Produce an evidence pack for an auditor, carrier or examiner
Built around the questions HHS, the FTC, carriers, underwriters and examiners actually ask.
Applies to: Gateway, Hosted
An evidence pack is a dated bundle (PDF summary, CSV/JSON detail and optional message exports with manifests) that answers one audience’s questions for one period. A Compliance or Owner account generates it under Console → Reports → Evidence pack; the pack carries its own hash and the name of the account that produced it.
Before you start
- Compliance or Owner role. A partner can generate a pack only while switched into the client, and the switch is logged.
- The request letter or questionnaire, for the period and request ID.
- Confirm the archive covers the period: 1 year is included on every plan; 6 or 7 years on the archive add-on and Hosted Pro; 5 years on the RIA profile.
Steps
- Console → Reports → Evidence pack → New.
- Choose the audience: HIPAA audit, Safeguards review (FTC, IRS WISP, cyber carrier), malpractice or underwriter, SEC or state exam, litigation. The audience decides which sections are included and how they are labelled.
- Set the period. Use the dates from the request, not the calendar year.
- Review the sections: policy in force (rule versions with change dates), encryption outcomes (TLS, locked delivery, S/MIME, warned/held/blocked counts), access records (admin actions, content views, exports), retention and legal holds, DNS health, and the signed agreement. Untick anything the request did not ask for.
- Add a note: request ID, matter number, reviewer’s name.
- Optional: include message exports (EML, MBOX or PST) with a sha256 manifest and chain-of-custody statement.
- Generate. The pack lands in the console and is also sent by secure link.
Verify
The pack cover shows generation time, hash and the generating account. Open Console → Archive & audit → Audit log and confirm an “Evidence pack generated” entry. Compare the hash on the cover with the hash in the manifest.
Troubleshooting
- The pack covers fewer months than the request. Cause: your archive retention is shorter than the period (1-year archive). Fix: include what exists, state the gap in the note, and add the archive add-on going forward.
- Encryption section shows zero locked deliveries. Cause: the encrypt rule was in test mode or never matched. Fix: check Console → Policy → Versions for the period; report the real numbers rather than editing them.
- The reviewer says the hash does not match. Cause: an export was opened and re-saved by a mail tool. Fix: send the original download, or regenerate.
- The secure link has expired. Cause: links are time-limited. Fix: Reports → Evidence pack → History → resend.
- The request asks for training records or your written policy. Cause: PXCMail does not hold them. Fix: attach them alongside the pack.
Example
Daniel Ortiz at Ortiz CPA receives his cyber carrier’s renewal questionnaire: encryption in transit, MFA on email, vendor oversight. He picks Safeguards review, the last twelve months, and notes “E&O renewal”. The pack shows the W-2, 1099 and 1040 fingerprint rules set to encrypt, the count of locked deliveries, MFA coverage across the nine staff, and the signed addendum, which maps to 16 CFR 314.4 elements (c)(3), (c)(5) and (f) at ecfr.gov. He attaches his WISP separately. A healthcare pack maps instead to 45 CFR 164.312; an RIA pack to Rule 204-2.
FAQ
Does the pack prove we are compliant?
No. It is evidence that specific controls operated during the period. The auditor, carrier or examiner decides what it means for you.
Can I give the auditor console access instead?
Yes, with the read-only Compliance role. Most reviewers prefer the pack because it is dated and hashed.
How often should we generate one?
The quarterly compliance report and annual safeguards letter are automatic. Generate a pack when someone asks.
Who can see that I generated it?
Every Owner and Compliance user, through the audit log.
Related
Still stuck? A human answers within 15 minutes on chat, 1 hour by email during business hours (24/7 for outages).