Onboarding checklist: signup to secure message

Ten steps take a new organization from signup to a first locked message in the audit trail: agreement, DNS, provider connection, users and roles, MFA, policy, devices, a test send, the audit trail, and the paperwork. Each step names who does it.

Before you start

Four roles, often the same person: the Owner who signs, whoever controls DNS, your Google or Microsoft admin, and the future Compliance user.
A work email at the domain you will protect and a card or PayPal for the 14-day trial.
Your industry profile decided: healthcare, accounting and tax, legal and title, or wealth. It sets the agreement, detection pack and retention defaults.

Steps

Sign the agreement (Owner): the BAA for healthcare or the Data Processing and Safeguards Addendum for other profiles — guide.
Add the DNS records (whoever controls your registrar) under Console → Domains & connection — guide; or book a DNS call. The wizard re-checks every 5 minutes.
Connect your email provider (Google or Microsoft admin) — Google / Microsoft. Hosted: skip, we host the mailboxes and migrate them.
Sync or add users under Console → Users & devices; assign the Compliance role (Admin) — guide.
Require MFA for everyone under Console → Security (Owner) — guide.
Review the policy template for your industry under Console → Policy and put custom rules in test mode (Compliance) — guide.
Hosted: set the device policy and have staff add the account to phones and Outlook — guide.
Send a [SECURE] test to a personal address and open it with the code — guide.
Check Console → Archive & audit → Audit trail shows TLS ✓ / scanned ✓ / archived ✓ for that message.
Download the compliance checklist for your industry, file the signed agreement, subscribe to the status page and add support@ to your contacts.

Verify

Console home shows every health check green, the agreement signed with a date, and at least one message in the audit trail with its policy decision and encryption method.

Troubleshooting

DNS stays red. Cause: a typo, a duplicate SPF record or propagation. Fix: DNS checks show red.
The test message never reaches the audit trail. Cause: the provider route or connector does not cover your user yet. Fix: re-check the provider guide, and test with an outside address; internal mail never appears.
The recipient did not get the code. Cause: wrong mobile number or the notification landed in spam. Fix: resend the code by email from the notification page.
Staff cannot see the Policy screen. Cause: the User role. Fix: assign Compliance to one person.
Hosted phones will not sync. Cause: device policy not yet set, or more than 10 devices on one user. Fix: set the policy first, then add devices.

Example

Lakeside Family Dental, twelve people on Google Workspace with Dentrix, does this over lunch. The office manager signs the BAA as Owner and names herself Security Officer. Their IT contact adds the DNS records at Cloudflare and the Gmail route. She syncs the users, gives herself Compliance, requires MFA, and keeps the healthcare pack as shipped with one custom rule for Dentrix chart numbers in test mode. She sends a [SECURE] test from frontdesk@ to her own phone, opens it with the texted code, and sees it in the audit trail as a locked delivery. The signed BAA goes in the compliance binder.

FAQ

How long does this take?

About half an hour once the DNS person is in the room. Propagation is the only step you cannot hurry.

Do we need to do all ten before staff can send?

Steps 1 to 3 make mail flow through PXCMail. The rest make it defensible; do them the same day.

What does the trial cost if we stop?

Nothing. The card or PayPal on file is charged $0 for 14 days; cancel before then and no charge is made.

Can our IT provider do this for us?

Yes. Partners provision and deploy clients from the partner console in about 15 minutes per tenant.

Still stuck? A human answers within 15 minutes on chat, 1 hour by email during business hours (24/7 for outages).

Onboarding checklist: from signup to first secure message