No new app. The ones you have, done right.
Hosted mailboxes work natively with Outlook on Windows and Mac, the built-in Mail apps on iPhone and Android, the Gmail app, and any IMAP client. Device policies make sure a lost phone is not a reportable breach. Gateway customers keep the mobile setup of their Google or Microsoft account; the policy layer applies to everything they send.
• Passcode (6+ digits)
• Device encryption
• Lock after 5 minutes
• Remote wipe of this mailbox if lost
Every client your staff already uses.
Outlook — Windows & Mac
Autodiscover sets it up from an address and password. Mail, calendar, contacts, shared mailboxes, delegation, out-of-office, rules. MFA prompt on first sign-in.
Setup →iPhone & iPad
Add the account as Exchange in Settings. Push mail, calendar, contacts; policy requires passcode and encryption; remote wipe of the mailbox data.
Setup →Android
Gmail app or built-in Mail via Exchange ActiveSync with the same policies; Outlook for Android supported.
Setup →Webmail
Included for every mailbox; Hosted Pro adds branded webmail on your subdomain with your logo.
IMAP clients
Thunderbird, Apple Mail (IMAP), others via scoped app passwords, revocable individually; no device policy enforcement on IMAP, so we recommend EAS/EWS for phones.
Sending secure from anywhere
Type [SECURE] at the start of the subject on any device to force locked delivery; detection runs regardless.
What the policy enforces (Hosted and Pro)
- Passcode required; minimum length 4–16 configurable; alphanumeric optional
- Device storage encryption required
- Inactivity lock 1–30 minutes
- Failed-attempt wipe threshold (optional)
- Remote wipe of the mailbox account data (not the whole phone) at next connection
- Device inventory: model, OS, last sync, policy status; non-compliant devices blocked from sync
- All enrollment, wipe and block events in the audit trail
Policies are set per organization in the console; MDM products (Intune, Jamf, Kandji) can be used alongside.
Protocols and limits
| Outlook | EWS with Autodiscover; Outlook 2016+, Microsoft 365 Apps, Outlook for Mac, new Outlook |
|---|---|
| Mobile | Exchange ActiveSync 16.1; iOS 15+, Android 10+; Outlook mobile |
| IMAP/SMTP | IMAP4 993 (TLS), SMTP 465/587 (TLS); app passwords required; MFA on the account |
| Webmail | Modern browsers; WCAG 2.1 AA; branded subdomain on Pro |
| Devices per user | 10 (configurable) |
| Wipe | Account wipe; executes at next sync; confirmation logged |
Questions about devices
Does remote wipe erase the whole phone?
No — it removes the PXCMail account data (mail, calendar, contacts) from the device. Personal photos and apps are untouched. Full-device wipe is a job for an MDM.
Can staff use the Gmail app?
Yes, with “Exchange and Office 365” account type, so policies apply.
What if someone refuses the policy?
The device cannot sync. The admin sees it as non-compliant in the console.
Do Gateway customers get device policies?
Device policies come from the mailbox provider; on Gateway that is Google or Microsoft. Hosted includes them.