Keep Gmail or Outlook, or move to PXCMail. Every message is TLS-enforced, encrypted when it has to be, scanned for sensitive data and written to an audit trail. BAA or industry addendum included.
Prices are the same in every industry; the industry profile (HIPAA, FTC Safeguards, legal, RIA) sets the agreement, detection rules and retention. All four profiles — healthcare, accounting & tax, legal & title, wealth — are available today.
Stay on Google Workspace or Microsoft 365. Route mail through PXCMail. No migration.
Live in 30 minutes. $49 practice minimum.
A full mailbox for every person, with Outlook, iPhone and Android working natively.
Multi-factor sign-in required for everyone.
For practices that get audited, hold records for years, or want their own branding.
Or start a trial and upgrade later.
| Feature | Gateway | Hosted | Hosted Pro |
|---|---|---|---|
| Mailbox, calendar, contacts | Your current provider | 50 GB included | 50 GB included |
| Outlook, iPhone, Android native sync with device policies | Via your provider | Yes | Yes |
| Dedicated encryption key for your practice (AWS KMS) | — | Yes | Yes |
| Archive retention | 1 year (6-year add-on) | 1 year (6-year add-on) | 6 years, immutable |
| Legal hold & retention policies | — | — | Yes |
| Branded webmail on your domain | — | — | Yes |
| Uptime SLA with credits | 99.9% target | 99.9% target | 99.9% contractual |
| Audit export API | CSV | CSV | CSV + API |
| Support | Standard | Standard | Priority |
| Migration | Not needed | Free up to 50 seats | Free up to 50 seats |
| Feature | Gateway $6 | Hosted $12 | Hosted Pro $18 |
|---|---|---|---|
| Agreements & compliance | |||
| Business Associate Agreement / Data Processing & Safeguards Addendum | ✓ | ✓ | ✓ |
| Industry profile (healthcare, accounting, legal, wealth) | ✓ | ✓ | ✓ |
| Quarterly compliance report, annual safeguards letter | ✓ | ✓ | ✓ |
| Evidence packs by regulator | ✓ | ✓ | ✓ |
| Encryption & delivery | |||
| Enforced TLS; S/MIME automatic | ✓ | ✓ | ✓ |
| Locked delivery with one-time code; secure reply; 2 GB attachments | ✓ | ✓ | ✓ |
| Branded notifications and reading page on your subdomain | add-on $1/seat | add-on $1/seat | ✓ |
| Dedicated IP pool by industry tier | ✓ | ✓ | ✓ |
| Detection & DLP | |||
| Industry detection packs; custom patterns; keyword lists; document fingerprints | ✓ | ✓ | ✓ |
| Five actions (deliver, encrypt, warn, hold, block); test mode; versioned policy | ✓ | ✓ | ✓ |
| OCR of scanned attachments and images | — | — | ✓ |
| Inbound filtering (MX): spam, malware, impersonation banner, payment-change detection | optional | included | included |
| Mailbox & devices | |||
| Mailbox 50 GB, calendar, contacts, shared mailboxes, groups, resources | your provider | ✓ | ✓ |
| Outlook, iPhone, Android native (EWS/EAS) with device policies and remote wipe | your provider | ✓ | ✓ |
| Dedicated encryption key per organization | — | ✓ | ✓ |
| Migration from Google / Microsoft | not needed | free ≤ 50 seats | free ≤ 50 seats |
| SSO (SAML/OIDC) for console and webmail | — | — | ✓ |
| Archive & audit | |||
| Searchable archive | 1 year | 1 year | 6/7 years immutable |
| Archive add-on: 6/7-year immutable retention | $3/seat | $3/seat | included |
| Legal hold | with archive add-on | with archive add-on | ✓ |
| Audit trail (6 years), CSV export | ✓ | ✓ | ✓ |
| API & webhooks | — | — | ✓ |
| Service | |||
| Support: human within 15 minutes (business hours), 24/7 outages | ✓ | ✓ | priority |
| Onboarding and DNS on a call | ✓ | ✓ | ✓ |
| Availability | 99.9% target | 99.9% target | 99.9% SLA with credits |
| Data location and access | US; US-only content access | US; US-only content access | US; US-only content access |
| Archive add-on (6- or 7-year immutable retention, legal hold) | $3 per seat / month on Gateway and Hosted |
|---|---|
| Branding add-on (logo, subdomain, colors on recipient pages) | $1 per seat / month (included in Pro) |
| Extra mailbox storage (Hosted) | $2 per 50 GB block per seat / month |
| Migration above 50 seats | $15 per seat, one-time |
| Practice / firm minimum | $49 per month on any plan (covers up to 8 Gateway or 4 Hosted seats) |
| Volume (over 100 seats) | 10% off list; over 250 seats, contact us |
| Partners (IT providers, billing companies) | 25–35% margin, bill-through or payout — partner program |
| Nonprofits and FQHCs | 15% off list with proof of status |
| Founding customers | Pricing locked for three years, in writing |
[SECURE] in the subject or let PHI detection decide. Nothing new to learn.Google and Microsoft will sign a BAA on the right plan. What they won’t do is encrypt the message when the patient’s mailbox can’t do TLS, catch a social security number before it leaves, or hand you an audit trail your auditor can read. Gateway adds exactly that for $6 per seat — and you keep everything else.
Compared with moving everyone to a $14–18 “HIPAA” mailbox elsewhere, you keep your tools and pay only for the layer you were missing.
Add Gateway to Google or Microsoft“Our office manager set it up during lunch. The DNS call took twelve minutes.”
“I send intake summaries from my phone and I can show the audit trail if anyone asks.”
“We kept Google. We just stopped guessing whether a message was actually encrypted.”
Testimonials and logos are placeholders until customer approvals are in. Read our Trust Center for the pentest letter, SOC 2 status, subprocessors and a sample BAA.
The BAA makes Google a business associate; it doesn’t change what happens to a message when the recipient’s server can’t encrypt, or when someone types a social security number into an email. Gateway adds enforced TLS, encrypted fallback, PHI scanning and an audit trail on top of the Google account you keep.
No. If a message has to be encrypted, the patient gets a link and a one-time code by text or email, and reads it in the browser on their phone. They can reply securely from there.
In Amazon Web Services regions in the United States, encrypted in transit and at rest. Hosted and Pro practices get their own encryption key. Support staff outside the US never have access to message content.
No AI reads your mail by default and we never train models on customer data. PHI detection uses pattern rules and, optionally, a HIPAA-eligible medical entity service that only returns a yes/no verdict and stores nothing.
Yes. Standard protocols (IMAP, EWS, ActiveSync) work from day one, and when you leave you get a full export of mail, calendar, contacts and your archive within 30 days, plus a certificate of destruction.
Most practices under 50 seats move in a single afternoon. Mail syncs in the background while you keep working; we switch DNS with you on a call. Migration is free up to 50 seats.
Yes. Hosted and Pro use ActiveSync and EWS, so the built-in mail apps on Android and iPhone, and Outlook on every platform, work natively — including PIN and remote-wipe policies.
Per seat, monthly or yearly in advance; yearly saves two months. Seats follow your directory when sync is on; added seats are prorated, reductions apply at renewal. Pay by card, Apple Pay, Google Pay, Link, ACH or PayPal; invoicing for annual plans over 25 seats. Sales tax applies by billing address unless you upload an exemption.
Yes, any time. Upgrades take effect immediately and are prorated; downgrades at the next renewal. Gateway → Hosted includes migration.
Monthly plans are month to month. Yearly plans are 12 months with a 60-day proration window; see cancellation & refunds. No cancellation fees, no calls to cancel.
A named user mailbox (Hosted) or a named sender whose outbound mail is processed (Gateway). Shared mailboxes, aliases, groups and resources are free.
The practice minimum is $49 per month on any plan. A $29/month single-seat Solo plan is on our roadmap; tell us if you need it and we’ll put you on the list.
Start a trial, or book 15 minutes and we’ll set DNS up together.
Comparing options? Google Workspace · Microsoft 365 · Hushmail · Paubox.