Your clinics, CPAs, law firms and advisers all ask the same question. One answer.
Add PXCMail to your stack: a 30-minute deployment on the Google or Microsoft tenants you already manage, an industry profile per client (HIPAA, FTC Safeguards, ABA, Rule 204-2), one console that shows every client’s status, and margin that makes it worth your time.
| Client | Profile | Health |
|---|---|---|
| Lakeside Family Dental | HIPAA | DKIM pending |
| Ortiz CPA | Safeguards | OK |
| Harbor Title | ABA 477R | Relay |
| Northwind Wealth | Rule 204-2 | OK |
| Pacific Behavioral | HIPAA | OK |
Overview
Partner console
All clients in one view: deployment status, DNS health, policy, audit summaries, seats, invoices.
25% margin, deal registration
Registered, Silver and Gold tiers from 25% to 35%. Monthly payouts or bill-through.
We do onboarding with you
Connector and DNS on a call with your tech; migration runbooks; escalation to US-based tier 2.
Standard protocols
SMTP relay, EWS, ActiveSync, IMAP. Nothing proprietary on the client side.
Evidence for your clients
Per-client audit exports and the annual compliance letter make your QBRs easier.
Co-marketing
Webinars, one-pagers and a listing in the partner directory.
What PXCMail is for an MSP
PXCMail is a compliance layer you deploy on the Google Workspace or Microsoft 365 tenants you already manage. For each client you pick an industry profile (HIPAA for a dental office, FTC Safeguards for a CPA firm, ABA 477R and ALTA for a title company, Rule 204-2 for an RIA), connect an outbound route or connector, add three DNS records, and the policy engine takes over: TLS required on every message, encrypted delivery when the recipient cannot do TLS, detection packs that catch SSNs, MRNs, W-2s and wire instructions before they leave, a one-year archive and a per-message audit trail. You see all of it in one partner console. Nothing runs on the client’s machines and nothing is proprietary on their side: SMTP relay, EWS, ActiveSync and IMAP.
The partner program pays 25% margin at Registered, 30% at Silver (10 client organizations or 150 seats) and 35% at Gold (30 organizations or 500 seats). You can bill through at list minus margin, or let the client pay PXCMail and take a monthly payout on collected fees. Deal registration protects an opportunity for 90 days at Registered; Gold adds protected accounts. The client signs the BAA or safeguards addendum directly with PacinfraX. You cannot alter it, and that is deliberate: it is the document their auditor will ask for.
A first client in an afternoon
Coastal IT Partners manages 31 clients; four of them are regulated. Lakeside Family Dental (12 people, Google Workspace, Dentrix), Ortiz CPA (9 people, Microsoft 365, Drake and TaxDome), Harbor Title (14 people, Microsoft 365, Qualia) and Northwind Wealth (5 advisers, Google Workspace, Orion and Redtail). They started with Lakeside, because the office manager had just received a cyber-insurance renewal questionnaire asking whether email was encrypted and whether PHI was detected before it left.
- 1:00 pm, create the organization. In the partner console Coastal adds Lakeside, chooses the Healthcare profile and invites the office manager as Owner. She signs the BAA electronically during signup. Coastal’s access to the organization is time-limited, visible to Lakeside and logged.
- 1:15 pm, connect Google. On a call with a PXCMail engineer, Coastal adds the outbound relay route in Google Admin, then the SPF include, DKIM and DMARC records at the registrar. The DNS wizard re-checks every five minutes; the console shows green within the hour.
- 1:45 pm, policy in test mode. The Healthcare pack is on: patient identifiers, insurance IDs, ICD-10 and CPT codes, attachments scanned. In test mode nothing is encrypted or held yet; every message is scored and logged so the office manager can see what would have happened.
- Next morning, enforce. Coastal reviews the overnight log with her: a few dozen external messages, a handful that would have been encrypted (treatment plans and pre-auths from
frontdesk@andinsurance@), none that would have been blocked. They switch the policy to enforce. Staff keep using Gmail. Dentrix keeps sending through the same account and inherits the policy.
The second client takes less time: the Safeguards profile for Ortiz CPA is a template, and the Microsoft 365 outbound connector is a known 20-minute job. By the end of the month all four are live, and Coastal has one health screen that flags DKIM drift before a client calls about it.
By the numbers
- The FBI’s IC3 logged 21,442 business email compromise complaints and $2.77 billion in BEC losses in 2024 (IC3 2024 Internet Crime Report).
- In Coalition’s 2026 Cyber Claims Report, BEC and funds-transfer fraud were 58% of all claims, and the average BEC loss was about $27,000 (Coalition).
- NetDiligence’s 2025 study found 98% of cyber claims came from small and mid-sized businesses (NetDiligence Cyber Claims Study 2025).
Those are your clients. The carrier knows it, which is why the renewal questionnaire keeps getting longer.
What your clients’ carriers and auditors ask you
When a renewal questionnaire or an audit request lands, it usually lands on the MSP. These are the questions we see most, and what the console gives you to answer them.
- “Is email encrypted in transit and at rest?”
- Yes, with evidence: TLS required on every outbound message, encrypted delivery on fallback, and a per-message record of which method was used. The quarterly compliance report summarizes it per client.
- “Do you have DLP for PHI, SSNs or wire instructions?”
- Detection packs per profile, with five actions (deliver, encrypt, warn, hold, block). The audit log shows each decision and its reason; export it for the carrier.
- “Where is the BAA, and does it cover the email vendor?”
- Signed electronically at signup and stored under Agreements in the client’s console; you can retrieve it from the partner console.
- “How long do you keep email, and can you produce it?”
- One year on every plan; 6 years for healthcare and legal and 7 for accounting with the archive add-on. Exports in EML, MBOX or PST with a sha256 manifest and a chain-of-custody statement.
- “Who at the vendor can read our mail?”
- Access to message content is US-only and logged; tier-1 support in Southeast Asia sees configuration and metadata only; no AI reads mail by default. See Security and Subprocessors.
For QBRs, pull the evidence pack per client. It is mapped to the regulator’s questions, so you walk in with answers instead of screenshots.
Steps to go live as a partner
- Apply and sign the partner agreement. You start at Registered with a one-hour onboarding and the help center.
- Register your first deal. Registration protects it for 90 days while you scope it with the client.
- Deploy the first client with us on a call. That one is on us, whichever tier you are in.
- Choose billing per client: bill-through (consolidated invoice at list minus margin) or payout (monthly, on collected fees).
- Wire alerts into your PSA. Held messages, DNS drift and reputation warnings can post to ConnectWise, Autotask, HaloPSA or a Slack or Teams channel.
Pricing math for a four-client book
| Client | Plan | Seats | List per month |
|---|---|---|---|
| Lakeside Family Dental | Gateway, Healthcare profile ($6) | 12 | $72 |
| Ortiz CPA | Gateway + 7-year accounting archive ($9) | 9 | $81 |
| Harbor Title | Gateway, Legal & title profile ($6) | 14 | $84 |
| Northwind Wealth | Gateway + RIA books-and-records archive ($10) | 5 | $50 |
| Total | 40 | $287 |
At Registered (25%) Coastal keeps $71.75 a month, about $861 a year, on four clients. At Silver (30%) it is $86.10 a month; at Gold (35%), $100.45. On bill-through Coastal is invoiced $215.25 and bills each client at list or at its own managed-service rate. The $49 minimum per organization matters for the smallest clients: Northwind’s five seats on plain Gateway would be $30, so the minimum would apply; with the RIA archive at $10 a seat it clears the minimum on its own. Hosted is $12 a seat and Hosted Pro $18 when a client wants the mailbox from the same vendor; migration is free up to 50 seats. Every price is billed yearly, and the 14-day trial charges nothing. Pricing
Questions MSPs ask
Do I need to install anything on the client side?
No. Gateway is a relay route in Google Admin or an outbound connector in Exchange, plus DNS records. Hosted uses native Outlook, iPhone and Android sync. There is no agent and no proprietary protocol.
Can I manage policy for every client from one place?
Yes. The partner console shows every client’s deployment status, DNS health, policy, seats and invoices, and you can open any client’s console with time-limited access that the client can see. Policy templates per profile mean you set the Healthcare pack once and apply it to the next clinic.
Who signs the BAA, the client or me?
The client. The BAA (with the 42 CFR Part 2 QSOA where it applies), the Data Processing & Safeguards Addendum and the RIA vendor letter are signed by the end customer with PacinfraX during signup. Partners may resell or refer; they may not alter agreements.
What happens if a client leaves me, or I leave the program?
Clients keep their service and choose their support path. Either party may end the partner agreement with 60 days’ notice. A client that leaves PXCMail gets an export of everything within 30 days and a certificate of destruction. Full terms: Partner terms.
Is there an API, a sandbox, SCIM?
Partner console, API and sandbox come with every tier; Gold adds a Terraform provider. SCIM provisioning is ROADMAP; directory sync from Google or Entra creates users today. Our Outlook and Gmail add-ins, SOC 2 Type I and the independent pentest letter are also ROADMAP; we will not tell your client otherwise.
Does it make sense on a Business Premium tenant that already has Purview?
Often, yes. Gateway adds the industry templates, a per-message audit trail, encrypted delivery the recipient opens with a one-time code and a human who sets it up on a call. If you have the Purview hours to spare and the client only needs encryption, say so to the client; see the Microsoft 365 comparison.