Enterprise archiving rules, small-firm price.
State-registered advisers follow books-and-records rules that mirror Rule 204-2, and state examiners ask the same questions. The vendors built for broker-dealers charge enterprise prices for it. PXCMail gives a two-planner firm journaling, retention and exports for the cost of a lunch per seat — on Gmail or Microsoft 365.
| Messages journaled | 100% · 2,904 |
| Flagged: performance claims | 3 · reviewed |
| Flagged: personal device | 0 |
| Reviewer sign-off | J. Park · Oct 17 |
| Archive | 5-year · immutable |
Overview
Client data in every message
Account numbers, statements, tax returns for planning — detected and encrypted automatically; clients open with a code.
State exam ready
Exports by date range and client with integrity hashes; the same archive answers a client complaint.
Grows with you
Register with the SEC later and nothing changes; add advisers and the policy follows.
Moments that matter
- Client emails last year’s 1040 for the plan — your reply and the plan go encrypted.
- State examiner asks for 24 months of client correspondence — exported in an afternoon.
- You add a second planner on a different Google account — same policy, same archive.
Works beside
eMoney, RightCapital, MoneyGuide, Wealthbox, Redtail, Holistiplan. Overview →
Pricing
Gateway + books & records $10 per seat; Solo plan planned.
What a state-registered planner has to keep
If you are registered with your state rather than the SEC, your books-and-records rule comes from the state securities regulator, and most states mirror Advisers Act Rule 204-2: keep written communications about recommendations, advice, receipt of funds and the placing of orders, keep them five years, keep the first two in an easily accessible place, and keep electronic records in a way that lets you produce them promptly. The examiner who visits a two-planner firm asks the same questions an SEC examiner asks a fifty-adviser firm, just with a shorter letter. PXCMail answers them with a journaled copy of every message in an immutable archive, five-year retention set by the wealth profile, and exports by client and date range with hashes. It does not supervise your planning advice and it does not replace your compliance consultant; it gives both of you the record.
A week at Northwind Wealth
Northwind has five advisers and an operations associate on Google Workspace, with Orion for portfolios, Redtail for the CRM and eMoney for plans. The CCO is also an adviser. The week below is Northwind’s; a state-registered planner’s week looks the same, only the examiner’s letterhead changes.
- Monday. A client emails last year’s 1040 and two brokerage statements for the plan update. The reply with the eMoney summary carries account numbers; policy: encrypt. The client opens with a code on her phone.
- Tuesday. An adviser confirms by email that a client wants to raise cash before a house purchase. That is an instruction about funds; it is journaled before anyone can delete it, and the archive keeps it five years.
- Wednesday. RightCapital and Redtail send meeting summaries and plan links on the firm’s behalf through Google. They inherit the policy; nothing to integrate.
- Thursday. The CCO’s weekly lexicon review flags three messages containing “guaranteed”. Two are a client quoting an annuity brochure; one is an adviser who gets a reminder about performance language. The review and the outcome are logged.
- Friday. The state examiner’s letter asks for 24 months of correspondence for two clients. Export by client address and date range, EML with a sha256 manifest, done before lunch.
By the numbers
- 5 years, the first 2 in an easily accessible place, is the Rule 204-2(e)(1) retention period that most state rules copy. (17 CFR 275.204-2)
- 58% of cyber insurance claims in Coalition’s 2026 report were business email compromise or funds-transfer fraud, with an average BEC loss of about $27,000. For a planner who confirms money movement by email, that is the realistic risk. (Coalition 2026 Cyber Claims Report)
- 98% of claims in the NetDiligence 2025 study came from small and mid-sized businesses. (NetDiligence Cyber Claims Study 2025)
What the examiner asks
“Produce all electronic communications with these clients for this period.” Archive search by address and date; export EML, MBOX or PST with a sha256 manifest and a chain-of-custody statement.
“How do you know the record is complete?” Journaling copies 100% of mail before delivery; mailbox deletions never touch the archive. Storage is immutable (S3 Object Lock).
“Where are the first two years kept?” All five years sit in the same archive and are searchable from the console, so the “easily accessible” test for the first two is met the same way as the rest.
“Do you review correspondence?” The lexicon flags performance claims and off-channel invitations; each review is logged with the reviewer and outcome. The firm sets the cadence.
“Is client account data protected in transit?” TLS is required to every recipient; statements, tax returns and account numbers go by locked delivery or S/MIME. The message record shows which.
Going live
- Start the trial with the RIA profile
14 days, $0 charged. The books-and-records vendor letter and the Data Processing and Safeguards Addendum are signed in signup. - Connect Google Workspace or Microsoft 365
One connector per tenant; a second planner on a different Google account joins the same policy. - Turn on journaling and the five-year profile
Add your lexicon: “guaranteed”, “text me”, your own terms. - Test mode for a week, then enforce
Confirm what would be encrypted and flagged; brief the advisers in ten minutes.
What Northwind pays
- Gateway + books and records, 6 seats
- $60 per month, billed yearly ($10 per seat)
- Two-planner firm, same tier
- $49 per month, the organization minimum
- Hosted Pro, 6 seats
- $108 per month with legal hold, SSO and a contractual SLA
A $29 per month Solo plan for one-person firms is ROADMAP, not available yet.
Questions planners ask
Does my state follow Rule 204-2 exactly?
Most states mirror it, with local differences in wording and sometimes retention. Check with your state regulator or compliance consultant; the five-year profile covers the common case and can be set longer.
What happens when we register with the SEC?
Nothing changes in PXCMail. The same archive, retention and exports serve an SEC exam request list; see the RIA page.
Do I have to archive personal email too?
PXCMail archives the firm accounts it is connected to. Off-channel communication is a policy question for your firm; the lexicon can flag invitations to move a conversation off email.
Can my compliance consultant have access?
Yes. The Compliance role is read-only for audit and archive; consultants who serve several firms can use the partner console.
Does encryption get in the way of clients?
Clients open with a one-time code, no account or app, and reply from the same page. Routine scheduling email goes out normally over TLS.