Paubox

Paubox is an email company built around HIPAA, the US health privacy law. Its products encrypt the everyday mail that clinics and hospitals send from Google Workspace, Microsoft 365 or Microsoft Exchange, and it also sells Paubox Marketing for campaigns and newsletters, a Paubox Email API for transactional mail from applications, HIPAA compliant forms, inbound threat protection, data loss prevention and archiving. The home page says it is trusted by 9,000+ healthcare organizations across the US, and the About page gives the company's goal as "Become the market leader for HIPAA compliant email security." The site groups its customers by size (small, mid-size, enterprise) and by industry, naming healthcare, insurance and education. It lists a G2 Best Software Awards 2026 placing among the Top 50 healthcare products.

Campaign email with Paubox Marketing

The product menu describes Paubox Marketing in one line: build, send, and track HIPAA compliant email campaigns. The clearest picture of it in use is the North Mississippi Health Services case study. That hospital system, with locations in Mississippi and one in Hamilton, Alabama, and over 90 primary and specialty clinics, had previously emailed only about appointments and operational status. Its digital marketing strategist started a newsletter of health education on Paubox Marketing and told Paubox she chose it for security and because several team members could learn it and send, so the work would not depend on one person.

The case study gives the practical details. Audiences can be segmented on factors the sender chooses, and the hospital uses gender, parental status, location and health condition so that people only receive information relevant to them. The strategist sends approximately five different newsletters to segments built from population data or expressed interest. The first newsletter, about a newly available procedure, brought in appointment requests and direct replies asking for more information. The most recent one went out to approximately 86,700 individuals, and more than half opened it. The team plans to add the Paubox Email API so that new subscribers are pulled into the system as soon as they sign up. The case study also says analytics were a requirement and that new features are added frequently based on customer feedback. The case study ends with an invitation to start HIPAA compliant email marketing for free.

Encrypted everyday email: Paubox Email Suite

The core product is Paubox Email Suite, which sits on top of an existing Google Workspace, Microsoft 365 or Microsoft Exchange account. The pricing FAQ says a business keeps its own address on its own domain, while consumer addresses such as gmail.com or yahoo.com are not compliant and should not be used. Its argument for the product: Google and Microsoft will sign business associate agreements, but those cover email within their servers and at rest, and Paubox secures mail in transit outside them.

According to the pricing page, every outbound email is encrypted automatically, with what Paubox calls patented blanket TLS encryption, and recipients get the message in their normal inbox without portals, passwords or plug-ins. Each email carries a footer saying Paubox secured it, and the headers show each relay secured with up to 256-bit AES encryption. If a recipient's server cannot handle TLS, Paubox uploads the message and attachments to its secure web app, one extra click for the reader. Attachments are encrypted, messages up to 150MB are supported, and replies are encrypted in transit by default. Senders can use phones, tablets and smartwatches with their usual mail apps. Other listed features are secure calendar invites from Outlook and Google Workspace, automatic enrollment of new senders on the domain, and verification that blocks sending to domains with expired or self-signed certificates. For deliverability, Paubox says it updates the SPF record and configures DKIM and DMARC so outbound mail avoids spam folders. Only TLS 1.2 and 1.3 are supported.

Security, DLP and archiving

Inbound security is sold as AI-powered. The home page says generative AI surfaces threats by analyzing tone, sender behavior and message intent, and explains why a message was flagged in plain language; it states that 54% of email security breaches start with malicious inbound emails. The pricing page lists phishing, malware, virus and business email compromise detection, spam filtering, display-name spoofing protection called ExecProtect+, labeling of safe senders with Paubox [Tags], link, attachment and QR code scanning, custom rules by domain, IP address or keyword, and quarantine reports.

The data loss prevention page, included with the Premium plan, says DLP scans the email body, sender, recipients and attachments, lets admins customize the criteria, quarantines emails with specific types of data, and notifies administrators. The page cites a $9.8M average cost of a healthcare data breach in 2024, says 45% of breaches are accidental or due to IT failure, and counts 10,000+ data breaches annually. Archiving keeps inbound and outbound mail with unlimited storage, searchable for audits, and the page says archiving cost does not rise with the volume stored.

Plans, trial and what every account includes

The pricing page offers three Email Suite plans, priced per sender, where a sender is one email address:

• Standard: HIPAA compliant email plus forms, described as set up in just 15 minutes.
• Plus: adds inbound protection against spam, ransomware and phishing, ExecProtect+, malware and virus protection, and transcription of audio attachments.
• Premium: adds archiving and data loss prevention.

Each plan includes a 14 day free trial, and the billing toggle says annual billing saves 30%. Paubox Email API and Paubox Marketing have their own tabs on the pricing page. No dollar amounts for the plans are printed in the page text.

The page lists what every plan includes: US-based support by phone or email, signable encrypted forms (free with any paid plan, which the page says saves over $1,000 per year), a business associate agreement at no extra charge, HITRUST certification, secure calendar invites, complimentary setup, a $250 referral credit and $100 off a renewal for adding a Paubox badge to your website. The support section adds chat, and says the customer success team takes calls for extended hours, Monday through Friday. A Salesforce CRM integration for sending HIPAA compliant email from Salesforce is listed as an optional add-on. Dashboard access comes with admin and user roles, SSO through Google Workspace or Microsoft 365 accounts, multi-factor authentication, real-time analytics and mail logs, and daily or weekly email reports.

Compliance and data location

The pricing page says Paubox is audited by third parties against HIPAA and that the Email Suite is HITRUST certified, and the footer links a HITRUST letter of certification and an AI use policy. It states that customer data is stored encrypted at rest and solely in US data centers, on redundant infrastructure with 99.99% uptime.

Who it suits

Paubox fits US healthcare organizations that already run Google Workspace or Microsoft 365 and need to email patients without sending them to a portal, from a small therapy practice to a hospital system. A marketing team that wants to send segmented health newsletters under a business associate agreement has Paubox Marketing, and a developer sending transactional mail from a health app has the Email API. It is not built for businesses outside healthcare and its neighboring regulated sectors, for senders on consumer mail accounts, or for anyone whose data must sit outside the US.