FlowCrypt vs Secure Message

FlowCrypt is an email encryption service that lets users send encrypted messages to OpenPGP users and password-protected messages to other recipients. Recipients can reply securely without installing a plugin. It is offered as a Chrome extension, with other platforms and a mobile application also listed. Gmail and Outlook integration are listed, along with message expiry and password-based recipient verification. The free plan is for fewer than 100 users and lists a 5 MB attachment threshold, while product details say free users can add attachments up to 25 MB. Enterprise supports domains with more than 100 users, and administrators can set domain-wide controls and enforce rules for passphrases, keys, and signing. Enterprise also supports SSO through Google, OIDC providers, and delegated identity providers, and can connect with public key servers, HSMs, and internal systems. Enterprise commercial-use pricing requires contacting FlowCrypt. Its enterprise data processing agreement is described as GDPR-compliant, and enterprise support includes an SLA for availability and response times for fixes and patches.

Secure Message is a self-hosted inbound email gateway that filters mail before it reaches an existing mail server. Its Community features include Postfix content filtering, spam scoring, DNSBL, SPF, DKIM and DMARC checks, quarantine, mail logs and administrator MFA. Professional adds a recipient web portal: recipients open protected messages with a one-time code, without an account or app. Its rules can encrypt, redirect or block sensitive outbound messages, and recipient checks can use SMTP callout, LDAP or directory lookups. Stored messages, attachments and quarantine use Fernet encryption with AES-128-CBC and HMAC-SHA256; the key remains on the customer host. Access controls include TOTP administrator MFA, role-based access and audit logging, with logs exportable to CSV. Enterprise adds AI Autopilot tuning, eDiscovery and archive search, DLP and disclaimers; Autopilot and the classifier are off by default. The gateway can sit in front of Microsoft 365 or an existing mail server without mailbox migration. The single-node appliance runs on Debian 13, with 2 vCPU and 4 GB RAM recommended as a starting point.