- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
SafeSquid Secure Web Gateway
Your internet access has to pass through a proxy. It shouldn’t have to be someone else’s cloud — SafeSquid Secure Web Gateway is an Indian-built proxy you run on your own Linux server, VM or cloud instance — TLS inspection, identity rules and DLP, with every log on a disk you place.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The SafeSquid platform family
This page covers SafeSquid Secure Web Gateway — SafeSquid’s one product, with its add-ons.
Quick facts
30-second orientation- Product
- Self-hosted HTTP/1.1 application proxy for web filtering, TLS inspection, malware scanning and DLP
- Maker
- Office Efficiencies (INDIA) Private Limited, through its strategic business unit SafeSquid Labs
- Company
- Incorporated 14 September 2004, Mumbai-registered per company records; on sale since at least 2007
- Status
- Actively maintained: build 2026.0904 shipped on 4 September 2026; appliance ISO refreshed in August
- Price
- No current list; commercial terms are quoted. An archived August 2024 page said under US$9 per user a year
- Licence
- Free tier with no time limit; annual commercial plan by named users, concurrent connections or CPU hours
- Deploy
- Appliance Builder ISO for x86_64 servers or VMs, a cloud image for AWS, Azure, GCP or DigitalOcean, or a tarball
- Sizing
- Vendor guidance: 400 concurrent connections on 4 cores and 8 GB, up to 8,000 on 64 cores and 128 GB
- India
- Self-hosted, so traffic and logs stay on servers you place; SafeSquid runs no PoPs and no hosted resolver
- In India via
- TechBag — sizing, licence basis, quote in INR with GST, and a pilot behind one office
Understand self-hosted web gateways before you buy one
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is a self-hosted web gateway?
A proxy you run yourself that every browser goes through, so web traffic can be decrypted, filtered and logged on your side.
A bare proxy box with IP lists vs a self-hosted inspecting gateway — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A bare proxy box with IP lists | SafeSquid Secure Web Gateway |
|---|---|---|
| HTTPS traffic | Passed through unread, or hand-configured | Intercepted or tunnelled per rule, TLS 1.0–1.3 |
| Who gets what | IP address lists in a config file | Users and groups from AD, LDAP or Kerberos |
| Sensitive uploads | Nothing reads them on the way out | DLP add-on reading text, images and Office files |
| Log history | Rotated away when the disk fills | 30 days local by default, forwarded for longer |
| A second gateway | A copy kept in step by hand | A cluster that syncs policy and certificates |
| What it is NOT | — | A cloud service, a roaming agent or a CASB |
The cheapest test is the free licence: build one gateway on a spare VM, send a single team through it for two weeks, and read the logs.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Proxy
An SMP-aware proxy on x86_64 Linux takes each request in explicit, transparent, reverse, proxy-chain, TCP-proxy or WCCP mode and applies your policy before it goes upstream.
Inspection
A rule either tunnels a CONNECT request or intercepts its TLS; then SqScan, ClamAV, external parsers or an ICAP server examine content, and DLP analysers read what leaves.
DNS
DNSBL lookups, homograph detection, GeoIP rules and DNS-tunnelling checks run inside the gateway, and its bundled BIND can sit in your clients’ resolution path if you choose.
Portal
The cloud-linked portal issues activation keys, custom categories, roaming VPN settings and policy backups; where SafeSquid hosts it is not documented, so ask if residency matters.
A proxy daemon on a Linux server you own — TLS, content and DNS checks inline, with a portal for keys and categories.
Nine capabilities. Control, inspect, operate.
SafeSquid is a web proxy you host yourself, so the traffic and the logs never leave your control.
Rules by who, where and when
Policy keys on user, group, source network, destination, time of day, application and transfer size, all in one rule set.
Directory-backed identity
Users authenticate locally or through PAM, LDAP or Active Directory, with Kerberos single sign-on for domain-joined PCs.
Safer search and video
Application signatures, login controls and social-media limits work beside enforced SafeSearch and YouTube restrictions.
Encrypted sessions opened by rule
Each CONNECT is tunnelled or intercepted by policy across TLS 1.0 to 1.3; a 2026 build moved to OpenSSL 3.5+ for post-quantum work.
Several scanners in line
The built-in SqScan engine, ClamAV, external parsers and any ICAP server you run can examine a download before the browser gets it.
Uploads read for data
Text and image analysers, true-MIME fingerprints and archive explosion; regex now reaches Office files, OCR is in beta. A paid add-on.
Fits the network you have
Explicit, transparent, reverse, proxy-chain, TCP-proxy and WCCP modes; WCCP itself is one of the premium feature subscriptions.
Gateways that share policy
Active-active or active-standby clusters keep policy, categories and certificates in step across the gateways you operate.
Open-format records
SIEM-ready logs are kept 30 days on local disk by default; send them to syslog, a SIEM, S3 or Azure Blob to hold them longer.
Watch SafeSquid SWG in action
Building a gateway from the Appliance Builder ISO, plus two dated demos of SafeSearch enforcement and an earlier release.
How To Setup Your Secure Web Gateway With SafeSquid Appliance Builder
Building a gateway from the Appliance Builder ISO, the install route SafeSquid recommends today.
Web Filter- How To Enforce SafeSearch for Google, Yahoo, Bing at Internet Gateway
A 2012 demo of forcing SafeSearch at the gateway, shown in the old interface of an earlier release.
Safesquid SWG Pre-Release Walk Through
A 2014 walk-through of an earlier release, from when the product took the SafeSquid SWG name.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Cloud gateways keep your traffic in their PoPs. SafeSquid runs on servers you place.
Here’s what genuinely sets it apart — and exactly where it stops.
A gateway you own, built in India
SafeSquid Labs builds it in India, and it runs only on servers you control. CERT-In’s guidelines for government bodies ask that clients reach the internet through a proxy; here the proxy, its decrypted traffic and its logs all stay on hardware you place, in India if you put it there.
Start on the free tier, pay when categories matter
Register for a key, install the Appliance Builder ISO and you have a proxy with HTTPS inspection and custom policy on a licence with no time limit. The commercial plan adds the URL categorisation database, real-time threat feeds, 365-day cloud backup and email support.
Fits the network and directory already there
It runs as an explicit, transparent, reverse or chained proxy, a TCP proxy or over WCCP, so it slots in behind an existing firewall. Users come from Active Directory, LDAP or PAM with Kerberos sign-on, and ICAP, SNMP and a REST interface connect it to the tools you run.
Where it stops
No cloud service and no roaming agent: remote users return over a VPN, with a paid add-on for Windows laptops only. There is no CASB, no price list today and no named customer. Free-tier category rules match nothing, and you size, patch and harden every server yourself.
The numbers behind the platform
What your SafeSquid SWG rollout looks like
Count connections, size servers
Estimate peak concurrent connections per office and match them to SafeSquid’s sizing rows, from 400 up to 8,000 a server.
Build a free-licence lab
Register for an activation key, install the Appliance Builder ISO on a VM, change any default password and set the CA.
Pilot one office through it
Point one office at the proxy, join it to Active Directory, turn on TLS interception and record every bypass you need.
Subscribe and add a second node
Pick named users, connections or CPU hours, activate categories and threat feeds, then cluster a second gateway.
Settle logs and remote users
Forward logs to your SIEM or storage for 180 days, and decide how remote staff return: WireGuard or the Roaming add-on.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We proved the whole design on the free licence first, then found category rules did nothing until the subscription was active.”
“Kerberos sign-on meant users never saw a login prompt, and the rules finally named people instead of IP ranges.”
“The inspection team wanted web logs on our own servers for 180 days. We forwarded them to the SIEM and that closed the point.”
“An Appliance Builder install on a spare server took an afternoon, most of it spent pushing our interception certificate to PCs.”
“DLP flagged spreadsheets with account numbers going to personal mail sites. We had to buy it as an add-on, but it earned its place.”
“Sales staff on Macs get nothing off-site; the roaming add-on is for Windows laptops only, so plan remote cover separately.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the self-hosted secure web gateway market — tap any vendor to see why it sits where it does.
TechBag Secure Web & DNS Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Small Indian vendor; several builds in 2026.
Ease of Starting × Inspection Depth
The grid nobody publishes — how easily you can start (free tier, self-serve download, public price) vs how deeply the gateway inspects web traffic.
Free tier, self-serve download; TLS, DLP add-on, no CASB.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
SafeSquid SWG vs the self-hosted web gateway field
Against Fortinet FortiProxy, Skyhigh SWG On-Prem, Symantec Edge SWG, Kaspersky Web Traffic Security and Zscaler Internet Access — on deployment, TLS, remote users, price, add-ons, scale, patching and India.
| Dimension | SafeSquid Secure Web Gateway | Fortinet FortiProxy | Skyhigh Secure Web Gateway On-Prem | Symantec Edge SWG | Kaspersky Web Traffic Security | Zscaler Internet Access |
|---|---|---|---|---|---|---|
| What it is | Indian self-hosted proxy | Fortinet’s on-site proxy | Formerly McAfee gateway | ProxySG, renamed | Proxy + ICAP gateway | Cloud-only proxy |
| Deployment | ISO, image or tarball | Appliance or yearly VM | E/F boxes or a VM | Box, VA or private cloud | VM image or DEB | Nothing to install |
| TLS inspection | TLS 1.0–1.3, by rule | Full, hardware offload | Full, 4096-bit RSA | Full, SSL offload | Full, four modes | Full, in Zscaler’s cloud |
| Off-network users | VPN back; Windows add-on | No client | Only with cloud SWG | Via Cloud SWG | No roaming agent | Client Connector |
| Cloud and hybrid | Your nodes, synced | FortiSASE sold apart | 12.2 yes, 13.0 not yet | Universal Policy | No cloud side | The cloud is the policy |
| Cloud app control | Inline app control | Inline CASB | Inline only | Inline; CloudSOC for API | No CASB | Inline and API |
| Threat protection | SqScan, ClamAV, ICAP | AV, IPS, sandbox bundled | DLP in, sandbox extra | Content Analysis | Malware, phishing, files | Sandbox, DLP, RBI |
| Pricing model | Annual, three bases | Box + 500-seat lots | Per user, partner-led | Per user, boxes extra | Per user, banded | Per user, by edition |
| Published entry price | Free tier; then quote | Not published | Not published | Quote; UK MSRP £56.25 | Not published | ~$6–12/user/month |
| Included vs add-on | DLP, roaming extra | DLP, RBI optional | Anti-malware extra | Suite in, hardware out | In Total Security | Editions add depth |
| Hardware and scale | 400–8,000 connections | 6,000–60,000 users | Sized by appliance | Sized by S210/S410 | 20 nodes, 757 Mbps | 500B+ transactions/day |
| Lifecycle and patching | Several 2026 builds | Exploited admin flaws | Dated EOLs | 7.3 ends ~Dec 2026 | Supported to Sept 2027 | Nothing to patch |
| India and logs | Your servers, 30 days | On your hardware | Your site, India logs | Your racks; Indian PoPs | Your servers; KSN out | Four Indian cities |
| Best fit | Proxy-mandated offices | Fortinet-standard sites | Ex-McAfee estates | ProxySG estates | Kaspersky estates | No proxy boxes at all |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose SafeSquid SWG if…
- ✓Internet access must run through a proxy you own, with decrypted traffic and logs on servers you place in India
- ✓You want to prove the design on a free licence with no time limit before any quote is signed
- ✓Your team can run, size and patch a Linux gateway, and users are mostly on the office network
Compare alternatives if…
- ✓Most staff work away from any office — Zscaler Internet Access covers them without a VPN back
- ✓You need API scanning of SaaS or a CASB — Symantec Edge SWG with CloudSOC or Skyhigh’s suites go further
- ✓You want a dated support runway on a self-hosted proxy — Kaspersky commits KWTS 6.2 to full support until September 2027
Do not expect…
- ✓A SafeSquid cloud service, Indian PoPs or a hosted DNS resolver — you run every node
- ✓A roaming agent for macOS or mobile; the Roaming add-on is a VPN for Windows laptops
- ✓URL category rules that work on the free tier, or a public price list today
SafeSquid Secure Web Gateway is one of 44 secure web & DNS products TechBag carries. The Secure Web & DNS guide narrows them to a shortlist and shows the reasoning. →
What does a hand-run proxy cost you?
Drag the sliders (users behind the gateway; admin-hour cost). Estimates model administrator time spent on hand-edited proxy rules, unblock requests and log pulls at an assumed 1.5 hours per user a year, with 70% of it removed by identity-based policy and searchable logs. Both figures are assumptions. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Not published: SafeSquid’s pricing page now returns 404, and commercial subscriptions are quoted yearly by named users, concurrent connections or CPU hours, paid by PayPal or wire. An archived August 2024 page put commercial use under US$9 per user a year — history, not today’s price. A free licence with no time limit runs the proxy without URL categories or threat feeds. TechBag quotes in INR with GST.
Free licence
Best for labs and proving the design
- No time limit; proxy, TLS inspection, custom policy
- No URL categorisation database or live threat feeds
- Activation key from key.safesquid.com
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
Commercial subscription
Best for production gateways
- Annual: named users, connections or CPU hours
- Adds categories, threat feeds, 365-day cloud backup
- DLP, Roaming, Log Aggregator and WCCP extra
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
What is your peak count of concurrent connections, and which row of SafeSquid’s sizing guide does each server meet?
Will the quote count named users, concurrent connections or CPU hours, and which fits how your offices browse?
Do you need URL categories and live threat feeds? The free tier has neither, so category rules match nothing.
Are DLP, Roaming, Log Aggregator and WCCP itemised in the quote, or will you discover them as extras later?
How do staff off the network come back: WireGuard, or the Windows-only Roaming add-on? Nothing is documented for macOS or phones.
Where will 180 days of logs live for CERT-In: a bigger local disk, your SIEM, or S3 or Azure Blob in an Indian region?
Has the cloud image’s default administrator password been changed, and who patches the Linux host and kernel?
Activation, categories and policy backups go through SafeSquid’s portal, whose hosting is undocumented. Is that acceptable?
Questions buyers ask
Ready to evaluate SafeSquid SWG?
Model your users and admin time first, or let a TechBag advisor size the servers and scope a pilot that sends one office through the gateway.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.