Compliant email for regulated small businesses

Every message encrypted. Every message on the record.

PXCMail encrypts what has to be encrypted, stops a social security number before it leaves, and writes the audit trail your regulator asks for. Your team keeps Gmail or Outlook. From $6 per seat.

Start free trial See a 2-minute demo

14-day trial · BAA or Safeguards addendum signed in signup · $49 practice minimum · cancel any time

Audit trail · Lakeside Family Dental · today

Time	From → To	Detection	Delivery
09:14	frontdesk@ → patient (gmail)	Treatment plan · MRN	Encrypted · opened 09:20
09:31	dr.alvarez@ → oralsurgery.org	Referral · DOB	TLS ✓ · S/MIME
10:02	billing@ → insurer	Pre-auth · member ID	TLS ✓
10:15	m.chen@ → personal gmail	Patient list (CSV)	Blocked · policy

Patient’s phone

Secure message from Lakeside Family Dental

Enter the code we texted you

4 8 2 1

Hi Elena — your treatment plan and estimate are attached. Reply here if you have questions. — Dr. Alvarez

Built for practices that have to get this rightFamily dental groupsBehavioral health practicesMedical billing companiesCPA & tax firmsTitle & escrowHealthcare IT MSPs

One platform

Keep what works. Fix what doesn’t.

Two ways to start, one price list, one console. Pick an industry profile and PXCMail sets the agreement, the detection rules and the retention defaults.

Gateway — keep your email

Route Google Workspace or Microsoft 365 through PXCMail. Enforced TLS, encrypted delivery, sensitive-data detection, archive, audit. Live in 30 minutes, no migration. $6/seat.

How Gateway works →

Encrypt when PHI detected

Require TLS to all recipients

Block forwarding to personal mail

Hosted — a full mailbox

50 GB mailbox, calendar, contacts, native Outlook, iPhone and Android with PIN and remote-wipe, your own encryption key. $12/seat.

How Hosted works →

Device	Policy
iPhone 15 · M. Chen	PIN ✓ · Encrypted ✓
Pixel 8 · J. Park	PIN ✓ · Encrypted ✓
Outlook · Front desk PC	MFA ✓

Encrypted delivery

TLS required. If the other side can’t, the patient or client opens with a one-time code — no account, no app.

How it feels on a phone →

Detection & DLP

SSNs, record numbers, tax forms, wire instructions — the patterns of your industry, caught before delivery.

What it looks for →

Archive & audit

Immutable archive, legal hold, and exports mapped to the questions auditors ask.

Built for the day someone asks →

Built for the firms that have to get this right

Pick your industry. The agreement, detection rules and retention follow.

HealthcareHIPAA · 42 CFR Part 2 · BAA includedTherapists, dental, medical practices, billing. Accounting & TaxFTC Safeguards Rule · IRS Pub 4557Protect W-2s, 1099s and SSNs automatically. Legal & TitleABA 477R · wire-fraud defense · legal holdLaw firms, title and escrow companies. Wealth & RIAsAdvisers Act Rule 204-2Books-and-records archive, exam-ready.

Same platform, same price list, same console. The profile sets the agreement, the detection rules and the retention defaults. IT providers: manage every regulated client from one view →

How it works

Three things change. Nothing your staff does.

01 · Connect

Point your email at PXCMail in 15 minutes

A Google SMTP relay or Microsoft 365 connector, plus DNS records we generate for your registrar — done with you on a call if you like. Hosted customers get migration included.

No new addresses, no new apps
BAA or Safeguards addendum signed in the flow

Connect your domain · lakesidedental.com

SPF	✓ published
DKIM (3)	✓ published
MAIL FROM	✓ aligned
Relay	✓ Google Workspace → PXCMail
Test message	✓ TLS · scanned · archived

02 · Protect

Every outbound message is scanned and encrypted by policy

Industry templates decide what counts as sensitive. TLS is required; encrypted delivery steps in when the other side can’t. Type [SECURE] to force it.

Healthcare, accounting, legal and wealth detection packs
Inbound spam, malware and impersonation checks

Secure message · Ortiz CPA

Enter the code we texted you

7 3 0 9

Your 2025 return draft is attached. Review pages 1–3 and reply here with changes. — Dan

Expires in 30 days · every open is logged

03 · Prove

The record writes itself

Who sent what, to whom, how it was encrypted, when it was opened. Archive and audit exports mapped to the questions HHS, the FTC and examiners actually ask. An annual letter for your file.

Immutable archive, legal hold on Pro
CSV today, API on Pro

Export · Q3 2026 · for auditor

Metric	Value
Messages scanned	41,208
Delivered with TLS	98.6%
Encrypted delivery (code)	1.3%
Blocked by policy	17
Integrity	sha256 ✓ · immutable

30′

typical time to first secure message

15′

first support response, business hours

per seat to make Gmail or Outlook compliant

AWS regions; only US staff see content

Proof, next to every promise

Practices that stopped worrying about email.

Illustrative

“Our office manager set it up during lunch. The DNS call took twelve minutes.”

JRPlaceholder — Office Manager, family dental practice (3 locations)

Illustrative

“I send intake summaries from my phone and I can show the audit trail if anyone asks.”

MKPlaceholder — LCSW, group behavioral health practice

Illustrative

“We kept Google. We just stopped guessing whether a message was actually encrypted.”

DAPlaceholder — Owner, medical billing company

The agreement your regulator expects — BAA, Safeguards addendum — signed before your first message
TLS enforced on every outbound message; encrypted delivery when it can’t be
Hosted on AWS in US regions; your own encryption key on Hosted and Pro
Independent penetration test SCHEDULED · SOC 2 Type I ROADMAP
No AI reads your mail by default. We never train on your data.
No lock-in: IMAP, EWS, ActiveSync; export everything in 30 days when you leave