Sentaro is the better choice than Sublime Security for EU teams on Microsoft 365 and Google Workspace, and each reason can be checked: it connects over API in four minutes with no MX change; Vord, Sentaro’s proprietary engine, returns one verdict with its reasoning shown in the console, so nobody has to write or tune rules and you can audit its BEC and vendor-fraud calls on your own mail; its App vector, live since Q3 2026, inventories every app, AI tool and OAuth grant over the same connection; every feature is included for a published $6 per protected account per month; and it is hosted in Sweden on Microsoft Azure, with subprocessors listed in its public DPA, while Sublime’s managed cloud lets you pick one of five regions, including EU (Dublin).
- Choose Sentaro if…
- IT is a handful of generalists, you want verdicts and remediation without rule maintenance, and you want OAuth and shadow-AI discovery in the same seat.
- Why Sentaro wins
- no rule language to learn, block, quarantine or tag inline in every paid account, consent phishing blocked in mail flow, and a documented hosting location: Sweden on Microsoft Azure, named in the DPA.
- Consider Sublime only if…
- you have security engineers who want to write MQL rules, or need self-hosting in your own AWS or Azure account.
- Price check
- Sublime documents its managed cloud as free for the first 100 mailboxes (as of October 2026); Enterprise is quoted. Sentaro is $6 per protected account per month, first account free. Prices in USD.
At a glance
- Category
- Both: integrated cloud email security (ICES), API-connected, no MX change.
- Platforms
- Sublime: Microsoft 365, Google Workspace and IMAP message sources. Sentaro: Microsoft 365 and Google Workspace, with Slack and Teams listed as channels.
- Deployment
- Sublime: managed cloud, or self-managed with Docker (up to 600 active mailboxes) or AWS CloudFormation and Azure ARM templates. Sentaro: managed only; connects over API in four minutes, historical visibility within 15 minutes.
- Pricing
- Sublime: managed cloud free for the first 100 mailboxes, per its docs (as of October 2026); Enterprise via sales. Sentaro: $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD.
- Hosting
- Sublime: managed-cloud regions include the US, UK (London), EU (Dublin), Canada and Australia; self-hosting lets you choose your own region. Sentaro: hosted in Sweden on Microsoft Azure; subprocessors in the DPA.
- Company
- Sublime: venture-backed; announced a $150M Series C in October 2025 and more than $240M raised in total. Sentaro: Sentaro AB, founded in 2025 in Stockholm.
- Best for
- Sublime: security teams and SOCs that want transparent, customizable detection. Sentaro: regulated EU SMEs and mid-market firms with lean IT.
Sublime Security vs Sentaro, feature by feature
We make Sentaro. Public information as of 18 October 2026. Sublime rows use Sublime’s documentation and its public rules repository. “Not publicly documented” means we could not confirm it, not that Sublime lacks it.
| Capability | Sublime Security | Sentaro |
|---|---|---|
| Deployment and commercial | ||
| API connection, no MX change | Yes | YesFour minutes |
| Self-hostingRunning the platform in your own cloud account. | YesDocker, AWS or Azure | NoManaged service only |
| Free entry | YesFirst 100 mailboxes, managed cloud | PartialFirst account free; Free plan coming soon |
| Published paid price | NoEnterprise via sales | Yes$6 per account per month |
| EU hosting statement (managed) | PartialEU (Dublin) among managed-cloud regions (docs) | YesHosted in Sweden on Microsoft Azure |
| Detection | ||
| Detection logic you can read and editRules written in a query language, visible to the customer. | YesMQL, open-source Core Detections | NoEngine verdicts; policy maps them to actions |
| No rule maintenance required | PartialDefault open rules; ADÉ agent writes and backtests new ones | Yes“No rules to maintain” |
| BEC | Yes20+ open BEC rules on GitHub | YesIntent, relationship and thread context |
| QR-code phishing | Yes20+ open QR rules | YesDecoded and destination scored |
| Lookalike domains in mail | YesOpen lookalike rules | YesAt first contact |
| Verdict explanation | YesThe matching rule is the explanation | YesReasoning on every console verdict |
| User-report triage | YesAutonomous Security Analyst (ASA) | Not publicly documentedNot publicly documented |
| Response and scope | ||
| Remediation | YesTrash and spam on Core; quarantine and banners on Enterprise | YesBlock, quarantine or tag inline in every paid account |
| OAuth app and shadow-AI discoveryWhich apps and AI tools users have connected, and what they can access. | Not publicly documentedNot publicly documented | YesApp vector, every plan |
| Consent phishingA lure that tricks a user into granting an app OAuth access. | Not publicly documentedNot publicly documented | YesBlocked in mail flow, grants surfaced |
Sentaro cells show live capabilities only (Message and App vectors); its roadmap is stated once, in the note below the table.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
Detection-as-code vs a managed engine: which does your team need?
Detection-as-code means the logic that flags a message is written as rules you can read, version and change. Sublime publishes its Core Detections on GitHub in MQL, and its Autonomous Detection Engineer (ADÉ), generally available for Enterprise, writes and backtests new rules. For a SOC that already treats detections as code for endpoints and cloud, this is a natural fit, and it removes the black box.
Sentaro takes the other path. Vord, Sentaro’s proprietary engine, deconstructs each message into tens to over a hundred signals, passes them to expert algorithms and a family of models, and returns one verdict with its reasoning attached. There is no rule language to learn and nothing to tune. Policy decides what happens per user group: block, quarantine or tag inline.
A practical test: ask who will look at detections next month. If the answer is a security engineer who enjoys writing rules, Sublime gives them more control than Sentaro does. If the answer is an IT generalist who also runs laptops and licenses, as it is in most EU SMEs and mid-market firms, Sentaro is the better choice.
Where Sentaro wins
- No rules to maintain: automatic verdicts with reasoning on every console verdict, and alerts only when a decision is needed.
- App and AI-tool risk included: the App vector inventories every app, AI tool and OAuth grant and blocks consent phishing. We found no OAuth discovery documented in Sublime’s docs (October 2026).
- Full response in every paid account: block, quarantine or tag inline. Sublime documents quarantine and banners on Enterprise.
- A published paid price: $6 per protected account per month, every feature included. Prices in USD. Sublime Enterprise is quoted.
- Hosting you can name in the DPA: hosted in Sweden on Microsoft Azure, with subprocessors listed. Sublime’s managed cloud offers an EU (Dublin) region among five; check its subprocessor list for where other processing happens.
Where Sublime Security may still fit
- Transparency and control: open MQL rules on GitHub that you can read, fork and extend. Sentaro does not expose a rule language.
- Self-hosting: run Sublime in your own AWS or Azure account and choose the region. Sentaro is managed only.
- Free scale: the first 100 mailboxes are free on Sublime’s managed cloud. Sentaro’s first account is free and its Free plan is still coming soon.
- SOC tooling and mail sources: ASA triages user reports, ADÉ writes detections, and Sublime also supports IMAP message sources.
Sentaro security and data handling
- Hosting
- Hosted in Sweden on Microsoft Azure. The DPA at /en/legal/dpa lists every subprocessor and its location.
- Engine
- Verdicts come from Vord, Sentaro’s proprietary engine.
- Access to mail
- Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service.
- Incident notice
- Within 24 hours of confirming a security incident, per the DPA.
- Regulation
- Built for the controls regulated EU firms are asked to evidence under NIS2 and DORA. No product makes you compliant on its own.
How to compare Sublime and Sentaro on your own mail
Both connect over API, so you can run them side by side without touching mail routing.
- 01
Connect Sentaro
An admin connects Microsoft 365 or Google Workspace in about four minutes. Sublime, if you run it, keeps running.
- 02
Review history
Historical visibility follows within 15 minutes, together with the app and OAuth-grant inventory.
- 03
Tag, then compare
Start with inline tags and compare verdicts on the same messages, reading Sentaro’s reasoning against the Sublime rule that fired.
- 04
Count the operating time
Beyond detections, compare the hours each tool takes your team per week. That is usually the deciding factor.
What customers say
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
From quarterly awareness training to zero clicks required.
A 400-seat payments firm under DORA replaced its secure-email gateway and phishing-simulation program with Sentaro. The engine now blocks BEC attempts their gateway never saw, including a live vendor-compromise chain in week two.
- 14
- BEC attempts blocked in the first month
- 4 min
- from contract to full deployment
- $0
- spent on phishing simulations since
Frequently asked questions
Is Sentaro better than Sublime Security?
Yes, for EU teams on Microsoft 365 or Google Workspace without dedicated detection engineers. Sentaro returns automatic verdicts with reasoning and no rules to maintain, includes OAuth and shadow-AI discovery, is hosted in Sweden on Microsoft Azure, and costs $6 per protected account per month with every feature included. Prices in USD. Sublime may still fit SOCs that want to write MQL rules or self-host.
Is Sublime Security free?
Partly. Sublime documents its managed cloud as free for the first 100 mailboxes on its Core tier (as of October 2026), and self-managed Docker deployments are documented for up to 600 active mailboxes; licensing for self-hosting at scale is not public. Enterprise features such as quarantine and banners are sold through sales. Sentaro’s first account is free, then $6 per protected account per month; its one-person Free plan is coming soon.
What is MQL in Sublime Security?
MQL, Message Query Language, is Sublime’s language for writing email detection rules. Sublime publishes its Core Detections as open-source MQL rules on GitHub, including rules for BEC, QR-code phishing and lookalike domains. Sentaro has no rule language; its engine returns verdicts and policy maps them to actions.
Who does Sublime Security compete with?
Sublime sits in the API-based email security category alongside Abnormal AI, IRONSCALES, Check Point Harmony Email and Sentaro, with Microsoft Defender for Office 365 as the native baseline most buyers already have. Its distinctive features are open detection-as-code, AI agents for SOC work and self-hosting.
Can I self-host Sentaro like Sublime?
No. Sentaro is a managed service hosted in Sweden on Microsoft Azure. Firms with dedicated-tenancy requirements can ask about the Sovereign tier, which includes dedicated EU tenancy, a custom DPA and SIEM export. Sublime can be self-hosted in your own AWS or Azure account.
Which is easier to run for a small IT team?
Sentaro. It is designed for that case: no rules to maintain, automatic verdicts, reasoning on every verdict and alerts only when a decision is needed. Sublime can also run with its default open rules, and its AI agents reduce rule work, but its strengths show most when someone tunes detections.
Does Sentaro have an API like Sublime?
Yes, in private preview: Sentaro’s API is v0.7.0 and invite only. It accepts an email for a verdict and manages tenants. Sublime’s model is built around MQL rules you write and run yourself. If API-driven workflows are central to you, check Sentaro’s API status with sales.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Sublime Security docs: installation (free 100 mailboxes, deployment options, limits)
- Sublime Security docs: quickstart (Microsoft 365, Google Workspace, IMAP)
- Sublime Security: plans
- Sublime Security docs: ADÉ, Autonomous Detection Engineer
- SecurityWeek: Sublime Security raises $150 million
- GitHub: sublime-security/sublime-rules detection rules
- Sublime Security docs: Sublime Cloud regions (accessed 2026-10-21)