Built for the day someone asks.
An auditor wants evidence. A lawyer wants every message with one client. A patient wants to know who saw what. An examiner wants two years by custodian with proof nothing was altered. PXCMail answers each in minutes, from a record that cannot be quietly edited.
| Date | From → To | Subject | Status |
|---|---|---|---|
| 2025-03-02 | frontdesk@ → maria.a@gmail | Treatment plan | Locked · opened |
| 2025-03-09 | maria.a@gmail → frontdesk@ | Re: Treatment plan | Secure reply |
| 2025-04-11 | billing@ → insurer | Pre-auth 48-2211 | TLS · S/MIME |
| Legal hold: matter 2025-117 · 3 messages | |||
Record, retain, hold, produce.
Audit trail
For every message: sender, recipients, time, detection findings and rule, action, encryption method and cipher, delivery result, opens and replies for locked messages. For admins: logins, policy changes, holds, exports, access to content. Content-free; six-year retention; hash-chained and copied daily to immutable storage.
Archive
Every inbound and outbound message with attachments, journaled before any user can delete it. Search by person, date range, keyword, attachment name and type, detection finding, hold status. One year included; 6 or 7 years on the archive add-on and Hosted Pro.
Immutable retention
Archive-plan data is written to object storage with compliance-mode locking: nobody — including PXCMail — can delete it before the retention period ends. Integrity hashes are stored with each message and verified on export.
Legal hold
Freeze a custodian, a matter (by keyword or participant set) or a date range. Held items survive retention expiry, user deletion and account termination until the hold is released; every hold action is logged.
Exports
CSV reports; EML/MBOX/PST message exports with a manifest and SHA-256 hashes; chain-of-custody statement; date-range and custodian exports in the formats examiners and e-discovery vendors accept. API on Hosted Pro.
Compliance reports
Quarterly: messages scanned, encrypted, warned, held, blocked; policy changes; user access; DNS health. Annual: written confirmation of safeguards for your risk analysis or WISP file.
Exports built around what regulators actually ask
| Who asks | Typical request | Export |
|---|---|---|
| HHS OCR (HIPAA audit protocol) | Evidence of transmission security, audit controls, access for a period | “HIPAA evidence pack” — policy in force, encryption outcomes, access log, retention settings |
| FTC / insurer (Safeguards) | Encryption of customer information in transit; activity logging | Quarterly compliance report; per-rule findings |
| Malpractice carrier / underwriter | How client data and wire instructions are protected | Controls summary + wire-instruction delivery log |
| SEC / state examiner (Rule 204-2) | All email for custodians over a date range; keyword hits; proof of immutability | Custodian/date-range export with hashes and chain of custody; keyword review log |
| Patient or client (accounting of disclosures) | Who sent what about me, to whom | Per-individual disclosure report |
| Counsel (litigation) | Everything on a matter, preserved | Legal-hold export in EML/PST with manifest |
The numbers
| Archive retention | 1 year included; 6 years (healthcare, legal, wealth) or 7 years (accounting) on add-on/Pro; up to 10 years on request |
|---|---|
| Immutability | Compliance-mode object lock for the retention period; cross-region copy |
| Search | Full-text across subject, body, attachment text; results in < 2 s for typical tenants; up to 10,000 results per query, paginated |
| Export size | Up to 50 GB per export job; larger by request; jobs run asynchronously with email notice |
| Legal holds | Unlimited; by custodian, matter, date range; release requires Compliance or Owner role |
| Audit retention | 6 years; hash-chained; daily snapshot to immutable storage |
| Access to content | Compliance and Owner roles only; every search and export logged |
Questions about archive and audit
Can we search the archive ourselves?
Yes — Owner and Compliance roles search and export from the console. Every search is logged, which is itself part of the audit trail.
What if a user deletes a message?
Journaling captures messages before delivery to the mailbox, so deletion from a mailbox does not affect the archive.
Can PXCMail delete our archive?
Not before the retention period ends on archive plans — the storage is locked in compliance mode. On the 1-year included archive, data is deleted on schedule or 30 days after termination.
Is the audit trail admissible?
It is a business record with timestamps, integrity hashes and a chain-of-custody statement on export. Whether it is admissible depends on the forum; counsel can request an affidavit from our records custodian.