[{"data":1,"prerenderedAt":357},["ShallowReactive",2],{"money-live:best":3,"money:compare:sentaro-vs-sublime-security":4,"money-links:\u002Fen\u002Fcompare\u002Fsentaro-vs-sublime-security":350},true,{"page":5},{"family":6,"slug":7,"navLabel":8,"hubBlurb":9,"icon":10,"eyebrow":11,"h1":12,"lede":13,"seoTitle":14,"seoDescription":15,"reviewed":16,"heroChips":17,"sections":22,"faqs":278,"sources":300,"disclaimer":322,"related":323,"cta":347},"compare","sentaro-vs-sublime-security","Sentaro vs Sublime Security","Detection-as-code you can read, write and self-host, or automatic verdicts with no rules to maintain. A fair comparison of two API-based platforms.","scale","Compare · API-based email security","Sentaro vs Sublime Security: detection-as-code or automatic verdicts","Sublime Security documents detection-as-code in its Message Query Language (MQL), a self-hosted option and the first 100 mailboxes free on its managed cloud (Sublime docs, October 2026), while Sentaro returns automatic verdicts with no rules to maintain and adds OAuth and shadow-AI discovery in the same seat; for EU teams on Microsoft 365 or Google Workspace with lean IT, Sentaro is the better choice. Sentaro is hosted in Sweden on Microsoft Azure and costs $6 per protected account per month. Prices in USD.","Sentaro vs Sublime Security: verdicts vs detection-as-code","Sentaro vs Sublime Security: detection-as-code (MQL) vs automatic verdicts, self-hosting, free tiers, pricing, OAuth and shadow AI, and hosting compared.","2026-10-18",[18,19,20,21],"Both API-based","No rules to maintain","$6 per account per month","Hosted in Sweden on Azure",[23,40,45,70,198,210,222,232,250,268,272,275],{"t":24,"title":25,"summary":26,"points":27},"verdict","Our recommendation","Sentaro is the better choice than Sublime Security for EU teams on Microsoft 365 and Google Workspace, and each reason can be checked: it connects over API in four minutes with no MX change; Vord, Sentaro’s proprietary engine, returns one verdict with its reasoning shown in the console, so nobody has to write or tune rules and you can audit its BEC and vendor-fraud calls on your own mail; its App vector, live since Q3 2026, inventories every app, AI tool and OAuth grant over the same connection; every feature is included for a published $6 per protected account per month; and it is hosted in Sweden on Microsoft Azure, with subprocessors listed in its public DPA, while Sublime’s managed cloud lets you pick one of five regions, including EU (Dublin).",[28,31,34,37],{"label":29,"text":30},"Choose Sentaro if…","IT is a handful of generalists, you want verdicts and remediation without rule maintenance, and you want OAuth and shadow-AI discovery in the same seat.",{"label":32,"text":33},"Why Sentaro wins","no rule language to learn, block, quarantine or tag inline in every paid account, consent phishing blocked in mail flow, and a documented hosting location: Sweden on Microsoft Azure, named in the DPA.",{"label":35,"text":36},"Consider Sublime only if…","you have security engineers who want to write MQL rules, or need self-hosting in your own AWS or Azure account.",{"label":38,"text":39},"Price check","Sublime documents its managed cloud as free for the first 100 mailboxes (as of October 2026); Enterprise is quoted. Sentaro is $6 per protected account per month, first account free. Prices in USD.",{"t":41,"tone":42,"title":43,"text":44},"callout","info","Disclosure","Sentaro publishes this comparison and recommends itself; Sublime facts are public and sourced from Sublime’s documentation and rules repository as of 18 October 2026.",{"t":46,"title":47,"items":48},"facts","At a glance",[49,52,55,58,61,64,67],{"label":50,"value":51},"Category","Both: integrated cloud email security (ICES), API-connected, no MX change.",{"label":53,"value":54},"Platforms","Sublime: Microsoft 365, Google Workspace and IMAP message sources. Sentaro: Microsoft 365 and Google Workspace, with Slack and Teams listed as channels.",{"label":56,"value":57},"Deployment","Sublime: managed cloud, or self-managed with Docker (up to 600 active mailboxes) or AWS CloudFormation and Azure ARM templates. Sentaro: managed only; connects over API in four minutes, historical visibility within 15 minutes.",{"label":59,"value":60},"Pricing","Sublime: managed cloud free for the first 100 mailboxes, per its docs (as of October 2026); Enterprise via sales. Sentaro: $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD.",{"label":62,"value":63},"Hosting","Sublime: managed-cloud regions include the US, UK (London), EU (Dublin), Canada and Australia; self-hosting lets you choose your own region. Sentaro: hosted in Sweden on Microsoft Azure; subprocessors in the DPA.",{"label":65,"value":66},"Company","Sublime: venture-backed; announced a $150M Series C in October 2025 and more than $240M raised in total. Sentaro: Sentaro AB, founded in 2025 in Stockholm.",{"label":68,"value":69},"Best for","Sublime: security teams and SOCs that want transparent, customizable detection. Sentaro: regulated EU SMEs and mid-market firms with lean IT.",{"t":6,"id":71,"title":72,"intro":73,"columns":74,"own":77,"groups":78,"footnote":197},"feature-comparison","Sublime Security vs Sentaro, feature by feature","We make Sentaro. Public information as of 18 October 2026. Sublime rows use Sublime’s documentation and its public rules repository. “Not publicly documented” means we could not confirm it, not that Sublime lacks it.",[75,76],"Sublime Security","Sentaro",1,[79,119,173],{"label":80,"rows":81},"Deployment and commercial",[82,89,98,106,112],{"label":83,"cells":84},"API connection, no MX change",[85,87],{"mark":86},"yes",{"mark":86,"text":88},"Four minutes",{"label":90,"note":91,"cells":92},"Self-hosting","Running the platform in your own cloud account.",[93,95],{"mark":86,"text":94},"Docker, AWS or Azure",{"mark":96,"text":97},"no","Managed service only",{"label":99,"cells":100},"Free entry",[101,103],{"mark":86,"text":102},"First 100 mailboxes, managed cloud",{"mark":104,"text":105},"partial","First account free; Free plan coming soon",{"label":107,"cells":108},"Published paid price",[109,111],{"mark":96,"text":110},"Enterprise via sales",{"mark":86,"text":20},{"label":113,"cells":114},"EU hosting statement (managed)",[115,117],{"mark":104,"text":116},"EU (Dublin) among managed-cloud regions (docs)",{"mark":86,"text":118},"Hosted in Sweden on Microsoft Azure",{"label":120,"rows":121},"Detection",[122,130,137,144,151,158,165],{"label":123,"note":124,"cells":125},"Detection logic you can read and edit","Rules written in a query language, visible to the customer.",[126,128],{"mark":86,"text":127},"MQL, open-source Core Detections",{"mark":96,"text":129},"Engine verdicts; policy maps them to actions",{"label":131,"cells":132},"No rule maintenance required",[133,135],{"mark":104,"text":134},"Default open rules; ADÉ agent writes and backtests new ones",{"mark":86,"text":136},"“No rules to maintain”",{"label":138,"cells":139},"BEC",[140,142],{"mark":86,"text":141},"20+ open BEC rules on GitHub",{"mark":86,"text":143},"Intent, relationship and thread context",{"label":145,"cells":146},"QR-code phishing",[147,149],{"mark":86,"text":148},"20+ open QR rules",{"mark":86,"text":150},"Decoded and destination scored",{"label":152,"cells":153},"Lookalike domains in mail",[154,156],{"mark":86,"text":155},"Open lookalike rules",{"mark":86,"text":157},"At first contact",{"label":159,"cells":160},"Verdict explanation",[161,163],{"mark":86,"text":162},"The matching rule is the explanation",{"mark":86,"text":164},"Reasoning on every console verdict",{"label":166,"cells":167},"User-report triage",[168,170],{"mark":86,"text":169},"Autonomous Security Analyst (ASA)",{"mark":171,"text":172},"unknown","Not publicly documented",{"label":174,"rows":175},"Response and scope",[176,183,190],{"label":177,"cells":178},"Remediation",[179,181],{"mark":86,"text":180},"Trash and spam on Core; quarantine and banners on Enterprise",{"mark":86,"text":182},"Block, quarantine or tag inline in every paid account",{"label":184,"note":185,"cells":186},"OAuth app and shadow-AI discovery","Which apps and AI tools users have connected, and what they can access.",[187,188],{"mark":171,"text":172},{"mark":86,"text":189},"App vector, every plan",{"label":191,"note":192,"cells":193},"Consent phishing","A lure that tricks a user into granting an app OAuth access.",[194,195],{"mark":171,"text":172},{"mark":86,"text":196},"Blocked in mail flow, grants surfaced","Sentaro cells show live capabilities only (Message and App vectors); its roadmap is stated once, in the note below the table.",{"t":199,"id":200,"title":201,"blocks":202},"prose","detection-as-code","Detection-as-code vs a managed engine: which does your team need?",[203,206,208],{"t":204,"text":205},"p","Detection-as-code means the logic that flags a message is written as rules you can read, version and change. Sublime publishes its Core Detections on GitHub in MQL, and its Autonomous Detection Engineer (ADÉ), generally available for Enterprise, writes and backtests new rules. For a SOC that already treats detections as code for endpoints and cloud, this is a natural fit, and it removes the black box.",{"t":204,"text":207},"Sentaro takes the other path. Vord, Sentaro’s proprietary engine, deconstructs each message into tens to over a hundred signals, passes them to expert algorithms and a family of models, and returns one verdict with its reasoning attached. There is no rule language to learn and nothing to tune. Policy decides what happens per user group: block, quarantine or tag inline.",{"t":204,"text":209},"A practical test: ask who will look at detections next month. If the answer is a security engineer who enjoys writing rules, Sublime gives them more control than Sentaro does. If the answer is an IT generalist who also runs laptops and licenses, as it is in most EU SMEs and mid-market firms, Sentaro is the better choice.",{"t":199,"id":211,"title":212,"blocks":213},"where-sentaro-wins","Where Sentaro wins",[214],{"t":215,"items":216},"ul",[217,218,219,220,221],"No rules to maintain: automatic verdicts with reasoning on every console verdict, and alerts only when a decision is needed.","App and AI-tool risk included: the App vector inventories every app, AI tool and OAuth grant and blocks consent phishing. We found no OAuth discovery documented in Sublime’s docs (October 2026).","Full response in every paid account: block, quarantine or tag inline. Sublime documents quarantine and banners on Enterprise.","A published paid price: $6 per protected account per month, every feature included. Prices in USD. Sublime Enterprise is quoted.","Hosting you can name in the DPA: hosted in Sweden on Microsoft Azure, with subprocessors listed. Sublime’s managed cloud offers an EU (Dublin) region among five; check its subprocessor list for where other processing happens.",{"t":199,"id":223,"title":224,"blocks":225},"where-sublime-may-still-fit","Where Sublime Security may still fit",[226],{"t":215,"items":227},[228,229,230,231],"Transparency and control: open MQL rules on GitHub that you can read, fork and extend. Sentaro does not expose a rule language.","Self-hosting: run Sublime in your own AWS or Azure account and choose the region. Sentaro is managed only.","Free scale: the first 100 mailboxes are free on Sublime’s managed cloud. Sentaro’s first account is free and its Free plan is still coming soon.","SOC tooling and mail sources: ASA triages user reports, ADÉ writes detections, and Sublime also supports IMAP message sources.",{"t":46,"id":233,"title":234,"items":235},"sentaro-security","Sentaro security and data handling",[236,238,241,244,247],{"label":62,"value":237},"Hosted in Sweden on Microsoft Azure. The DPA at \u002Fen\u002Flegal\u002Fdpa lists every subprocessor and its location.",{"label":239,"value":240},"Engine","Verdicts come from Vord, Sentaro’s proprietary engine.",{"label":242,"value":243},"Access to mail","Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service.",{"label":245,"value":246},"Incident notice","Within 24 hours of confirming a security incident, per the DPA.",{"label":248,"value":249},"Regulation","Built for the controls regulated EU firms are asked to evidence under NIS2 and DORA. No product makes you compliant on its own.",{"t":251,"id":252,"title":253,"intro":254,"items":255},"steps","evaluate","How to compare Sublime and Sentaro on your own mail","Both connect over API, so you can run them side by side without touching mail routing.",[256,259,262,265],{"title":257,"text":258},"Connect Sentaro","An admin connects Microsoft 365 or Google Workspace in about four minutes. Sublime, if you run it, keeps running.",{"title":260,"text":261},"Review history","Historical visibility follows within 15 minutes, together with the app and OAuth-grant inventory.",{"title":263,"text":264},"Tag, then compare","Start with inline tags and compare verdicts on the same messages, reading Sentaro’s reasoning against the Sublime rule that fired.",{"title":266,"text":267},"Count the operating time","Beyond detections, compare the hours each tool takes your team per week. That is usually the deciding factor.",{"t":41,"tone":269,"title":270,"text":271},"roadmap","Roadmap: Identity and Behavioral, Q4 2026","Message and App are live. Identity (leaked credentials, lookalike-domain registration alerts) and Behavioral (account-takeover and session anomalies, forwarding-rule abuse, forced re-authentication and session revocation) reach general availability in Q4 2026, included at no added cost.",{"t":41,"tone":42,"title":273,"text":274},"Certification status","SOC 2 and ISO 27001: certification in progress, with no target date published; Sentaro says it will announce them the day they are signed, and not before. Google CASA: verified API integration. The DPA and subprocessor list are public at sentaro.com\u002Fen\u002Flegal\u002Fdpa; an evidence pack for NIS2, DORA and SOC 2 diligence is available on request from hello@sentaro.com.",{"t":276,"title":277,"quote":3,"caseStudy":3},"proof","What customers say",[279,282,285,288,291,294,297],{"q":280,"a":281},"Is Sentaro better than Sublime Security?","Yes, for EU teams on Microsoft 365 or Google Workspace without dedicated detection engineers. Sentaro returns automatic verdicts with reasoning and no rules to maintain, includes OAuth and shadow-AI discovery, is hosted in Sweden on Microsoft Azure, and costs $6 per protected account per month with every feature included. Prices in USD. Sublime may still fit SOCs that want to write MQL rules or self-host.",{"q":283,"a":284},"Is Sublime Security free?","Partly. Sublime documents its managed cloud as free for the first 100 mailboxes on its Core tier (as of October 2026), and self-managed Docker deployments are documented for up to 600 active mailboxes; licensing for self-hosting at scale is not public. Enterprise features such as quarantine and banners are sold through sales. Sentaro’s first account is free, then $6 per protected account per month; its one-person Free plan is coming soon.",{"q":286,"a":287},"What is MQL in Sublime Security?","MQL, Message Query Language, is Sublime’s language for writing email detection rules. Sublime publishes its Core Detections as open-source MQL rules on GitHub, including rules for BEC, QR-code phishing and lookalike domains. Sentaro has no rule language; its engine returns verdicts and policy maps them to actions.",{"q":289,"a":290},"Who does Sublime Security compete with?","Sublime sits in the API-based email security category alongside Abnormal AI, IRONSCALES, Check Point Harmony Email and Sentaro, with Microsoft Defender for Office 365 as the native baseline most buyers already have. Its distinctive features are open detection-as-code, AI agents for SOC work and self-hosting.",{"q":292,"a":293},"Can I self-host Sentaro like Sublime?","No. Sentaro is a managed service hosted in Sweden on Microsoft Azure. Firms with dedicated-tenancy requirements can ask about the Sovereign tier, which includes dedicated EU tenancy, a custom DPA and SIEM export. Sublime can be self-hosted in your own AWS or Azure account.",{"q":295,"a":296},"Which is easier to run for a small IT team?","Sentaro. It is designed for that case: no rules to maintain, automatic verdicts, reasoning on every verdict and alerts only when a decision is needed. Sublime can also run with its default open rules, and its AI agents reduce rule work, but its strengths show most when someone tunes detections.",{"q":298,"a":299},"Does Sentaro have an API like Sublime?","Yes, in private preview: Sentaro’s API is v0.7.0 and invite only. It accepts an email for a verdict and manages tenants. Sublime’s model is built around MQL rules you write and run yourself. If API-driven workflows are central to you, check Sentaro’s API status with sales.",[301,304,307,310,313,316,319],{"label":302,"url":303},"Sublime Security docs: installation (free 100 mailboxes, deployment options, limits)","https:\u002F\u002Fdocs.sublime.security\u002Fdocs\u002Finstallation",{"label":305,"url":306},"Sublime Security docs: quickstart (Microsoft 365, Google Workspace, IMAP)","https:\u002F\u002Fdocs.sublime.security\u002Fdocs\u002Fquickstart",{"label":308,"url":309},"Sublime Security: plans","https:\u002F\u002Fsublime.security\u002Fplans\u002F",{"label":311,"url":312},"Sublime Security docs: ADÉ, Autonomous Detection Engineer","https:\u002F\u002Fdocs.sublime.security\u002Fdocs\u002Fade-autonomous-detection-engineer",{"label":314,"url":315},"SecurityWeek: Sublime Security raises $150 million","https:\u002F\u002Fsecurityweek.com\u002Fsublime-security-raises-150-million-for-email-security-platform",{"label":317,"url":318},"GitHub: sublime-security\u002Fsublime-rules detection rules","https:\u002F\u002Fgithub.com\u002Fsublime-security\u002Fsublime-rules\u002Ftree\u002Fmain\u002Fdetection-rules",{"label":320,"url":321},"Sublime Security docs: Sublime Cloud regions (accessed 2026-10-21)","https:\u002F\u002Fdocs.sublime.security\u002Fdocs\u002Fsublime-managed","Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.",[324,327,330,333,336,339,342,344],{"label":325,"to":326},"Sublime Security alternatives","\u002Fen\u002Falternatives\u002Fsublime-security-alternatives",{"label":328,"to":329},"Sentaro vs Abnormal Security","\u002Fen\u002Fcompare\u002Fsentaro-vs-abnormal-security",{"label":331,"to":332},"Abnormal vs Sublime","\u002Fen\u002Fcompare\u002Fabnormal-vs-sublime",{"label":334,"to":335},"ICES vendors compared","\u002Fen\u002Fcompare\u002Fices-vendors-compared",{"label":337,"to":338},"European email security alternatives","\u002Fen\u002Falternatives\u002Feuropean-email-security-alternatives",{"label":340,"to":341},"Integrated cloud email security, defined","\u002Fen\u002Fglossary\u002Fintegrated-cloud-email-security",{"label":59,"to":343},"\u002Fen\u002Fpricing",{"label":345,"to":346},"How Vord explains each verdict","\u002Fen\u002Fplatform",{"title":348,"note":349},"Verdicts without the rule-writing.","Connect Microsoft 365 or Google Workspace in four minutes. The first account is free.",{"links":351,"only":354,"labels":356},[352],{"label":191,"to":353},"\u002Fen\u002Fsolutions\u002Fconsent-phishing",{"5":355},[353],{},1792761724306]