Questions, answered plainly.
General questions first; industry-specific ones further down.
Getting started
Do I have to change my email address or provider?
No. Gateway works with the Google Workspace or Microsoft 365 account you already have. Hosted is for practices that want the mailbox from us too.
How long does setup take?
Gateway: about 30 minutes, including DNS. Hosted: an afternoon for migration; the cutover call is 20–30 minutes.
Is there a free trial?
14 days on every plan. A card or PayPal account on file is required so your service doesn’t stop on day 15; nothing is charged for 14 days; you won’t be charged until the trial ends and you can cancel in one click.
What is the practice minimum?
$49 per month on any plan, which covers up to 8 seats on Gateway or 4 on Hosted. A single-seat Solo plan is on the roadmap.
Compliance
Do you sign a BAA?
Yes, electronically, before activation. Read the sample.
Is PXCMail “HIPAA certified”?
No vendor is; HIPAA certification doesn’t exist. We publish our safeguards, our BAA, our subprocessors and our audit roadmap in the Trust Center.
Where is our data stored?
In AWS regions in the United States, encrypted in transit and at rest. Hosted and Pro practices have their own encryption key.
Does anyone outside the US see our email?
No. Support staff outside the US see metadata only. Message content is accessible only to US-based staff, on your written request, and every access is logged.
Does any AI read our mail?
No AI reads your mail by default, and we never train models on customer data. PHI detection is pattern-based; an optional HIPAA-eligible medical-entity service returns only a verdict and stores nothing.
Day to day
Do patients need an account or an app?
No. For encrypted delivery they receive a link and a one-time code by text or email and read the message in the browser. They can reply securely.
How do I force a message to be encrypted?
Type [SECURE] at the start of the subject. Otherwise PHI detection decides.
Does it work on Android and iPhone?
Yes. Hosted uses ActiveSync and EWS, so built-in mail apps and Outlook work natively, with PIN and remote-wipe policies. Gateway customers keep their current mobile setup.
Can we have shared mailboxes like frontdesk@?
Yes, on Hosted. Shared mailboxes are delegated, not shared logins, so every action is attributable.
By industry
Accounting & tax: does the Safeguards Rule really apply to a two-person tax office?
Yes. The exemption for firms with fewer than 5,000 consumers removes the written risk assessment, board report and incident plan — not encryption, MFA, access controls or the written program. The PTIN renewal also asks about your WISP. Read the plain-English explainer.
Accounting & tax: we have a client portal — why do we need email protection?
Because clients email documents anyway. The rule cares what happened to the data, not where you asked it to go. PXCMail detects tax documents in email and encrypts the reply automatically.
Legal: is encrypted email required by the bar?
Model Rule 1.6(c) and ABA Opinion 477R require reasonable efforts, with stronger measures for sensitive matters. Policy-based encryption and locked delivery for sensitive content is the practical way to meet that without deciding message by message. Explainer.
Title & escrow: how does the wire-fraud defense actually work?
Inbound: impersonation, lookalike domains, reply-to mismatches and payment-change language produce a red banner. Outbound: wire instructions always go locked with a one-time code and a verify-by-phone notice. The archive records both.
Wealth: are we subject to Rule 17a-4?
Only if you are a broker-dealer. Registered investment advisers follow Advisers Act Rule 204-2 (state equivalents for state-registered advisers), which requires five-year retention and prompt production but not WORM storage or a designated third party. Explainer.
Wealth: do you have a SOC 2 report?
SOC 2 Type I is on our roadmap with a date in the Trust Center; the Trust Center also lists what is in place today. Many advisers start with Gateway now and attach the report when it lands.
Leaving
Can we leave and take everything?
Yes. Standard protocols work from day one; on cancellation you get a full export within 30 days and a certificate of destruction. See Cancellation & refunds.
What happens to our archive if we cancel?
It is exported to you and then destroyed, unless a legal hold is in place, in which case we hold it under the BAA until you release it.