Frequently asked questions

A secure web gateway (SWG) sits between your users and the internet and decides what web traffic is allowed. In plain terms, it's how an organisation filters and controls internet access — blocking malicious, phishing and unwanted sites, allowing or denying websites by URL or category, and inspecting HTTPS. EnforceGate vX is a self-hosted secure web gateway: it does all of that on your own network, with no cloud.

Route your users' web traffic through EnforceGate and define a policy of what to allow or block — by domain, URL, category (adult content, gambling, social media, malware and more), or by user, group and IP. It filters every request on-box and can block, warn or redirect to a captive portal, and plain-text policies reload live so you can change what's blocked without downtime. It's a self-hosted way to filter employee or student internet access without a cloud service.

Yes. A category is simply a domain or URL list a policy points at — adult content, gambling, hacking tools, social media, or any other grouping you define. Source them from community-maintained lists our documentation points to, or any public blocklist you prefer, and community scripts fetch, convert and refresh them into the engine's local .policy lists. On Pro and Enterprise (planned), the Exosys Curated Domain Lists add 60+ ready-made categories, classified with state-of-the-art AI — downloaded once at install and fully offline, refreshed several times a day on our side, with optional incremental updates from a CDN. Either way, matching stays on-box with no cloud category service and no per-request lookup, and the ~150-million-rule capacity is large enough to load full category sets. Because every rule is matched in memory, adding more categories or domains costs memory, not speed — the per-request decision time stays essentially constant (about two-tenths of a microsecond) as the rule set grows, so there's no performance penalty for filtering on more categories. You decide which categories to enforce and how current they are — Exosys doesn't impose a fixed taxonomy.

Yes — and being open to outside intelligence is a genuine difference from the big vendors. Cloud secure web gateways from the likes of Cisco, Palo Alto Networks and Zscaler are built around their category database and their cloud: you largely enforce the taxonomy they ship, decisions run through their service, and folding in large external feeds or your own intelligence is limited to what the platform chooses to allow.

EnforceGate is open by design. An optional, sandboxed toolbox sidecar ships a real scripting environment — bash, Python 3, curl, git, jq and pip — so you can pull any source on a schedule: the free UT1 category corpus, abuse.ch's ThreatFox and URLhaus threat feeds, a commercial feed you already subscribe to, or your own internal lists. A short script converts each source into an on-box list and reloads the engine live — and matching stays entirely local, with no per-request cloud lookup.

This works on every edition, including free Lite. Prefer not to assemble your own? Pro and Enterprise also bundle the Exosys Curated Domain Lists — 60+ AI-classified categories — but you're always free to add, replace or blend in your own sources.

Yes — it's not only for user web access. Deploy it as an outbound HTTP/HTTPS egress filter in a DMZ or data-centre segment and route your servers' outbound web traffic through it. Whitelist only the destinations each server legitimately needs — package mirrors (apt, yum, npm, PyPI), OS and software update endpoints, and licensing or telemetry — and deny everything else by default. A compromised or misconfigured server then can't reach an attacker's endpoint, which shrinks the attack surface and blocks data exfiltration and command-and-control callbacks. Because policies are plain-text and git-backed, the allowlist stays auditable and reviewable like any other change.

Nowhere external. EnforceGate runs entirely inside your perimeter as a container or virtual appliance — traffic, policies and logs stay on your infrastructure. There is no cloud backhaul and no vendor telemetry on inspected traffic.

Inspection ships disabled by default. peek reads only the SNI; bump performs full decryption and requires an explicit, audited acknowledgement before it will start. Whether decryption is lawful depends on your jurisdiction and the notice or consent you provide — you remain responsible for that determination. In bump mode you also distribute the inspection CA to client trust stores, and certificate-pinned applications — many banking and mobile apps, and some SaaS — can't be decrypted and need explicit bypass rules.

Yes — that's what the TLS connector is for. It's a TLS proxy that performs the same SSL/TLS decryption (SSL bump) as Squid, but caches nothing. Its job is visibility: an optional tap duplicates the decrypted HTTP traffic as clear text onto an Ethernet interface, so out-of-band security tools — an IDS, a DLP system or a traffic monitor — can listen to it. They can then spot data exfiltration, malware and command-and-control (C2) traffic that would otherwise be hidden inside HTTPS, and run precise protocol analytics. Because the tap only mirrors traffic out-of-band, it never sits in the request path — no added latency, no dropped connections. The TLS connector is available on Pro and Enterprise.

Three ways, to match how your team works.

Scripted, system-administrator style — drive the engine non-interactively with the egctl utility and clear, self-describing verbs (show-version, show-policy-list, request-policy-reload), ideal for shell scripts, cron and CI.

Interactive, network-engineer style — a modal CLI that blends Cisco IOS and Juniper Junos: add, set, edit, remove, comment and annotate policies, validate them, and roll a change back, all without leaving the session. Staged edit → commit → rollback will feel familiar to anyone who runs Junos.

REST Client API (coming soon) — integrate EnforceGate with your own tooling and automation.

In every case the underlying policy configuration is backed by git, so every change is versioned, easy to back up, and simple to diff or audit.

Yes. The captive portal — the page a user lands on when a request is blocked, warned, or needs an acceptable-use acknowledgement — is a self-contained Python application, not a locked binary. The one that ships with free Lite is fully yours to adapt: rebrand it, rewrite the copy, add your logo and a helpdesk contact, change the flow, or extend the localisation (it ships in English, French, German and Italian). We're releasing that portal as open-source software under the Apache 2.0 licence, soon — so you'll be able to fork it, contribute upstream, and build on it freely. Pro and Enterprise ship a more capable proprietary captive portal with additional features on top (for example, the AI assistant that answers users' "why was this blocked?" questions on Enterprise).

The engine loads and matches up to ~150 million rules entirely in memory, with every request evaluated locally — no cloud lookup. In our in-house benchmark, 150 million rules ran in under 5 GiB with common-case decisions in about 0.2 µs — and that decision time stayed flat as the rule set grew from 50M to 150M, so adding rules adds memory, not delay (see the performance white paper). You scale out, or run high availability, by adding engines — planned for Pro and Enterprise editions. Cost follows your deployment footprint, not traffic or rule count, so growth stays predictable.

Minutes. Download the signed Docker bundle, verify it, run the guided installer, and point your clients at the proxy. Prefer a VM? The turnkey virtual appliance ships as ready-to-import images in OVA, QCOW2, VHDX and VMDK formats for VMware, KVM and Hyper-V. Either way, the engine self-initialises its keys, certificates and a default policy on first boot.

Upgrades are in-place and seamless — typically 1–2 minutes end to end, with under a minute of service interruption while the new components start. Your configuration, license activation, policy history and audit log are preserved across upgrades, including yearly release transitions. On the virtual appliance the host operating system updates continuously as atomic, rollback-capable snapshots, so the OS underneath is always current — only the EnforceGate components are swapped at upgrade time. Docker deployments simply pull the new image versions.

It depends on the edition. Lite (free) has no licence validation and no expiry — it runs indefinitely with no connectivity to Exosys. Pro and Enterprise activate once per validity period (yearly): the engine validates its licence against the Exosys Control Server at activation, then caches it, so it runs the rest of the year with no ongoing connectivity. The Exosys Curated Domain Lists work the same way: downloaded once at install and fully usable offline, with incremental updates only if you opt in. For air-gapped or restricted networks, we provide an offline-activation procedure for Pro and Enterprise editions.

Three editions — Lite, Pro and Enterprise. Lite is free for a single instance and available now through Early Access. Pro (for MSPs and growing teams) and Enterprise (for large or regulated fleets) are in development — join the waitlist to hear when they ship. There's no per-byte, per-user or per-endpoint metering: Lite is free, and Pro will be priced per instance.

Squid is part of what we ship — but turning a bare proxy into a managed web gateway is the hard part, and the open-source add-ons people used to reach for to do it are largely unmaintained today. EnforceGate is the maintained, supported layer on top: a verdict engine that matches up to ~150 million rules in memory, the interactive Cisco IOS / Juniper Junos-style CLI and scriptable command-line tooling, a category-list workflow, signed and integrity-checked images, and a Swiss engineer to call. You get a product that stays current — not a pile of cron jobs and abandoned plugins to maintain. And because the gateway is built on Squid, you also get its caching: frequently-requested content is served straight from the on-box cache instead of being re-fetched, which can improve page-load times for your users. (If you're replacing the dead SquidGuard layer specifically, see our SquidGuard alternative page.)

Every licence includes Direct support — email and a support portal, triaged by an Exosys engineer who works on the product, not a community forum. Extended, a paid upgrade available on Pro, adds scheduled callbacks and priority engineering triage. Premium, included with Enterprise, adds a named engineering contact, special-release builds and rollout consultation.