Built to keep delivering mail when something fails.
Short answer: if a data center fails, PXCMail keeps running without any action from you. If the whole us-east-1 region fails, we recover in us-west-2 with a recovery time objective of 4 hours and a recovery point objective of 15 minutes for mailbox and archive data. During either event, mail sent to you waits on the sender’s server and is delivered when ingress returns, so a delay does not become a loss. The targets, the scenarios and what we rehearse are below, followed by the few things we ask you to keep ready at your end.
Objectives
| Measure | Target |
|---|---|
| Recovery time objective (RTO) | 4 hours for full service in the DR region |
| Recovery point objective (RPO) | 15 minutes for mailbox and archive data; near-zero for configuration |
| Availability | 99.9% monthly (contractual on Hosted Pro) |
| Mail queuing | Senders’ providers retry for up to 24–72 hours; no mail is lost during an ingress outage |
Scenarios and responses
| Scenario | Design response |
|---|---|
| Availability-zone failure | All components run in at least two AZs; automatic failover; no customer action |
| Region failure (us-east-1) | Archive and audit replicated to us-west-2; configuration restored from continuous backup; ingress and sending re-pointed by DNS; mailbox organizations restored from managed backups; runbook rehearsed quarterly |
| Data corruption or ransomware | Immutable (Object Lock) archive and audit copies; backup vaults locked; point-in-time recovery for configuration; isolated restore environment |
| Loss of a key vendor | Standard protocols at every boundary (SMTP, IMAP, EWS/EAS, OIDC, S3); migration runbooks to alternative mailbox and gateway components rehearsed; subprocessor exit plans documented |
| Key personnel unavailable | Two people per system; runbooks and architecture decisions in version control; on-call rotation; retained contractors |
| Office or regional disruption | Remote-first operations; no customer data on endpoints; MFA and managed devices |
| Pandemic or prolonged staff absence | Cross-trained support; reduced-service plan prioritizing mail flow, security and support over new features |
Backups
Three kinds of copy exist at any time. The archive and audit trail are written to immutable storage (S3 Object Lock) in us-east-1 and replicated to us-west-2, so neither we nor an attacker holding our credentials can shorten or alter them. Mailboxes on Hosted plans are covered by managed backups with point-in-time recovery to the 15-minute RPO. Configuration (policies, users, domains, device policies) is backed up continuously and versioned, so a bad policy change can be rolled back to the previous version from the console without a recovery event. Restores are exercised quarterly, not assumed.
Exercises
Quarterly recovery exercises (restore from backup, AZ loss, and annually a full region failover) with results summarized in the Trust Center; findings tracked to closure.
Communication
Status page from an independent monitor; email and console notices for incidents affecting your organization; post-incident reviews for outages over 30 minutes.
What we ask you to keep ready
- Registrar access. Know who holds the login to your DNS registrar and keep MFA on it. Region failover on our side is DNS-driven, and in a rare case we may ask you to confirm a record.
- Do not repoint MX on your own. Senders’ providers retry for 24 to 72 hours, and moving MX straight to Google or Microsoft bypasses the policy engine and the archive. Change DNS only when an incident entry on the status page tells you to.
- Keep contacts current. The account owner and Security Officer under Console → Organization receive incident email. A departed office manager on that list means nobody hears from us.
- Subscribe to the status page and put the link in your own continuity plan next to your mailbox provider and your practice-management vendor.
- Write us into your plan. Your continuity plan should say what staff do while email is delayed. For Harbor Title, that means wire instructions are confirmed by phone on the number on file and no closing proceeds on an emailed change, which is the rule on a normal day too.
Example
A Tuesday at Harbor Title. At 2:05 pm the status page shows mail ingress degraded in us-east-1 and an incident acknowledged. Escrow officer Maria keeps working in Qualia; inbound mail from lenders queues on their servers. At 2:40 the incident entry says the region failover has begun. By 4:30 ingress is accepting mail in us-west-2, the queued messages arrive, and the archive shows no gap because journaling resumed from the replicated copy. Nothing changed at Harbor Title’s registrar. The post-incident review appears within ten business days because the incident ran over 30 minutes.
FAQ
Does a failover change where my data lives?
No. us-west-2 is in the United States, and the access rules are the same in both regions.
Are the RTO and RPO contractual?
They are stated in the SLA for every plan. Service credits for availability apply on Hosted Pro.
Can I see the results of the exercises?
A summary of each quarterly exercise and the annual region failover is published in the Trust Center, with findings tracked to closure. A SOC 2 report is ROADMAP, not live.
What happens to locked-delivery links during an outage?
Notifications already sent stay valid; the reading page returns when the component recovers. Revocations made during the outage apply as soon as the console is back.
Contact
Questions about continuity, or a request for the current exercise summary: [email protected].