Secure every web request.
On your own infrastructure.

Yes: 30 days of Pro, free. A card is required to start, but you are not charged until the trial ends and cancelling anytime during the trial costs nothing. Checkout is hosted by Stripe, your account is provisioned automatically, and you get an e-mail to set your password and download the verified images. When a trial ends without a subscription, EnforceGate keeps running and keeps enforcing your policy; it simply drops to a reduced level, limited to 10 connector sessions and without the curated domain lists. Nothing is deleted, and subscribing restores full capacity automatically on the same serial, with no reinstall. See what happens when a licence expires.

A secure web gateway (SWG) sits between your users and the internet and decides what web traffic is allowed. In plain terms, it's how an organisation filters and controls internet access: blocking malicious, phishing and unwanted sites, allowing or denying websites by URL or category, and inspecting HTTPS. EnforceGate vX is a self-hosted secure web gateway: it does all of that on your own network, with no cloud.

EnforceGate includes a built-in proxy that decides whether to allow every request. Clients are pointed at that proxy rather than having their traffic silently intercepted: you add its address to the usual proxy settings, whether that is a PAC or WPAD file, your browser, your operating system, or group policy.

That covers anything that speaks HTTP through a proxy, not only workstations and laptops: printers, appliances and servers, which you can restrict to the destinations they legitimately need such as package mirrors and vendor update endpoints. Used that way it acts as an HTTP firewall for outbound web traffic.

You then define a policy of what to allow or block: by domain, URL, category (adult content, gambling, social media, malware and more), or by user, group and IP. Every request is decided on-box and can be blocked, warned or redirected to a captive portal, and plain-text policies reload live so you can change what's blocked without downtime. It's a self-hosted way to filter employee or student internet access, and to control whats your servers and devices may reach, without a cloud service.

Yes, and being open to outside intelligence is a genuine difference from the big vendors. Cloud secure web gateways from the likes of Cisco, Palo Alto Networks and Zscaler are built around their category database and their cloud: you largely enforce the taxonomy they ship, decisions run through their service, and folding in large external feeds or your own intelligence is limited to what the platform chooses to allow.

EnforceGate is open by design. An optional, sandboxed toolbox sidecar ships a real scripting environment (bash, Python 3, curl, git, jq and pip), so you can pull any source on a schedule: the free UT1 category corpus, abuse.ch's ThreatFox and URLhaus threat feeds, a commercial feed you already subscribe to, or your own internal lists. A short script converts each source into an on-box list and reloads the engine live, and matching stays entirely local, with no per-request cloud lookup.

This works on every edition. Prefer not to assemble your own? The Pro, Business and Enterprise editions also bundle the Exosys Curated Domain Lists (59 AI-classified categories), but you can always add, replace or blend in your own sources.

Nowhere external. EnforceGate runs entirely inside your perimeter as a container or virtual appliance; traffic, policies and logs stay on your infrastructure. There is no cloud backhaul and no vendor telemetry on inspected traffic.

Squid is part of what we ship, but turning a bare proxy into a managed web gateway is the hard part, and the open-source add-ons people used to reach for to do it are largely unmaintained today. EnforceGate is the maintained, supported layer on top: a verdict engine that matches up to ~150 million rules in memory, the interactive Cisco IOS / Juniper Junos-style CLI and scriptable command-line tooling, a category-list workflow, signed and integrity-checked images, and a Swiss engineer to call. You get a product that stays current, not a pile of cron jobs and abandoned plugins to maintain. And because the gateway is built on Squid, you also get its caching: frequently-requested content is served straight from the on-box cache instead of being re-fetched, which can improve page-load times for your users. (If you're replacing the dead SquidGuard layer specifically, see our SquidGuard alternative page.)

Per instance, per year, with no per-byte, per-user or per-endpoint metering. Three editions, Pro, Business and Enterprise, differ by the capabilities they unlock and the connector sessions they bundle. Pro is available today; the Business and Enterprise editions are in development. See the editions table for what each one includes and what it costs.