Proofpoint Email DLP and Encryption vs Secure Message

Proofpoint Email DLP and Encryption detects sensitive information in email and attachments to help prevent data loss and automate compliance. Administrators can apply encryption policies at global, group, and user levels through LDAP and Active Directory integrations. Detection includes hundreds of built-in identifiers and dictionaries, with custom entries supported, and scans more than 300 file types by default. Policies can trigger encryption based on destination, sender, or message attributes; encryption can also act as a TLS fallback. Recipients can access protected messages through a web portal, mobile browser, or Outlook client. A centralized dashboard provides real-time statistics and trends, incident review, and actions on non-compliant messages. Proofpoint says Email DLP integrates with Unified DLP for shared configuration, detection, and remediation across email, cloud, applications, and endpoints. Listed compliance areas include PCI, SOX, GDPR, PII, and HIPAA. The service is available on Android, iOS, web, and Windows, with cloud and hybrid deployment options. Proofpoint states that it uses HTTPS/TLS in transit and AES 256 encryption at rest, and undergoes an annual SOC 2 Type II audit. Pricing is on request; the product page offers a demo request, with no trial terms stated.

Secure Message is a self-hosted inbound email gateway that filters mail before it reaches an existing mail server. Its Community features include Postfix content filtering, spam scoring, DNSBL, SPF, DKIM and DMARC checks, quarantine, mail logs and administrator MFA. Professional adds a recipient web portal: recipients open protected messages with a one-time code, without an account or app. Its rules can encrypt, redirect or block sensitive outbound messages, and recipient checks can use SMTP callout, LDAP or directory lookups. Stored messages, attachments and quarantine use Fernet encryption with AES-128-CBC and HMAC-SHA256; the key remains on the customer host. Access controls include TOTP administrator MFA, role-based access and audit logging, with logs exportable to CSV. Enterprise adds AI Autopilot tuning, eDiscovery and archive search, DLP and disclaimers; Autopilot and the classifier are off by default. The gateway can sit in front of Microsoft 365 or an existing mail server without mailbox migration. The single-node appliance runs on Debian 13, with 2 vCPU and 4 GB RAM recommended as a starting point.