If you are looking for a self-hosted alternative to Proofpoint or Mimecast, you are usually after two things their cloud platforms cannot give you: control over where your mail lives, and a bill that does not grow with every new mailbox. That is exactly the gap Hermes Secure Email Gateway is built to fill.
The trade-off
Proofpoint and Mimecast are excellent enterprise platforms. Their threat intelligence, global scale, and dedicated security operations are genuinely best-in-class, and for a large enterprise with the budget and compliance needs to match, they are hard to beat.
But that model carries two costs that land hardest on smaller organizations:
- Per-mailbox, per-month pricing that scales with headcount. The bill quickly outgrows an SMB or MSP budget.
- Your mail flows through the vendor’s cloud. For teams with data-residency, privacy, or sovereignty requirements, that alone can be a non-starter.
What Hermes does differently
Hermes is a self-hosted, open-source secure email gateway and mail server. You run it on your own hardware or VPS, so your mail and data never leave infrastructure you control. And it is licensed per server, not per mailbox. One flat price protects thousands of mailboxes, so your costs stay predictable as you grow.
The free, AGPLv3 Community Edition is the complete gateway and mail server: anti-spam, anti-malware, full encryption (S/MIME, PGP, TLS), and SPF/DKIM/DMARC/ARC. Hermes Pro layers on the operational and security extras, including time-of-click link protection, the post-delivery URL defense you would otherwise pay Proofpoint or Mimecast for.
| Proofpoint / Mimecast | Hermes SEG | |
|---|---|---|
| Deployment | SaaS, mail routes through the vendor cloud | Self-hosted on your own infrastructure |
| Pricing model | Per mailbox, per month | Per server, flat, thousands of mailboxes |
| Data ownership | Held in the vendor cloud | Stays on hardware you control |
| Source | Proprietary | Open source (AGPLv3) Community Edition |
| Anti-spam / anti-malware | Yes | Yes. SpamAssassin, postscreen, RBLs, ClamAV |
| Encryption (S/MIME, PGP, TLS) | Yes (by tier) | Yes, included in Community Edition |
| SPF / DKIM / DMARC / ARC | Yes | Yes, full tooling built in |
| Time-of-click link protection | Yes | Yes. Link Guard (Pro) |
| Built-in mail server & webmail | No, sits in front of your mail | Yes. Dovecot mailboxes + Nextcloud |
| Runs in front of M365 / Google Workspace | Yes | Yes, or as your full mail backend |
Comparison reflects typical SMB / self-hosted deployments and each vendor’s published positioning. All trademarks belong to their respective owners; Hermes SEG is not affiliated with or endorsed by Proofpoint or Mimecast.
The cost model, and why it flips as you grow
The headline difference is not a discount, it is a different unit of pricing. Per-mailbox SaaS scales linearly: double your mailboxes and you roughly double your security bill, every year, forever. A per-server license does not move when you add people. Protecting 50 mailboxes and protecting 2,000 can be the same license.
For a growing SMB, that means your security cost stops being a moving target. For an MSP protecting many small clients, it means you can put real email security in front of accounts that could never justify per-seat enterprise pricing, and keep the margin. The Community Edition being free also means you can stand up protection first and decide on Pro later, rather than signing a per-seat contract to start.
Your data stays yours
With a cloud gateway, every message your organization sends and receives passes through, and is processed on, the vendor’s infrastructure. For many teams that is fine. For others, healthcare, legal, finance, government, or anyone with data-residency or sovereignty obligations, it is the reason they cannot use those platforms at all. Hermes runs on hardware you choose, in a location you choose. There is no Hermes cloud in the path, because there is not one. You decide where mail is stored and processed, and you can prove it.
Time-of-click link protection, self-hosted
The feature people most associate with Proofpoint (URL Defense) and Mimecast (URL Protection) is time-of-click link rewriting: inbound links are rewritten so their destination is checked at the moment someone clicks, not just when the message arrives. That matters because attackers routinely send a clean link and weaponize it hours later, after it has cleared your filters.
Hermes Pro includes the same class of defense with Link Guard: inbound links are rewritten through a Hermes redirect, and the destination’s reputation is checked at click time with layered verdicts (heuristics plus URLhaus and OpenPhish feeds, with optional Google Safe Browsing and VirusTotal), open-redirect detection, and admin-configurable actions. It runs in your stack, on your infrastructure, with no per-mailbox fee.
Where Proofpoint and Mimecast still win
If you need a vendor-run 24/7 security operations center, managed threat hunting, sandboxing at massive scale, or a long list of compliance certifications carried under the vendor’s name, the big SaaS suites still lead. Hermes gives you the core defenses and the architecture to own your stack. It is not a drop-in replacement for an enterprise SOC.
Who Hermes is a great fit for
- SMBs and MSPs who want real email security without per-mailbox SaaS pricing.
- Self-hosters and privacy-focused teams who need mail and data to stay on their own infrastructure.
- Organizations adding defense-in-depth in front of Microsoft 365 or Google Workspace, instead of trusting one vendor for both mail and security.
Common questions
Is there a free alternative to Proofpoint or Mimecast?
Yes. The Hermes Community Edition is free and open source (AGPLv3), with no time limit, and includes the full gateway: anti-spam, anti-malware, encryption, and SPF/DKIM/DMARC/ARC. Time-of-click Link Guard is part of the paid Pro tier.
Can Hermes sit in front of my existing Microsoft 365 or Google Workspace?
Yes. Point your MX at Hermes, let it filter and encrypt inbound mail, and relay the clean mail to M365, Google Workspace, or Exchange. Your mailboxes stay where they are.
Does Hermes do sandboxing and managed threat intelligence like the big suites?
Hermes provides layered reputation and signature-based defenses and time-of-click link checking. It does not include a vendor-run sandbox farm or a managed threat-hunting team. If those are hard requirements, the enterprise SaaS suites are a better fit.
How hard is it to run?
It deploys as a Docker Compose stack with a guided installer, and updates through a single command. You own the uptime and backups, which is the trade for owning your data and your bill.
Try it yourself
The Community Edition is free and open source, with no time limit. Pro adds Link Guard and more, with a free trial and no credit card required.