- Home
- Security Awareness Training Software
- SentryMail
SentryMail
The operator’s registered office is Lindental 8d, 94032 Passau, Germany.
What it is
SentryMail is a self-hosted, open-core platform for planning and evaluating phishing-awareness simulations. Teams can schedule campaigns, choose HTML or Markdown templates, import .eml files, and set landing pages. Recipient-level tracking records opens, clicks, and form submissions; reports include campaign analytics, a dashboard risk score, and CSV export. Its Enterprise LMS supports self-hosted mandatory video courses, automatic course assignment for low awareness scores, quizzes, and audit-proof certificates. Integrations listed include LDAP, Microsoft Graph, SCIM 2.0, OIDC/SSO providers, and SMTP services. Enterprise adds SAML SSO, SIEM exports, and LMS xAPI export. Security features include Argon2id passwords, encrypted secrets, two-factor authentication, audit logging, and hardened containers. The maker says the product can run within customer infrastructure and supports pseudonymized reporting. Community is free; paid plans start at €10/user/yr, but require at least 25 employees. Business and Enterprise license purchases are marked as coming soon. Installation documentation specifies Docker Compose and Linux with Docker Engine.
For and against
For
- Tracks recipient opens, clicks, and form submissions.
- Includes campaign analytics, risk scoring, and CSV export.
- Enterprise LMS offers courses, quizzes, and certificates.
- Supports self-hosting and pseudonymized reporting.
- Community plan is free forever.
Against
- Paid plans require at least 25 employees.
- Business and Enterprise licenses are marked coming soon.
- Installation requires Linux with Docker Engine.
The verdict
SentryMail combines campaign tracking with training, reporting, and listed security controls in a self-hosted platform. Check the employee minimum and license availability before considering a paid plan.
Who it suits
SentryMail may suit organizations that want to run phishing simulations and awareness training on their own infrastructure. Its paid options are aimed at teams with at least 25 employees.
Plans and prices
Community
open-source core · self-hosting · GitHub community support
Read 15 Oct 2026 · sentrymail.de
Business (2,501+ employees)
tiered by employee count
Read 15 Oct 2026 · sentrymail.de
Business (1,001–2,500 employees)
tiered by employee count
Read 15 Oct 2026 · sentrymail.de
Business (501–1,000 employees)
tiered by employee count
Read 15 Oct 2026 · sentrymail.de
Enterprise (2,501+ employees)
Business plus 40% · white-label · SAML SSO · SIEM export
Read 15 Oct 2026 · sentrymail.de
Business (301–500 employees)
tiered by employee count
Read 15 Oct 2026 · sentrymail.de
Business (151–300 employees)
tiered by employee count
Read 15 Oct 2026 · sentrymail.de
Business (51–150 employees)
tiered by employee count · minimum 25 employees
Read 15 Oct 2026 · sentrymail.de
Business (25–50 employees)
minimum 25 employees · advanced simulations · reporting and analytics · email support
Read 15 Oct 2026 · sentrymail.de
On the record
- AI integration
- The AI feature accepts any OpenAI-compatible endpoint, including OpenAI, Azure, Mistral, Groq, OpenRouter, Ollama, vLLM and LM Studio.docs.sentrymail.de · read 15 Oct 2026
- API
- The documentation exposes API routes including an evidence-package endpoint at GET /audit-events/evidence-package.docs.sentrymail.de · read 15 Oct 2026
- Architecture
- The stack uses FastAPI, React/Vite/TypeScript, PostgreSQL, Redis, Caddy and rootless Docker Compose.docs.sentrymail.de · read 15 Oct 2026
- Campaign features
- Campaigns support scheduling, HTML or Markdown templates, EML imports, landing pages and recipient-level tracking.docs.sentrymail.de · read 15 Oct 2026
- Campaigns
- Campaigns support scheduling, HTML or Markdown templates, .eml import, landing pages, and per-recipient tracking of opens, clicks, and form submissions.docs.sentrymail.de · read 30 Sep 2026
- Company legal name
- The legal notice identifies SecureBits Cyber Security UG (limited liability) in formation as the operator.sentrymail.de · read 15 Oct 2026
- Compliance
- SentryMail says it helps organizations document awareness training for NIS2 and lists a compliance center covering GDPR, NIS2, ISO 27001, BSI ORP.3, and § 38 BSIG.sentrymail.de · read 30 Sep 2026
- Data residency
- The product is designed to run entirely on the operator’s infrastructure without vendor telemetry or cloud dependency.docs.sentrymail.de · read 15 Oct 2026
- Deployment
- The official installation guide describes a Docker Compose stack and lists Linux with Docker Engine as its operating-system requirement.docs.sentrymail.de · read 30 Sep 2026
- Developer identity
- The securebitsorg GitHub profile says Marcel Dellmann develops the SentryMail application as a realistic phishing-simulation and awareness-training server.github.com · read 15 Oct 2026
- Enterprise integrations
- Enterprise supports SAML SSO, SIEM export to Splunk HEC, Elasticsearch, Microsoft Sentinel or JSON, and LMS xAPI export to a Learning Record Store.sentrymail.de · read 30 Sep 2026
- Evidence chain
- Audit entries are linked with SHA-256 hashes and can be exported as a verifiable evidence package.docs.sentrymail.de · read 15 Oct 2026
- Evidence integrity
- The Core feature list describes hash chaining of audit entries using SHA-256 and an exportable evidence package with a standalone verifier.sentrymail.de · read 30 Sep 2026
- Installation
- Installation is provided through an interactive install.sh script or manual Docker Compose commands.github.com · read 15 Oct 2026
- Integrations
- Documented connections include LDAP, Microsoft Entra ID, SCIM 2.0, OIDC, SAML, Splunk, Elasticsearch, Microsoft Sentinel and generic JSON.docs.sentrymail.de · read 15 Oct 2026
- Licence
- The core is open source under the Mozilla Public License 2.0, while Business and Enterprise add-ons are proprietary.docs.sentrymail.de · read 15 Oct 2026
- Limit: minimum size
- Paid subscriptions require a minimum order of 25 employees.sentrymail.de · read 15 Oct 2026
- Limit: open tracking
- The repository warns that many mail clients block tracking pixels, making clicks more reliable than opens.github.com · read 15 Oct 2026
