Everything we’d want to know before trusting a vendor with patient email.
PXCMail is operated by PacinfraX Corporation, 19900 MacArthur Boulevard, Suite 915, Irvine, CA 92612. This page is written for compliance officers, IT providers and the practice owner who reads the fine print. It says what is in place today and what is scheduled, with dates.
Overview
Business Associate Agreement
Signed electronically before activation. Breach notification to you within 72 hours of determination. Read the sample BAA.
Hosted on AWS, US only
AWS HIPAA-eligible services under AWS’s BAA with us. Primary region us-east-1, disaster recovery us-west-2. No data outside the United States.
Encryption
TLS 1.2+ in transit; AES-256 at rest via AWS KMS; dedicated key per practice on Hosted and Pro; immutable storage for archives.
Access control
MFA for all customers and staff; hardware security keys for administrators; time-limited privileged access; no standing access to message content.
Offshore access policy
Tier-1 support outside the US sees metadata only. Message content is accessible only to US-based tier-2 staff, on written customer request, and every access is logged.
Independent penetration test
Third-party test of the platform and tenant isolation before general availability; summary letter published here.
SOC 2 Type I, then Type II
Type I targeted within 9 months of launch; Type II observation begins immediately after.
Risk analysis & policies
Written HIPAA Security Rule risk analysis, 20 security policies, annual workforce training, incident response plan with tabletop exercises.
Security whitepaper → · Incident response → · Business continuity → · Data residency → · Responsible disclosure → · Transparency → · Roadmap → · Security details → · HIPAA & the BAA → · Subprocessors → · Status →
Security questionnaire?
We maintain completed SIG Lite and CAIQ questionnaires, a one-page architecture diagram, our certificate of insurance and W-9. Request the procurement kit.
Report a concern
[email protected]. We acknowledge within one business day.