Keep your email. Add the layer you were missing.
Gateway sits between your Google Workspace or Microsoft 365 account and the rest of the world. Your staff keep their inbox, their phone and their habits. Every outbound message gets TLS enforced, encrypted when it has to be, scanned for sensitive data, archived and logged. Every inbound message is checked for malware and impersonation.
Live in 30 minutes · no migration · BAA or industry addendum signed in signup · $49 practice minimum
[SECURE] subject tagOrganizations that already have email and need it to be compliant.
Practices on Google or Microsoft
You have a BAA or Safeguards obligation and no enforcement behind it. Gateway adds the controls without touching mailboxes.
IT providers managing many tenants
One policy per client, one console for all of them, deployed in 15 minutes per tenant with the connector you already know.
Firms that cannot migrate right now
Mid-season, mid-case, mid-audit. Gateway is reversible: remove the relay and DNS records and you are back where you started.
Four hops, every message, under a second.
Your provider hands mail to PXCMail
Google Workspace routes outbound mail through an SMTP relay route; Microsoft 365 uses an outbound connector and a transport rule. Both authenticate to a tenant-specific ingress endpoint over TLS 1.2+ with SMTP AUTH credentials or tenant certificate. Internal mail between your own users never leaves your provider.
- Per-tenant ingress credential, rotatable from the console
- Allowed sender domains enforced; spoofed internal senders rejected
| Provider | Google Workspace |
| Route | smtp-out.pxcmail.com:587 · TLS 1.3 |
| Auth | SMTP AUTH · credential rotated 12 days ago |
| Last message | 2 min ago |
Detection and your rules decide what happens
The message body, headers and attachments (PDF, Office, images with OCR on Pro) are scanned against your industry detection pack and custom patterns. The policy engine returns one of five actions: deliver (TLS required), encrypt (locked delivery), warn (bounce back to sender with guidance), hold (supervisor release), block. Decisions are made in under 500 ms for typical messages; large attachments are scanned asynchronously with a delivery delay shown in the audit trail.
- Industry packs: healthcare, accounting & tax, legal & title, wealth
- Subject tags:
[SECURE]forces encryption;[PLAIN]is never honored for detected content
| Detected | Treatment plan · MRN 48-2211 · DOB |
| Pack | Healthcare (HIPAA) |
| Rule | PHI → encrypt |
| Action | Locked delivery |
| Latency | 312 ms |
TLS enforced, encrypted when it can’t be
Outbound delivery requires TLS 1.2+ with a valid certificate to the recipient’s server. If the recipient cannot negotiate it — or policy says the message is sensitive — the message is held in encrypted storage and the recipient gets a notification with a one-time code. S/MIME is used automatically when the recipient publishes a certificate. Your DKIM signature and MAIL FROM domain stay yours, so reputation accrues to your domain.
- Dedicated IP pools per industry tier; bounce and complaint feedback per tenant
- Delivery receipts and open events written to the audit trail
Archive and audit trail, automatically
A copy of every message is written to the archive (1 year included; 6–7 years on the archive add-on, immutable). The audit trail records sender, recipients, detection result, action, encryption method, delivery result and open events — never the content. Exports are mapped to the questions HHS, the FTC, carriers and examiners ask.
- Search by person, date, keyword, attachment name
- CSV export on every plan; API on Hosted Pro
| Metric | Value |
|---|---|
| Scanned | 12,480 |
| TLS delivered | 98.7% |
| Locked delivery | 1.1% |
| Warned / held / blocked | 14 / 3 / 2 |
| Archive integrity | sha256 ✓ |
Everything Gateway does, by name.
Enforced TLS
Required, not opportunistic. Certificate validation on. MTA-STS and DANE honored where published by the recipient.
Locked delivery
One-time code by SMS or email, 30-day expiry (configurable 1–90), revoke any time, secure reply, attachments up to 2 GB, English and Spanish.
Details →Detection packs & DLP
Identifiers, documents (W-2, 1040, 1099 fingerprints), clinical codes, wire instructions, custom regex and keyword lists; attachment scanning; five actions.
Details →Inbound protection
Optional MX routing: spam, malware, link rewriting, impersonation and lookalike-domain detection with a visible warning banner, payment-change language detection.
Archive & legal hold
Searchable archive; immutable 6/7-year retention on add-on; legal hold by person, matter or date range.
Details →Audit trail & reports
Per-message record, admin actions, quarterly compliance report, annual safeguards letter, auditor export.
Directory sync
Users and groups from Google Workspace or Microsoft Entra; seats follow your directory; offboarding revokes within 15 minutes.
Disclaimers & notices
Per-domain footers, 42 CFR Part 2 redisclosure notice, wire-fraud “verify by phone” notice, privilege banner.
Deliverability tooling
DMARC aggregate reports parsed into a dashboard, SPF/DKIM health checks, bounce and complaint feedback per tenant, auto-pause before reputation damage.
What the console gives your admin
- Tenant settings: domains, ingress credentials, industry profile, agreements, billing contacts
- Policy editor: enable packs, add custom patterns, choose actions per rule, exceptions by sender/recipient domain, test against a sample message
- Users & roles: Owner, Admin, Compliance (read audit/archive, manage holds), Support (metadata only), User
- Quarantine & holds: review, release, reject, with reasons logged
- Reports: 30/90-day summaries, quarterly compliance report, exports
- Alerts: bounce/complaint thresholds, blocked messages, DNS drift, credential rotation due
Numbers your IT provider will ask for
| Supported providers | Google Workspace (all editions), Microsoft 365 (all business/enterprise plans), Exchange Online; other SMTP sources on request |
|---|---|
| Relay | SMTP submission 587 STARTTLS or 465 implicit TLS; TLS 1.2/1.3; SMTP AUTH or certificate |
| Message size | 35 MB via email; up to 2 GB via locked delivery link |
| Recipients per message | 100 (500 on Hosted Pro by request) |
| Sending volume | 2,000 messages per seat per day; new accounts ramp over 44 days (see AUP) |
| Policy latency | < 500 ms typical; attachments > 10 MB scanned asynchronously |
| Archive | 1 year included; 6 years (healthcare/legal/wealth) or 7 years (accounting) on add-on; immutable |
| Locked message expiry | 30 days default, 1–90 configurable; revoke any time |
| Audit retention | 6 years, content-free |
| Data location | AWS us-east-1 (primary), us-west-2 (DR); US-only access to content |
| Availability target | 99.9% monthly; SLA credits on Hosted Pro |
Works beside what you already run.
Email providers
Google Workspace, Microsoft 365 / Exchange Online, Google Workspace Business Starter with BAA, Microsoft 365 Business Basic/Standard/Premium.
Identity
Google directory sync, Microsoft Entra sync, SAML/OIDC SSO for the console (Hosted Pro), SCIM (roadmap).
Practice & firm software
Anything that sends mail through your provider inherits the policy: EHRs, practice management, tax software, case management, CRMs. Integration list →
Questions about Gateway
Does Gateway see internal email between my own staff?
No. Internal mail stays inside Google or Microsoft. Gateway processes mail leaving your domain (and inbound mail if you route MX through PXCMail).
What happens if PXCMail is unavailable?
Your provider queues outbound mail and retries; nothing is lost. For inbound MX routing we recommend keeping your provider’s MX as a lower-priority backup during onboarding; after that, our multi-AZ ingress and DR region handle failover. Status is public at /trust/status/.
Will recipients see anything different?
For TLS-delivered mail, nothing. For locked delivery they receive a branded notification and open the message with a code. Your DKIM and MAIL FROM domain remain yours, so mail is “from you”, not “via PXCMail”.
Can I exempt certain recipients or domains?
Yes — exceptions by recipient domain (for example your hospital partner with S/MIME), by sender, or by message type, all logged. Exceptions cannot disable TLS enforcement.
How do I turn it off?
Remove the relay route or connector and the DNS records; mail flows as before. Your archive stays available for export for 30 days after cancellation.
Is Gateway enough for HIPAA / the Safeguards Rule?
Gateway provides the technical controls and evidence for email. Compliance also needs your policies, training and risk assessment. We give you templates and the annual letter; we don’t give legal advice.