Secure Message

Secure Message is a self-hosted gateway for organizations that need to control inbound mail, protected recipient delivery and sensitive outbound messages in one system. It suits teams able to operate a Debian appliance, especially in regulated industries where key custody and auditability matter. The broader policy coverage is compelling, but infrastructure ownership and annual licensing make it a specialist choice rather than a casual encryption add-on.

Overview

The gateway receives mail through MX routing before it reaches Microsoft 365 or another existing mail server, then relays outbound mail through a smart host. Mailboxes stay where they are, which avoids a migration project, but deployment remains an infrastructure responsibility. The single-node appliance runs on Debian 13, with a recommended starting allocation of 2 vCPU and 4 GB of RAM.

Stored messages, attachments and quarantine are encrypted with Fernet using AES-128-CBC and HMAC-SHA256. The key stays on the customer host, giving the organization direct custody while making host security, backup and administration part of its operational burden.

Key features

Community supplies a substantial inbound baseline: Postfix content filtering, spam scoring, DNSBL, SPF, DKIM and DMARC checks, quarantine and mail logs. TOTP administrator MFA, role-based access and audit logging are included, and logs can be exported to CSV. That combination suits internal IT and compliance teams that need traceable administration, although Community is constrained to one domain and one administrator.

Secure delivery lets Professional recipients open protected messages in a web portal with a one-time code. They do not need an account or an installed application, reducing friction for external contacts. Professional rules can encrypt, redirect or block sensitive outbound mail, including holding it for portal delivery. Recipient verification can reject mail for nonexistent users through SMTP callout, LDAP or directory lookups, helping organizations avoid misdelivery and directory-related acceptance problems.

Enterprise adds AI Autopilot tuning, eDiscovery and archive search, DLP and disclaimers. Autopilot and the classifier are off by default, so organizations should plan policy and activation work rather than assume those controls operate immediately. The mix is well aligned with regulated correspondence, but it is more administrative machinery than a small business may need.

Pricing

Secure Message uses a freemium structure. Community has custom pricing and includes one domain and one administrator, with community support. It is the sensible starting point for a single-domain deployment that can accept narrow administrative coverage; it gives up the user, domain and support allowances of the paid tiers.

Professional costs $690 a year, billed annually at $690 / year. It covers 10 domains and up to 10 users, includes business-hours support, and is the practical fit for a defined department or midsize organization that needs recipient-portal delivery, outbound policy rules and directory-based recipient verification.

Enterprise costs $1,490 a year, billed annually at $1,490 / year. Unlimited users and domains, priority support and an SLA target organizations with broad deployment or contractual response expectations. Enterprise also supplies the advanced compliance features; teams that do not need those additions may find Professional the better-balanced tier.

A scoped trial can be requested with engineering, but no trial duration is stated. Annual billing and the paid-tier seat and domain limits should be weighed against the cost of operating the appliance.

Platforms

Secure Message runs on Linux as a self-hosted appliance and is administered through the web. Debian 13 is required for the single-node deployment. It can front Microsoft 365 or an existing mail server through MX routing and outbound smart-host relay, without mailbox migration.

Who it's for

The product is aimed at healthcare, finance and legal teams, managed service providers, internal IT departments and compliance-driven organizations. It is a strong match when one team can own Debian operations, mail routing and policy administration, and when keeping encryption keys on the customer host is important. It is a poor fit for organizations seeking a fully hosted service, a lightweight desktop workflow or broad multi-domain administration on a free plan.

Pros and cons

Pros

• One gateway for inbound and outbound policy: filtering, portal delivery and rules that encrypt, redirect or block sensitive mail reduce the need to combine separate controls.
• Recipient-friendly protected delivery: one-time-code portal access avoids requiring recipients to create accounts or install software.
• Customer-held encryption key: at-rest protection covers messages, attachments and quarantine while the key remains on the customer host.
• Auditable administration: MFA, role-based access and CSV-exportable logs support oversight and investigations.

Cons

• Operational overhead: Debian 13, appliance sizing and mail-routing ownership demand infrastructure expertise.
• Community limits: one domain and one administrator restrict free deployments.
• Paid plans are annual: Professional and Enterprise require yearly commitments, with broader support and capacity reserved for the higher tiers.
• Advanced automation is not immediate: Enterprise Autopilot and classifier functions are disabled by default and require deliberate rollout.

Alternatives

Choose Lockbin instead when you want a freemium, cross-platform secure-messaging service with a free tier capped at one user, 25 MB attachments and six months of inbox storage.

SecureMyEmail is the better direction for Android, iOS, macOS or Windows users seeking a client-oriented option with a free single-address plan.

Pick Send It Secure for API, extension, mobile and web access, with a guest tier offering 30-day retention, 25 MB files and 10 lifetime sends to non-paid users.

gpg4o suits Windows users who specifically want OpenPGP functions in Microsoft Outlook.

c.Email is a free extension offering unlimited email addresses and support for existing addresses.

FlowCrypt is aimed at extension users, with a free plan for fewer than 100 users and a 5 MB attachment threshold.

Consider Mimecast Secure Messaging for a paid, multi-platform secure-messaging suite with large-file delivery and email continuity.

DataMotion Secure Email Exchange is an enterprise offering with contact-sales pricing.

For broader category browsing, see Email Encryption Software and File encryption tools.

Verdict

Choose Secure Message if your organization needs a self-hosted control point in front of Microsoft 365 or an existing mail server, with recipient-portal delivery, outbound policy enforcement and customer-held encryption keys. Look elsewhere if you cannot operate Debian-based mail infrastructure, need a hosted consumer workflow, or require more than one domain and administrator without moving to a paid annual plan.