If you’re looking for a self-hosted alternative to Proofpoint or Mimecast, you’re usually after two things their cloud platforms can’t give you: control over where your mail lives, and a bill that doesn’t grow with every new mailbox. That’s exactly the gap Hermes Secure Email Gateway is built to fill.
The honest trade-off
Proofpoint and Mimecast are excellent enterprise platforms. Their threat intelligence, global scale, and dedicated security operations are genuinely best-in-class, and for a large enterprise with the budget and compliance needs to match, they’re hard to beat, we’re not going to pretend otherwise.
But that model carries two costs that land hardest on smaller organizations:
- Per-mailbox, per-month pricing that scales with headcount, the bill quickly outgrows an SMB or MSP budget.
- Your mail flows through the vendor’s cloud. For teams with data-residency, privacy, or sovereignty requirements, that alone can be a non-starter.
What Hermes does differently
Hermes is a self-hosted, open-source secure email gateway and mail server. You run it on your own hardware or VPS, so your mail and data never leave infrastructure you control. And it’s licensed per server, not per mailbox, one flat price protects thousands of mailboxes, so your costs stay predictable as you grow.
The free, AGPLv3 Community Edition is the complete gateway and mail server: anti-spam, anti-malware, full encryption (S/MIME, PGP, TLS), and SPF/DKIM/DMARC/ARC. Hermes Pro layers on the operational and security extras, including time-of-click link protection, the post-delivery URL defense you’d otherwise pay Proofpoint or Mimecast for.
| Proofpoint / Mimecast | Hermes SEG | |
|---|---|---|
| Deployment | SaaS, mail routes through the vendor cloud | Self-hosted on your own infrastructure |
| Pricing model | Per mailbox, per month | Per server, flat, thousands of mailboxes |
| Data ownership | Held in the vendor cloud | Stays on hardware you control |
| Source | Proprietary | Open source (AGPLv3) Community Edition |
| Anti-spam / anti-malware | Yes | Yes. SpamAssassin, postscreen, RBLs, ClamAV |
| Encryption (S/MIME, PGP, TLS) | Yes (by tier) | Yes, included in Community Edition |
| SPF / DKIM / DMARC / ARC | Yes | Yes, full tooling built in |
| Time-of-click link protection | Yes | Yes. Link Guard (Pro) |
| Built-in mail server & webmail | No, sits in front of your mail | Yes. Dovecot mailboxes + Nextcloud |
| Runs in front of M365 / Google Workspace | Yes | Yes, or as your full mail backend |
Comparison reflects typical SMB / self-hosted deployments and each vendor’s published positioning. All trademarks belong to their respective owners; Hermes SEG is not affiliated with or endorsed by Proofpoint or Mimecast.
Where Proofpoint and Mimecast still win
Being straight with you: if you need a vendor-run 24/7 security operations center, managed threat hunting, sandboxing at massive scale, or a long list of compliance certifications carried under the vendor’s name, the big SaaS suites still lead. Hermes gives you the core defenses and the architecture to own your stack. It isn’t a drop-in replacement for an enterprise SOC.
Who Hermes is a great fit for
- SMBs and MSPs who want real email security without per-mailbox SaaS pricing.
- Self-hosters and privacy-focused teams who need mail and data to stay on their own infrastructure.
- Organizations adding defense-in-depth in front of Microsoft 365 or Google Workspace, instead of trusting one vendor for both mail and security.
Try it yourself
The Community Edition is free and open source, with no time limit. Pro adds Link Guard and more, with a free trial and no credit card required.