Spam and virus filtering privacy ratings

Spam filters, email virus scanners and email security gateways, self-hosted and hosted.

19 spam and virus filtering are rated against 9 public criteria, and 19 have enough evidence for a letter grade. Our pick is SpamScanner. Of the 15 with a known jurisdiction, 9 are based in a Five Eyes country, and 13 in the wider Fourteen Eyes.

Open-source spam and virus filtering only · Criteria for this category · Suggest an addition · Markdown

Spam and virus filtering privacy ratings, sorted by pick and then by grade
Name	Grade	Score	Data	Jurisdiction	Open source	No trackers or telemetry	No ads or data sales	Independent audit	Transparency report	Tells users about requests	TLS configuration	Security headers	Modern web standards
SpamScanner Our pick Spam, phishing and malware scanner for email written in Node.js by the Forward Email team, used as a library or a command-line tool on your own server.	Grade B	80	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable
Amavis Self-hosted content filter written in Perl that sits between a mail server and scanners such as SpamAssassin and ClamAV, passing each message to them and acting on the results.	Grade B	80	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable
Apache SpamAssassin Self-hosted spam filter from the Apache Software Foundation that scores mail with rules, DNS blocklists and Bayesian filtering, used alongside mail servers such as Postfix.	Grade B	80	100%	United States Five Eyes	Yes	Yes	Yes	No	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable
MailScanner Self-hosted email security system written in Perl that scans mail for spam, viruses and phishing using SpamAssassin and antivirus engines, with Postfix, Sendmail and Exim.	Grade B	80	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable
Rspamd Self-hosted spam filtering system written in C and Lua that checks mail with rules, statistics, fuzzy hashes and DNS lists, and integrates with Postfix, Exim and other mail servers.	Grade B	80	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable
Proxmox Mail Gateway Self-hosted email gateway distribution from Proxmox that filters inbound and outbound mail for spam, viruses and phishing, managed through a web interface.	Grade C	65	100%	Austria Outside Eyes	Yes	Partial	Yes	No	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable
Microsoft Defender for Office 365 Email and collaboration security add-on for Microsoft 365 that scans mail, links and attachments for phishing and malware on top of Exchange Online Protection spam filtering. It also covers Teams, SharePoint and OneDrive.	Grade D	50	100%	United States Five Eyes	No	No	Yes	Partial	Yes	Yes	Yes	No	Not tested yet
Proofpoint Email Protection Secure email gateway for organizations that filters inbound and outbound mail for spam, phishing, malware and impersonation. It runs as a cloud service or on premises in front of Microsoft 365, Google Workspace or other mail servers.	Grade D	41	100%	United States Five Eyes	No	No	Partial	Partial	Partial	Yes	Yes	Partial	Not tested yet
DuoCircle Email services company whose products include cloud spam and phishing filtering, backup MX, email forwarding, outbound SMTP relay, and SPF and DMARC management.	Grade F	38	100%	United States Five Eyes	No	No	Partial	Partial	Partial	Yes	Yes	No	Not tested yet
Check Point Email Security Cloud email security service from Check Point, formerly Harmony Email & Collaboration and Avanan. It connects to Microsoft 365 and Google Workspace by API to filter phishing, malware and spam before messages reach the inbox.	Grade F	28	100%	Israel Outside Eyes	No	No	Partial	Partial	No	No	Yes	Partial	Not tested yet
N-able Mail Assure Cloud email security service sold to managed service providers that filters inbound and outbound mail for spam, phishing and malware, with email continuity and encrypted archiving. It works with Microsoft 365 and other mail servers.	Grade F	25	100%	United States Five Eyes	No	No	Partial	Partial	No	No	Yes	No	Not tested yet
Vade AI-based email filtering for Microsoft 365, Google Workspace, internet service providers and mail servers that blocks spam, phishing and malware. Vade merged with Hornetsecurity and is being folded into the Hornetsecurity brand.	Grade F	25	100%	France Nine Eyes	No	No	Partial	Partial	No	No	Yes	No	Not tested yet
SpamHero Hosted spam and virus filtering service for organizations with their own domain, set up by pointing MX records at it. It also offers outbound SMTP relay, quarantine, delivery logs and reseller controls for managed service providers.	Grade F	22	100%	United States Five Eyes	No	No	Partial	No	No	No	Yes	Partial	Not tested yet
Trustifi Cloud email security service that filters inbound phishing, impersonation and malware, and adds outbound encryption, data loss prevention and archiving for Microsoft 365, Google Workspace and other mail servers.	Grade F	22	100%	United States Five Eyes	No	No	Partial	No	No	No	Yes	Partial	Not tested yet
Libraesva Email security gateway from an Italian vendor, deployed on premises or in a private cloud, that filters spam, phishing and malware with local sandboxing and AI models. The company also sells email archiving, DMARC management and phishing training.	Grade F	20	100%	Italy Fourteen Eyes	No	No	Yes	No	Not applicable	Not applicable	Not applicable	Not applicable	Not applicable
Heimdal Email Security Cloud email filtering from Heimdal, a Danish security company, that blocks spam, phishing, malware and business email compromise, managed from the Heimdal dashboard alongside its endpoint security products.	Grade F	19	100%	Denmark Nine Eyes	No	No	Partial	No	No	No	Yes	No	Not tested yet
Mailinblack French cloud email security service that filters spam, phishing, ransomware and malicious links for business mailboxes, sold with a password manager and security awareness training.	Grade F	19	100%	France Nine Eyes	No	No	Partial	No	No	No	Yes	No	Not tested yet
OOPSpam Anti-spam API that scores form submissions, comments, sign-ups and messages for spam and fraud using machine learning, IP and email reputation checks. Plugins connect it to WordPress, form builders and other platforms.	Grade F	19	100%	United States Five Eyes	No	No	Yes	No	No	No	Partial	No	Not tested yet
Egress Cloud email security for Microsoft 365 and Google Workspace from Egress, a KnowBe4 company, covering inbound phishing detection, outbound data loss prevention and email encryption.	Grade F	16	100%	United Kingdom Five Eyes	No	No	Partial	No	No	No	Partial	Partial	Not tested yet

Questions

What is the most private option among spam and virus filtering?

Our pick is SpamScanner. Self-hosted spam, phishing and malware scanning for Node.js with no telemetry, built by the Forward Email team and used to filter Forward Email's mail.

How are spam and virus filtering rated?

Each entry answers 9 questions: open source, no trackers or telemetry, no ads or data sales, independent audit, transparency report, tells users about requests, TLS configuration, security headers and modern web standards. Answers need links to evidence. See the full criteria.

Does jurisdiction matter?

Jurisdiction decides which laws can compel a provider to hand over data. Each entry shows its country and whether it is in the Five, Nine or Fourteen Eyes. The data a provider can hand over depends mostly on what it stores and who holds the keys. Read about jurisdictions and the CLOUD Act.