One place to run compliance for every mailbox you’re responsible for.
The console is where an office manager, a compliance officer or an IT provider sets policy, watches what happened, answers an auditor and manages seats. It is built for people who do this once a month, not all day: every screen says what it is for and what to do next.
| Status | All systems normal · DNS ✓ · relay ✓ |
| Last 7 days | 2,140 scanned · 98.9% TLS · 21 encrypted · 1 blocked |
| Attention | 1 held message · 2 users without MFA |
| Agreements | BAA signed 2026-01-14 · annual letter due 2027-01 |
| Seats | 12 of 15 · next invoice Nov 1 |
What’s in the console, screen by screen.
Home
Health (DNS, relay, MFA coverage), 7/30-day counts, items needing attention, agreements and renewal dates, quick actions.
Organization
Legal name, address, industry profile, Security Officer, agreements (BAA/addendum with countersigned PDFs), subprocessors acknowledgement, branding (Pro).
Domains & connection
Domains, DNS records with live checks, relay/connector credentials with rotation, MX routing on/off, S/MIME certificates, DMARC dashboard.
Users & devices
Users (synced or manual), roles, MFA status, app passwords, devices and wipe, shared mailboxes and groups (Hosted), offboarding workflow.
Policy
Detection packs, custom rules, actions, exceptions, subject tags, disclaimers, test mode with sample message, version history with diffs and rollback.
Quarantine & holds
Held messages with findings, release/reject with reason, inbound quarantine, bulk actions, expiry.
Archive & audit
Search, message view (Compliance/Owner), legal holds, exports with manifests, audit log viewer with filters, access-to-content log.
Reports
Quarterly compliance report, annual safeguards letter, DMARC, deliverability, detection precision, evidence packs by regulator.
Billing
Plan, seats (with directory count), add-ons, invoices, payment method, tax exemption, cancellation, data export.
Partner view
All client organizations with health, seats and alerts; switch into a client with logged, time-limited access; deal registration; margin statements.
Security
Session policy, SSO (Pro), break-glass requests, API keys and webhooks (Pro), security contacts, incident notices.
Support
Chat, tickets, scheduled calls, knowledge base search, status subscription; no content in tickets by design.
Who can do what
| Capability | Owner | Admin | Compliance | Support | User | Partner |
|---|---|---|---|---|---|---|
| Billing, agreements, cancel | ✓ | — | — | — | — | bill-through only |
| Domains, connection, DNS | ✓ | ✓ | — | view | — | ✓ (logged) |
| Users, roles, devices, wipe | ✓ | ✓ | — | view | own devices | ✓ (logged) |
| Policy edit | ✓ | ✓ | ✓ | — | — | ✓ (logged) |
| Release held messages | ✓ | ✓ | ✓ | — | — | if delegated |
| Archive search & view content | ✓ | — | ✓ | — | — | — |
| Legal hold, exports | ✓ | — | ✓ | — | — | — |
| Audit log (metadata) | ✓ | ✓ | ✓ | view | own | view |
| Reports | ✓ | ✓ | ✓ | — | — | per client |
| API keys, webhooks, SSO | ✓ | ✓ | — | — | — | — |
Every role action is written to the audit log with actor, time, IP and object. Owner can require dual approval for content access and legal-hold release.
Built for the monthly user
- Every screen states its purpose and the next action; empty states explain what will appear and why it matters.
- Dangerous actions (wipe, hold release, policy change) require confirmation with a reason and are reversible where possible (policy rollback).
- Plain language: “encrypted with a code” not “OTP portal”; regulation references in tooltips.
- Accessible: WCAG 2.1 AA, keyboard-complete, screen-reader tested; works at 200% zoom.
- Fast: pages render in under one second on a practice’s typical connection.
How the console is protected
- MFA required; security keys supported; SSO on Pro
- Session timeout 15 minutes idle (5–60 configurable); re-authentication for content access and billing
- Partner access is time-limited (default 2 hours), visible to the client, and logged
- No message content in support tooling; support role sees metadata only
- Rate limiting and anomaly detection on sign-in; alerts for new admin devices