Secure every web request.
On your own infrastructure.

A secure web gateway (SWG) sits between your users and the internet and decides what web traffic is allowed. In plain terms, it's how an organisation filters and controls internet access — blocking malicious, phishing and unwanted sites, allowing or denying websites by URL or category, and inspecting HTTPS. EnforceGate vX is a self-hosted secure web gateway: it does all of that on your own network, with no cloud.

Route your users' web traffic through EnforceGate and define a policy of what to allow or block — by domain, URL, category (adult content, gambling, social media, malware and more), or by user, group and IP. It filters every request on-box and can block, warn or redirect to a captive portal, and plain-text policies reload live so you can change what's blocked without downtime. It's a self-hosted way to filter employee or student internet access without a cloud service.

Yes — and being open to outside intelligence is a genuine difference from the big vendors. Cloud secure web gateways from the likes of Cisco, Palo Alto Networks and Zscaler are built around their category database and their cloud: you largely enforce the taxonomy they ship, decisions run through their service, and folding in large external feeds or your own intelligence is limited to what the platform chooses to allow.

EnforceGate is open by design. An optional, sandboxed toolbox sidecar ships a real scripting environment — bash, Python 3, curl, git, jq and pip — so you can pull any source on a schedule: the free UT1 category corpus, abuse.ch's ThreatFox and URLhaus threat feeds, a commercial feed you already subscribe to, or your own internal lists. A short script converts each source into an on-box list and reloads the engine live — and matching stays entirely local, with no per-request cloud lookup.

This works on every edition, including free Lite. Prefer not to assemble your own? Pro and Enterprise also bundle the Exosys Curated Domain Lists — 60+ AI-classified categories — but you're always free to add, replace or blend in your own sources.

Nowhere external. EnforceGate runs entirely inside your perimeter as a container or virtual appliance — traffic, policies and logs stay on your infrastructure. There is no cloud backhaul and no vendor telemetry on inspected traffic.

Squid is part of what we ship — but turning a bare proxy into a managed web gateway is the hard part, and the open-source add-ons people used to reach for to do it are largely unmaintained today. EnforceGate is the maintained, supported layer on top: a verdict engine that matches up to ~150 million rules in memory, the interactive Cisco IOS / Juniper Junos-style CLI and scriptable command-line tooling, a category-list workflow, signed and integrity-checked images, and a Swiss engineer to call. You get a product that stays current — not a pile of cron jobs and abandoned plugins to maintain. And because the gateway is built on Squid, you also get its caching: frequently-requested content is served straight from the on-box cache instead of being re-fetched, which can improve page-load times for your users. (If you're replacing the dead SquidGuard layer specifically, see our SquidGuard alternative page.)

Three editions — Lite, Pro and Enterprise. Lite is free for a single instance and available now through Early Access. Pro (for MSPs and growing teams) and Enterprise (for large or regulated fleets) are in development — join the waitlist to hear when they ship. There's no per-byte, per-user or per-endpoint metering: Lite is free, and Pro will be priced per instance.