Works beside what you already run.
PXCMail is email. Most “integrations” need nothing: anything that sends through your Google or Microsoft account inherits the policy. Here is what connects, and how.
Overview
Email providers
Google Workspace (SMTP relay route, directory sync, migration API) · Microsoft 365 / Exchange Online (outbound connector, Entra sync, EWS migration) · IMAP sources for migration (cPanel, Zoho, Rackspace, Yahoo Small Business).
Identity
Google directory · Microsoft Entra ID · SAML 2.0 / OIDC SSO for the console and webmail (Hosted Pro): Okta, Entra, Google, JumpCloud · SCIM provisioning (roadmap).
Healthcare software
SimplePractice, TherapyNotes, TheraNest, Jane, Dentrix, Eaglesoft, Open Dental, Curve, athenahealth, Kareo/Tebra, eClinicalWorks — via your email account; secure intake forms via Jotform HIPAA or IntakeQ.
Accounting & tax software
Drake, Lacerte, ProSeries, UltraTax, CCH Axcess, TaxDome, Canopy, SafeSend, QuickBooks Online Accountant, Gusto, ADP, Bill.com — via your email account; client-list sync to detection rules from TaxDome/Canopy CSV export.
Legal & title software
Clio, PracticePanther, MyCase, Smokeball, CosmoLex, NetDocuments, Qualia, SoftPro, ResWare, RamQuest — via your email account; matter-number patterns imported for detection and legal hold.
Wealth software
Orion, Redtail, Wealthbox, Salesforce FSC, eMoney, RightCapital; custodian portals (Schwab, Fidelity, Altruist) — via your email account; client lists for keyword and account-number detection.
Compliance platforms
Evidence exports and the API feed Vanta, Drata, Secureframe and compliance consultants’ tooling; annual safeguards letter in PDF.
Helpdesk & MSP tooling
Webhooks into ConnectWise, Autotask, HaloPSA and Slack/Teams channels for alerts (held messages, DNS drift, reputation warnings); partner API for provisioning.
Archiving & e-discovery
Exports in EML/MBOX/PST with manifests for Relativity, Logikcull, Everlaw and Smarsh/Global Relay migrations; journaling to an external archive on request.
Don’t see yours? If it sends email through your Google or Microsoft account, it already works. Ask us about anything else.
Most connections are already made
PXCMail connects to four things: your email provider, your identity provider, your compliance tooling and your archive. Everything else, from Dentrix to Qualia to Redtail, connects by sending email through the Google or Microsoft account you already have. Once Gateway sits in front of that account, every message inherits the same policy no matter which application created it. There is no connector to install in your practice software and nothing to keep updated when it changes versions.
How each connection works
- Google Workspace (Gateway)
- An outbound relay route in Google Admin sends mail leaving your domain to PXCMail; we apply policy and deliver it. Three DNS records (SPF include, DKIM, DMARC) keep your domain as the sender. About 15 minutes with us on a call. Setup guide
- Microsoft 365 / Exchange Online (Gateway)
- An outbound connector in the Exchange admin center plus a mail flow rule that scopes it, so you can pilot one group before everyone. Same three DNS records. Setup guide
- IMAP migration (Hosted)
- For moving mailboxes into PXCMail Hosted from cPanel, Zoho, Rackspace, Yahoo Small Business, Hushmail or an old Exchange: one app password per mailbox, a sync that runs in the background, a final delta at cutover. Free up to 50 seats. Migration guide
- Directory sync
- Read-only sync from Google directory or Microsoft Entra ID creates users and keeps names and groups current, so a policy can apply to a group (the front desk,
insurance@) rather than a list you maintain by hand. Deactivated in the directory means deactivated in PXCMail. - SSO (Hosted Pro)
- SAML 2.0 or OIDC for the console and webmail: Okta, Entra, Google, JumpCloud. MFA is enforced by your identity provider. SSO guide
- Webhooks and API
- The audit API and webhooks are a Hosted Pro feature: held messages, DNS drift and reputation warnings post to ConnectWise, Autotask, HaloPSA, Slack or Teams. Partners get a provisioning API and a sandbox with the partner program. API reference
- Exports
- Archive exports in EML, MBOX or PST with a sha256 manifest and a chain-of-custody statement, up to 50 GB per export job; audit records, the quarterly compliance report and the annual safeguards letter for Vanta, Drata, Secureframe or your consultant. When you leave, everything is exported within 30 days with a certificate of destruction.
A week at Lakeside Family Dental
Lakeside is a 12-person dental office on Google Workspace with Dentrix. Dentrix is set to send through the office’s Google account, so a treatment plan it emails from frontdesk@ takes the same path as a message typed in Gmail. Google hands it to the relay route, Gateway runs the Healthcare pack, finds a patient name next to an insurance ID and a CPT code, and applies the encrypt action. The patient gets a notification and opens the plan with a one-time code; the office sees the open in the audit trail. On Thursday a referral to an oral surgeon who publishes an S/MIME certificate goes out S/MIME-encrypted with nobody doing anything. On Friday a pre-authorization from insurance@ to a payer whose server does TLS is delivered over TLS, logged as such, and nothing else happens. Lakeside integrated nothing. The policy sits on the account, and the account is what everything uses.
The same holds at Ortiz CPA, where TaxDome notifications and Drake’s emailed organizers go through Microsoft 365, and at Harbor Title, where Qualia’s closing emails take the same connector as Maria’s wire instructions. If a vendor product cannot be configured to send through your account, tell us which one and we will say plainly whether it can be routed.
By the numbers
- The FBI’s IC3 counted 21,442 business email compromise complaints and $2.77 billion in losses in 2024 (IC3 2024 report). That fraud arrives and leaves through ordinary mailboxes, which is where Gateway sits.
- Coalition’s 2026 claims report: 52% of funds-transfer-fraud claims began as BEC (Coalition 2026 Cyber Claims Report).
What is not an integration
PXCMail does email. It does not do forms, e-signatures or fax. For HIPAA intake forms and signatures we point you to partner products, Jotform HIPAA or IntakeQ, and the completed-form notifications they email you go through policy like everything else. Fax stays with your fax provider. We do not read your practice-management database, your CRM or your document system; detection runs on the message and its attachments, with OCR for scanned attachments on Hosted Pro. Client lists from a TaxDome or Canopy CSV, Redtail or Orion can be imported as keyword lists for detection, but that is an import you run, not a live sync.
Roadmap
- SCIM provisioning for Okta, Entra and Google: ROADMAP. Directory sync covers user creation today.
- Outlook and Gmail add-ins with a send-secure button: ROADMAP. Today staff type
[SECURE]in the subject or let detection decide. - Recipient sign-in with Google, Apple or Microsoft: ROADMAP. Today recipients open with a one-time code by SMS or email.
- URL detonation on inbound mail: ROADMAP.
Dates and status: Roadmap.
Questions about integrations
Does Gateway see internal email between our own staff?
No. Internal mail stays inside Google or Microsoft. Gateway processes mail leaving your domain, and inbound mail only if you route MX through PXCMail (inbound MX guide).
Our software sends from its own servers, not from our account. Does the policy apply?
Not automatically. Most practice and firm software can be set to send through your Google or Microsoft SMTP; when it is, the policy applies. When it cannot, that mail is outside PXCMail, and you should know that before you rely on it.
Can an MSP provision clients by API?
Yes. The partner program includes a provisioning API and a sandbox at every tier. For IT providers
Will the extra SPF include push us over the 10-lookup limit?
It can, if you already have several. The DNS wizard counts lookups and re-checks every five minutes; the DMARC guide explains how to trim includes without breaking anything.
Can you journal to our existing archive?
Yes, on request. We can journal a copy to an external archive, and exports in EML, MBOX or PST carry manifests for Relativity, Logikcull, Everlaw and Smarsh or Global Relay migrations.
Does Gateway work on Google Business Starter?
Yes. Business Starter plus Gateway is the combination priced on the Google Workspace comparison: $84 plus $60 a month for 10 seats.