- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Fortra Secure Email Gateway
A customer list went out inside a screenshot. Your DLP rule could only bounce the email — Fortra Secure Email Gateway runs on hardware or a cloud tenancy you choose, opens every attachment with deep content inspection, and redacts only the part of a message that breaks policy — then sends it with S/MIME, PGP or portal encryption.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The Fortra platform family
This page covers Fortra Secure Email Gateway — with Exchange Gateway, ICAP Gateway and the Cryoserver archive folded in. The rest:
Quick facts
30-second orientation- Product
- Self-hosted secure email gateway for inbound threats and outbound data loss, built on deep content inspection
- Lineage
- The ex-Clearswift gateway; the old brand’s domain now redirects to Fortra Email Security
- Hosting
- Your hardware, a VMware or Hyper-V private cloud, Azure or AWS, or managed in ISO-certified data centres
- Platform
- Needs a standard RHEL operating stack; Fortra handles installation and upgrades on each platform
- Mail systems
- Mail-system agnostic: sits in front of Microsoft 365, Google Workspace or on-premises Exchange
- Inbound
- Avira and Sophos AV engines, Active Code removal, an optional Sophos cloud sandbox and URL checks
- Outbound
- Adaptive Redaction strips only the breaching content, OCR on images included; TLS, S/MIME and PGP
- Folded in
- Exchange Gateway, ICAP Gateway and the Cryoserver archive; Web Gateway belongs to the same family
- Price
- Quote-only; Fortra publishes no list price and no licence meter for the gateway
- In India via
- TechBag — sized to your mail volume and host, quoted in INR with GST through Fortra’s channel
Understand the secure email gateway before you buy one
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is a secure email gateway?
A gateway sits in the mail path and inspects every message in and out before it is delivered or sent.
A shared cloud mail filter vs Fortra Secure Email Gateway — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A shared cloud mail filter | Fortra Secure Email Gateway |
|---|---|---|
| Policy breach | Whole email blocked, sender annoyed | Only the offending text or image redacted |
| Hidden data | Metadata and tracked changes sent out | Stripped by document sanitisation |
| Attachments | Judged by file extension | Typed by signature, archives opened |
| Mail location | A shared cloud filter abroad | Servers or a cloud tenancy you choose |
| Encryption | One method, or none | TLS, S/MIME, PGP, ZIP or a pickup portal |
| What it is NOT | — | A BEC-focused API layer, or a SaaS you never patch |
The cheapest test is monitor mode on one domain: log what Adaptive Redaction would remove for a month before any rule blocks mail.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Host
A standard Red Hat Enterprise Linux stack on your own hardware, VMware or Hyper-V, or in Azure or AWS; Fortra installs and upgrades it, or hosts it for you.
Inspection
Identifies each file by its signature, checks its structure, opens archives, headers, footers and embedded objects, and records exactly what it strips out.
Policy
Rules built on sender, recipient, content, attachment type and classification labels decide whether a message is rejected, held, delivered, encrypted or redacted.
Delivery
Outbound mail can leave over TLS, S/MIME or PGP, as a password ZIP or through a web pickup portal, with copies kept in the optional Cryoserver archive.
A RHEL host you choose, an inspection engine that opens every file, policy that redacts or encrypts, and delivery options from TLS to a pickup portal — mail never has to leave your network.
Nine capabilities. Inspect, redact, deliver.
Fortra Secure Email Gateway keeps mail on infrastructure you control — and redacts the breach instead of bouncing the email.
Deep content inspection
Files are typed by signature, their structure verified, and nested zips, headers and embedded objects opened before any policy applies.
Several AV engines
Avira and Sophos engines scan inbound mail, with Active Code detection and removal and an optional Sophos cloud sandbox for new files.
URLs sent to isolation
Links are checked against threat feeds and can be blocked, sanitised or rewritten to open inside Garrison or Ericom browser isolation.
Remove only the breach
Rather than block a whole message, it deletes the sensitive text or image region and lets the rest through, with OCR reading screenshots.
Metadata and hidden data
Document sanitisation strips metadata, revision history and autosaved content, and anti-steganography cleans hidden data from images.
Acts on classification tags
Tags written by Fortra Data Classification travel in document metadata, and gateway rules can read them to hold, encrypt or release mail.
Six ways to send securely
TLS, S/MIME, PGP, password-protected ZIP, a web pickup portal and an on-prem Ciphermail portal, matched by policy to each recipient group.
Cryoserver option
The optional Cryoserver archive keeps audited copies of all mail sent to, from and within the business, for court and compliance requests.
Exchange and ICAP gateways
Exchange Gateway applies policy to internal Exchange mail, and ICAP Gateway brings the same inspection to web proxies and file transfer.
Watch Fortra introduce the Secure Email Gateway
One short product video from Fortra’s official channel, published in November 2024, introducing the on-premises gateway.
Fortra Secure Email Gateway
A 1:26 product video from November 2024 introducing the on-premises gateway and its inbound and outbound protection.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Bounced emails stop business. Fortra Secure Email Gateway redacts the breach instead.
Here’s what genuinely sets it apart — and exactly where it stops.
Redaction instead of a bounced email
Most gateways can only stop a message that breaks a data rule, and the business stops with it. Adaptive Redaction removes just the offending part, a card number in the body or a customer list in a screenshot read by OCR, and delivers the rest, so outbound DLP stops being a fight with users.
Mail stays on infrastructure you pick
This is software, not a shared cloud filter: run it on your own servers, a VMware or Hyper-V private cloud, or your own Azure or AWS tenancy. For an Indian bank, insurer or public body that must keep mail in the country, that settles the residency question most cloud filters leave open.
Inspection that opens everything
The Deep Content Inspection engine types each file by signature rather than extension, unpacks archives and embedded objects, and logs what it removed. Several AV engines, Active Code stripping and an optional Sophos sandbox sit on top, and risky links can be rewritten to Garrison or Ericom isolation.
Where it stops
Impersonation is not its focus; Fortra pitches its cloud product for BEC. You run the RHEL servers, patch windows and capacity. No price or licence meter is published. Teams and Slack are out of scope, and the optional Sophos cloud sandbox detonates files off-site, so check what leaves your network.
The numbers behind the platform
What your Fortra Secure Email Gateway rollout looks like
Size mail and policy
Count mailboxes and daily volume, and list which data must never leave by mail: PAN, Aadhaar, card numbers, drawings.
Choose where it runs
Pick the host (your hardware, VMware or Hyper-V, or your own Azure or AWS tenancy) and confirm the RHEL build for it.
Run in monitor mode
Route a pilot domain through it, log what Adaptive Redaction would remove, and tune the rules before anything is blocked.
Turn on enforcement
Switch on redaction, sanitisation and encryption by group, keep logs 180 days for CERT-In, and add Cryoserver if needed.
Settle the licence
Agree the meter, the support term and any Exchange or ICAP gateway, then get the quote in INR with GST through TechBag.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Account numbers used to bounce whole emails back to staff. Now the number is redacted and the mail still goes out.”
“Hosting it on our own VMware cluster settled the data-location question our auditors kept raising about outbound mail.”
“OCR catching patient details inside scanned referral letters was the feature that won over our compliance team.”
“Excellent on outbound control, but CEO-fraud mail still needed another layer; this gateway is not built for impersonation.”
“Patching the RHEL servers is our job, so plan admin time; Fortra handled the installation and upgrades as promised.”
“Price lists with tracked changes kept leaking old discounts; sanitisation now strips revision history before files leave.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the secure email gateway market — tap any vendor to see why it sits where it does.
TechBag Email Gateway Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Quote-only; self-hosted; ex-Clearswift lineage.
Outbound Data Control × Hosting Freedom
The grid nobody publishes — how much a gateway can do to outbound content (DLP, redaction, encryption) vs how freely you can choose where it runs.
OCR redaction, sanitisation, six encryption methods; host it anywhere.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Fortra Secure Email Gateway vs the on-premises gateway field
Against FortiMail, Forcepoint, Proofpoint, Barracuda and Kaspersky — on form factor, malware, outbound DLP, redaction, encryption, BEC, price and where your mail is processed.
| Dimension | Fortra Secure Email Gateway | Fortinet FortiMail | Forcepoint Email Security | Proofpoint Email Protection | Barracuda Email Protection | Kaspersky Security for Mail Server |
|---|---|---|---|---|---|---|
| What it is | Self-hosted gateway | Fortinet’s mail gateway | Threat + data gateway | Proofpoint’s flagship | Tiered gateway suite | Mail-server security |
| Form factor | Software, host anywhere | Box, VM or cloud | Cloud, on-prem, hybrid | Cloud; legacy appliance | Cloud or appliance | On the mail server |
| Mail systems fronted | Mail-system agnostic | M365, Google, on-prem | In front of M365, Google | Any MX target | Any mail server | Exchange-centred |
| Malware and sandbox | Multi-AV + sandbox | FortiGuard + sandbox | Not detailed | Threat-intel depth | ATP sandboxing | Engine; KATA extra |
| Outbound DLP | Adaptive DLP | Outbound DLP | Forcepoint DLP inside | Separate DLP SKU | Higher tiers | Basic |
| Redaction and sanitising | OCR redaction | Block or encrypt | Block, encrypt, coach | Not documented | Not documented | Not documented |
| Encryption | Six methods | Built-in encryption | Automatic encryption | Ask Proofpoint | Policy-driven | Not documented |
| BEC and impersonation | Basic; cloud for BEC | BEC detection | BEC defence | Behavioural AI | API impersonation layer | Basic |
| Same-vendor add-ons | Archive, ICAP, cloud | Security Fabric | DLP and DSPM | Broad add-on suite | IR, DMARC, training | KATA and web gateway |
| Pricing model | Quote, meter unstated | Appliance or per user | Per user, quoted | Per user, in tiers | Per user, in tiers | Per mailbox, quoted |
| Published entry price | Not published | Not published | Not published | No current list | No list on its site | Not published |
| India data location | Wherever you host it | Appliance on-site | On-prem option | India DC (2025) | Appliance option | On-prem; caveats |
| Lock-in and exit | Policies to rebuild | Fabric ties | DLP policy coupling | MX plus add-ons | Tier bundling | Light to replace |
| Best fit | Regulated, outbound DLP | Fortinet estates | Forcepoint DLP estates | Large enterprises | Mid-market bundles | Kaspersky estates |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Fortra Secure Email Gateway if…
- ✓Mail must be processed on servers or a cloud tenancy you control, in India if you choose
- ✓Outbound data loss is your bigger email risk and blocking whole messages hurts the business
- ✓You want redaction, sanitisation and several encryption methods in one gateway you can audit
Compare alternatives if…
- ✓You want a per-user model with tiers — Barracuda and Proofpoint Essentials sell that way via partners
- ✓You already run Fortinet or Forcepoint — FortiMail and Forcepoint Email Security plug into what you own
- ✓BEC is the main worry — add an API layer, or look at Proofpoint or Barracuda’s impersonation tools
Do not expect…
- ✓Behavioural BEC detection — Fortra sells that in its cloud product
- ✓A service you never patch — the RHEL servers are yours to run
- ✓Teams, Slack or shared-drive coverage
Fortra Secure Email Gateway is one of 36 email security products TechBag carries. The Email Security guide narrows them to a shortlist and shows the reasoning. →
What does outbound mail control cost you by hand?
Drag the sliders (mailboxes; IT-hour cost). Estimates model the IT time spent releasing wrongly blocked outbound mail, cleaning metadata by hand and answering data-handling queries, at an assumed 4 hours per mailbox a year, with 70% of it removed by redaction and sanitisation. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote only. Fortra publishes no price for the Secure Email Gateway, its Exchange and ICAP sister gateways or the Cryoserver archive, and no INR list. It does not state whether the gateway is licensed per mailbox, per server or by mail volume. TechBag sizes the host and mail volume, settles the meter and support term with Fortra, and gets the quote itemised in INR with GST.
Secure Email Gateway
Best for outbound control on your own hosts
- Quoted per deployment; meter unstated
- Redaction, sanitising, six encryption ways
- Your hardware, VMware, Hyper-V, Azure, AWS
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ Exchange, ICAP or archive
Best when internal mail or file flows need it
- Exchange Gateway for internal mail
- ICAP Gateway for proxies and MFT
- Cryoserver for audited archiving
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Is the gateway licensed per mailbox, per server or by mail volume, and are the Exchange and ICAP gateways priced apart?
Does Adaptive DLP ship detectors for PAN, Aadhaar and GSTIN numbers, or will we write and test those patterns ourselves?
Which lookups leave our network? The optional Sophos cloud sandbox detonates files off-site; confirm where it runs.
Which RHEL versions and hypervisors are supported today, and who patches the OS between Fortra’s product upgrades?
The gateway is not pitched at impersonation. What covers CEO-fraud mail: Fortra’s cloud product, Microsoft or another layer?
Can message logs be kept 180 days and exported to our SIEM, so CERT-In requests are answered from our own records?
Which method will outside recipients get (S/MIME, PGP, ZIP or the portal), and how do they reply to us securely?
What term, sizing and support level does the quote cover? Ask TechBag for it in INR with GST, sister gateways listed apart.
Questions buyers ask
Ready to evaluate Fortra Secure Email Gateway?
Size your mail volume and choose a host, or let a TechBag advisor settle the licence meter, Indian identifier detection and sister gateways with Fortra and get the quote itemised in INR.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.