The mailbox your firm should have had.
Everything in Gateway, plus a 50 GB mailbox for every person, calendar and contacts, shared mailboxes for frontdesk@ and billing@, native Outlook, iPhone and Android sync with PIN and remote-wipe policies, and a dedicated encryption key for your organization. Migration from Google or Microsoft is included.
Hosted Pro $18 adds 6-year immutable archive, legal hold, branded webmail, contractual SLA and the audit API
| User | Device | Policy | Last sync |
|---|---|---|---|
| M. Chen | iPhone 15 | PIN ✓ Encrypted ✓ | 2 min |
| J. Park | Pixel 8 | PIN ✓ Encrypted ✓ | 9 min |
| Front desk | Outlook · Windows | MFA ✓ | now |
| D. Ortiz | iPad (lost) | Wipe pending | 3 d |
Three situations where the mailbox should come from us.
No business email yet
New practice or firm on personal Gmail. Hosted gives you your domain, compliant mailboxes and devices managed from day one.
You want a dedicated key and device control
Each organization gets its own AWS KMS key; phones must have a passcode and encryption; lost devices are wiped remotely. Gateway can’t do that on someone else’s mailbox.
You are paying twice
Google or Microsoft plus a compliance add-on often costs more than Hosted at $12 — with one vendor, one BAA and one invoice.
Mailboxes on AWS, policy in front, devices under control.
Built on Amazon’s HIPAA-eligible mailbox service
Each organization is a separate mailbox organization with its own encryption key, replicated across availability zones. Mailboxes are 50 GB with calendar, contacts, tasks, shared mailboxes, aliases, distribution groups and resource calendars. Protocols: EWS (Outlook), Exchange ActiveSync (iPhone, Android), IMAP/SMTP (any client), and webmail.
- Autodiscover: address and password are enough to set up Outlook or a phone
- Journaling of every message into the archive before any user can delete it
| Mailboxes | 14 users · 3 shared · 2 resources |
| Encryption key | KMS · dedicated · rotated 2026-09-01 |
| Journaling | 100% → archive |
| Retention | 7 years (accounting profile) |
| MFA | Enforced · 14/14 enrolled |
Every outbound message goes through the same engine as Gateway
Submission from Outlook, a phone or webmail is routed through the policy engine: TLS enforced, detection packs, locked delivery, archive, audit. Inbound mail is filtered for spam, malware and impersonation before it reaches the mailbox. Nothing to configure twice.
- Same policy editor, same detection packs, same audit trail
- Internal mail between users is also archived and subject to DLP rules you enable
Phones and laptops, under policy
ActiveSync device policies require a passcode (minimum length configurable), device encryption and an inactivity lock; the admin console lists every device with last sync, and a lost device’s mailbox is wiped remotely at its next connection. App passwords for IMAP clients are scoped to mail and revocable one by one. Multi-factor authentication is required for every user.
- Outlook (Windows, Mac), Apple Mail, Gmail app, built-in Android mail
- Device enrollment, wipe and app-password events in the audit trail
Passcode required (6+ digits)
Encryption required
Lock after 5 minutes
Remote wipe enabled
What’s in a Hosted seat.
Mailbox, calendar, contacts
50 GB per user (expandable), shared calendars, room and equipment resources, out-of-office, rules, delegation.
Shared mailboxes & groups
Delegated shared mailboxes (no shared passwords), aliases, distribution groups, send-as and send-on-behalf with attribution in the audit trail.
Dedicated encryption key
AWS KMS key per organization; annual rotation; destroyed on offboarding (crypto-shredding) with a certificate.
MFA & SSO
TOTP or security keys for every user; SAML/OIDC SSO on Hosted Pro; session timeouts per policy; admin break-glass with dual approval.
Retention, journaling, legal hold
Per-folder and per-user retention; 100% journaling; legal hold by person, matter or date range on Pro.
Migration included
Mail, calendar, contacts from Google Workspace or Microsoft 365 via API; background sync; cutover call; reconciliation report. Free up to 50 seats.
Webmail
Web client included; Hosted Pro adds branded webmail on your own subdomain with your logo and colors.
Audit of mailbox access
Logins, device enrollments, delegate access, exports and admin actions — six-year content-free record.
Onboarding with a human
DNS, migration and device setup on calls; support within 15 minutes; Pro gets priority routing.
When Pro is worth $6 more
| Capability | Hosted $12 | Pro $18 |
|---|---|---|
| Mailbox, calendar, contacts, shared | Yes | Yes |
| Device policies, remote wipe, MFA | Yes | Yes |
| Dedicated key, migration | Yes | Yes |
| Archive retention | 1 yr (add-on 6/7) | 6/7 yr immutable |
| Legal hold | — | Yes |
| Branded webmail, SSO (SAML/OIDC) | — | Yes |
| SLA with credits | 99.9% target | 99.9% contractual |
| Audit API & webhooks | CSV | Yes |
| OCR of scanned attachments | — | Yes |
| Support | Standard | Priority |
The numbers
| Mailbox size | 50 GB; additional 50 GB blocks $2/seat/month |
|---|---|
| Protocols | EWS, Exchange ActiveSync, IMAP4, SMTP submission, CalDAV/CardDAV via webmail, webmail |
| Max message | 35 MB; 2 GB via locked delivery link |
| Users per organization | 1–1,000 (contact us above) |
| Shared mailboxes, groups, resources | Unlimited within reason; no seat charge |
| Retention | Configurable 30 days – 10 years; journaling 100% |
| Backups & DR | Multi-AZ; cross-region copy of archive; RTO 4 h / RPO 15 min |
| Migration | Google Workspace, Microsoft 365, IMAP sources; free ≤ 50 seats, $15/seat above |
| Data location | AWS US regions; US-only access to content |
Questions about Hosted
Can we keep our domain and addresses?
Yes. Your domain, your addresses; we switch MX records with you on the cutover call. Old mail is migrated, so nothing is lost.
How long does migration take and is it disruptive?
Most organizations under 50 seats move in an afternoon. Mail syncs in the background while staff keep working; the cutover itself is 20–30 minutes. We keep the old account read-only for 30 days.
Do we need an IT person?
No. Onboarding is done with you on a call; devices set up with an address and password. IT providers who manage you can use the partner console.
What about Google Docs / OneDrive files?
Hosted covers email, calendar and contacts. Files stay where they are; many customers keep Google Drive or OneDrive and use Gateway-style policies for sharing links. A files product is on our roadmap.
Can we leave?
Yes, any time: standard protocols from day one, full export in 30 days, migration tooling back to Google or Microsoft, certificate of destruction.
Who can read our mail?
Nobody at PXCMail without your written request, and then only US-based tier-2 staff, with every access logged. Your dedicated key means our own infrastructure staff cannot read stored mail outside the service.