Catch it before it leaves.
Most breaches are not hackers. They are a billing summary sent to the wrong address, a spreadsheet attached by habit, a diagnosis typed into a subject line. PXCMail checks every outbound message and attachment against your industry detection pack and your own rules, and acts before delivery — in under half a second.
| Message | Found | Action |
|---|---|---|
| Re: estimate | MRN · DOB | Encrypt |
| FWD: patient list.xlsx | 214 names + DOB → personal gmail | Blocked |
| Wire for Friday | Routing + account | Lock + notice |
| Lunch Friday? | — | TLS ✓ |
Your industry’s patterns, maintained by us.
Healthcare
SSN, MRN formats, NPI, DEA numbers, ICD-10 and CPT codes, medication names, lab value patterns, insurance member IDs, dates of birth with names, 42 CFR Part 2 program markers.
Accounting & Tax
SSN, EIN/ITIN, W-2/1099/1040/K-1 document fingerprints, bank account and routing numbers, card numbers (Luhn), payroll registers, direct-deposit change language.
Legal & Title
Wire instructions, ABA routing numbers, escrow and IOLTA account references, matter numbers, privilege markers, settlement terms, closing-date language.
Wealth & RIAs
Account numbers, SSN, statements, “guaranteed return” and performance-claim lexicon, off-channel language, personal-trading references.
Custom rules
Regular expressions with validators, keyword lists, client-name lists synced from your CRM, chart-number formats, document fingerprints from your own templates.
Attachments
PDF, Word, Excel, PowerPoint, CSV, ZIP (one level), images with OCR on Pro; password-protected files are flagged as unscannable and handled by policy.
Five things a rule can do
- Deliver — TLS required; the message is logged as scanned with no findings or with findings below threshold.
- Encrypt — locked delivery with a one-time code (the usual choice for PHI and tax documents).
- Warn — bounce back to the sender with what was found and how to send it safely; nothing leaves.
- Hold — queue for a supervisor or compliance role to release or reject, with reasons logged (bulk sends, external forwards).
- Block — for destinations that should never receive the content (personal mailboxes, competitors, countries).
Actions can depend on recipient domain, sender role, attachment type, confidence score and count of findings. Every rule has a test mode that logs what it would have done.
False positives are a cost. We measure them.
Every finding carries a confidence score; packs ship with thresholds tuned on real practice mail (with consent), and the console shows precision for your tenant over the last 30 days. Users can report a false positive from the warn bounce; compliance roles can whitelist a pattern with one click, and the change is logged.
No AI reads your mail by default
Detection is pattern- and fingerprint-based. An optional HIPAA-eligible medical-entity service (Amazon Comprehend Medical) can be enabled per tenant to improve clinical detection; it runs inside our AWS account, returns entity types and a verdict, retains nothing, and is off until you turn it on.
Limits and behaviors
| Scan scope | Subject, body (text and HTML), headers, attachments; nested archives one level; images via OCR (Pro) |
|---|---|
| Latency | < 500 ms typical; attachments > 10 MB scanned asynchronously with a delivery delay shown in the audit trail |
| Rules per tenant | Up to 500 custom rules; 50 keyword lists of 10,000 entries; CRM-synced lists refreshed hourly |
| Exceptions | By recipient domain, sender, group, attachment type; logged; cannot disable TLS |
| Hold queue | Items expire after 7 days (configurable); reviewers notified by email; actions logged |
| Reporting | Findings by rule, user, destination; precision estimate; quarterly compliance report |
| Inbound | Same engine applies to inbound when MX is routed through PXCMail: impersonation, payment-change language, malware, links |
Questions about detection
Will it block legitimate mail?
The default actions for most findings are encrypt or warn, not block. Block is reserved for destinations you choose. Test mode lets you see what a rule would do before enabling it.
Can staff override a decision?
They can add [SECURE] to force encryption. They cannot force plain-text delivery of detected content; a compliance role can release a held message, and that is logged.
Does it work on mail sent from our EHR or tax software?
Yes, if that software sends through your Google or Microsoft account (or through PXCMail Hosted). Software that sends from its own servers is outside your domain’s policy.
What about internal mail?
On Hosted, internal mail is archived and can be subject to rules you enable (for example, blocking patient lists to personal devices). On Gateway, internal mail stays inside your provider.