What’s live, what’s next.

Live Available today

• Gateway for Google Workspace and Microsoft 365: enforced TLS, encrypted delivery with one-time code, PHI detection, archive, audit trail, BAA.
• Hosted mailboxes with Outlook, iPhone and Android native sync and device policies.
• Industry profiles for healthcare, accounting & tax, legal & title and wealth: agreement, detection pack and retention defaults set at signup.
• Migration from Google Workspace and Microsoft 365.
• English and Spanish patient-facing notifications.

Rolling out Available on request

• Self-service policy editor for practice admins.
• Partner console for IT providers managing multiple practices.
• Annual compliance letter generator.

Roadmap In development

• Patients opening encrypted messages with Google, Apple or Microsoft sign-in (no code).
• Outlook and Gmail “Send secure” add-ins.
• Medical-entity PHI detection (HIPAA-eligible, opt-in) and detection inside scanned images.
• Secure fax and intake forms via partners.
• Solo plan for single-seat practices.
• Broker-dealer edition (Rule 17a-4, designated third party, FINRA 3110 supervision).
• SOC 2 Type I report; independent penetration test letter published in the Trust Center.
• ROADMAP AI-assistant hardening (target March 2027). Inbound mail is checked for the technical traces of prompt injection before an assistant such as Copilot or Gemini reads it: CSS-hidden or zero-size text, zero-width characters, imperatives hidden in Base64 or HTML comments, hidden PDF layers, and messages that address both a person and a machine. Matches are stripped or flagged with a banner and written to the audit log with the reason. We will not claim to catch every injection; we will publish what the detector looks for.
• ROADMAP AI tool inventory (target May 2027). A console screen that lists which AI assistants and connectors have access to your mailboxes, what each can read, and whether an agreement covers it. Built for the technology-asset inventory in the proposed HIPAA Security Rule update and for the “which AI tools touch client data” question on cyber-insurance applications.
• ROADMAP BAA registry (target June 2027). One place to record every business associate agreement and service-provider addendum your organization holds: vendor, scope, signed date, renewal, who signed. Exports as the vendor list an auditor or the Safeguards Rule’s service-provider oversight requirement asks for.

How to read this page

Live means you can use it today on the plan named. Rolling out means it exists and we enable it per organization on request, usually within a business day, while we finish the self-service version. Roadmap means it is being built and has a target month; the month is our honest estimate, revised here first if it slips. If a sales conversation or a page on this site says something is available and this page says roadmap, this page is right and we would like to hear about it.

The three AI items follow the same rule as everything else on the roadmap: every control in the mail path stays deterministic and explainable, no model reads your mail by default, nothing is trained on customer data, and an assistant never signs an agreement, places a call or approves a payment on your behalf. The first item makes other people’s assistants safer to run on your inbox; the second shows you which of them exist; the third keeps the paperwork those assistants and every other vendor create in one register.

Changelog

Entries are added for every customer-visible change, with the date, the plan it applies to, and whether any action is needed. Subscribe by RSS or email at general availability.

Date	Change	Applies to	Action needed
GA	Gateway and Hosted general availability; industry profiles for healthcare, accounting & tax, legal & title, wealth	All	—
GA	Console, policy editor with test mode and versioning, quarantine, archive search, evidence packs	All	—
GA	Partner console and provisioning API (sandbox)	Partners	Request access
GA	Help center (40 articles), Trust Center documents, status page	All	—