portal do?
When an outbound message matches one of your rules (for example a [secure] tag in the subject), the gateway encrypts and holds it, and the recipient gets a notification with a link. They request a one-time code, which is emailed to their original address, then read and reply in the portal. Messages stay readable for 14 days by default.
How does AI security work?
It's an Enterprise option with two parts: a classifier that adds one weighted signal to the spam score, and an advisor that proposes configuration changes. Both are off by default. In the default Overseer mode, proposals wait for an administrator; Autopilot applies only bounded changes and rolls back if good mail starts getting caught. You can run inference on a model inside your own network.
Can I request managed hosting?
Yes, by request. Self-hosted is the standard product. Hosted or managed Secure Message isn't a catalog plan, tell us about your environment and we'll talk it through.
Make secure email feel simple again.
Keep your existing email, strengthen protection, and give your team more control over sensitive communication.