What’s live, what’s dated, what’s being evaluated.
We would rather publish a date and miss it by a month than imply something exists. Dates are quarter-level and updated monthly.
| Item | Status | Target |
|---|---|---|
| Gateway and Hosted general availability | Scheduled | GA quarter |
| Independent penetration test (platform, tenant isolation) | Scheduled | Before GA; letter published here |
| HIPAA risk analysis and policy set | In place | Reviewed annually |
| Cyber liability and E&O insurance | In progress | Before GA |
| SOC 2 Type I | Scheduled | Within 9 months of GA |
| SOC 2 Type II | Planned | 12 months after Type I observation start |
| HITRUST e1 / i1 | Evaluating | On customer demand, year 2 |
| Inbound URL detonation sandbox | Planned | GA + 2 quarters |
| Recipient sign-in with Google/Apple/Microsoft (no code) | Planned | GA + 2 quarters |
| Outlook and Gmail “Send secure” add-ins | Planned | GA + 2 quarters |
| SCIM provisioning | Planned | GA + 3 quarters |
| Secure fax and intake forms via partners | Planned | GA + 3 quarters |
| Solo plan (1–2 seats) | Planned | GA + 1 quarter |
| Broker-dealer edition (Rule 17a-4, FINRA 3110) | Evaluating | Year 2 |
| Files / drive product | Evaluating | On customer demand |
| AI-assistant hardening: strip and flag prompt-injection traces in inbound mail ROADMAP | Planned | Q1 2027 (March) |
| AI tool inventory: which assistants and connectors can read which mailboxes ROADMAP | Planned | Q2 2027 (May) |
| BAA registry: every BAA and service-provider addendum in one exportable register ROADMAP | Planned | Q2 2027 (June) |
How we date things
Each row has one of five states. In place means the control exists and is reviewed on the cadence shown. In progress means a contract is signed or work has started. Scheduled means a date is fixed relative to general availability. Planned means it is on the engineering plan with a target quarter. Evaluating means we have not decided to build it, and we say so rather than list it as planned. If a date slips, the new date appears here before it appears anywhere else, with a line in the changelog.
The three AI items
They come from a decision we wrote down in October 2026: every control in the mail path stays deterministic and explainable, no model reads customer mail by default, nothing is trained on customer data, and software never signs an agreement, places a phone call or approves a transfer on a customer’s behalf. The hardening item protects the assistants customers already run on their inboxes (Copilot, Gemini and similar) from instructions hidden in inbound mail: CSS-hidden or zero-size text, zero-width characters, imperatives in Base64 or HTML comments, hidden PDF layers, and dual-target phishing that addresses a person and a machine at once. Matches are stripped or flagged and logged with the reason. The inventory item lists which assistants and connectors can read which mailboxes, for the technology-asset inventory in the proposed HIPAA Security Rule update and for insurance questionnaires. The registry item keeps every business associate agreement and service-provider addendum in one place with an export, which is what the Safeguards Rule’s service-provider oversight element and a HIPAA auditor’s vendor question both ask for.
What we will not put on this table
- A SOC 2 or HITRUST claim before the report exists. Until then, the security whitepaper and the AWS reports available through AWS Artifact are the evidence.
- “HIPAA certified”. There is no such certification; we publish the controls map instead.
- Any claim that a detector catches every phishing message or every prompt injection.
Questions
Can we get the SOC 2 report before it is published here?
No, because it does not exist yet. We will send the auditor’s engagement letter and the pentest letter under NDA once each is signed, and the report itself the week it is issued.
Can a customer request a roadmap item?
Yes. Write to support with the item and the regulation or questionnaire question behind it. Requests with a stated requirement behind them are weighted highest.
How often is this page reviewed?
Monthly, and whenever a date changes. The changelog records each edit.