Security and Data Handling – mxHero Help Center

This page explains how mxHERO protects your email while processing it, what data mxHERO keeps and for how long, and where that data is stored. Use it to answer questions from your security, privacy or compliance team before deployment. For certifications and audit reports, see the mxHERO Trust page at https://www.mxhero.com/trust.

Where your data is processed

Mail processing. The mxHERO mail gateway runs in Amazon Web Services (AWS), in the US East (N. Virginia) region, across several availability zones.
Your cloud storage. Files that rules save to Box, OneDrive and SharePoint, Google Drive, Egnyte or Dropbox are stored in your own account with that provider. Your provider's location, retention and security settings apply to them.
mxHERO Shares. When you set up mxHERO Shares, you choose a region, which can't be changed afterwards from the dashboard:

Region	AWS location
US	US East (N. Virginia), `us-east-1`
Japan	Asia Pacific (Tokyo), `ap-northeast-1`

To move an existing organization to another region, contact mxHERO support with your organization ID.

Protection in transit

SMTP. mxHERO offers and uses TLS for every SMTP connection, in both directions. TLS is opportunistic: mxHERO encrypts whenever the other server supports it. Old protocols (SSLv2, SSLv3) and weak ciphers are disabled. To require encryption on a route, configure it on your side. For example, the mxHERO connectors in Microsoft 365 are created with TLS required, and Google Workspace routes can require TLS. See Network endpoints and IP addresses.
Web and API. The Admin Dashboard, End User App, mxHERO Shares pages and connections to storage providers use HTTPS.
Message authentication. mxHERO adds an ARC seal to every message it delivers, which records the SPF, DKIM and DMARC results the message had when it arrived. It can also DKIM-sign mail for your domains. See SPF, DKIM and DMARC.

Protection at rest

Data that mxHERO stores is encrypted at rest.

In mxHERO Shares:

Every uploaded file is scanned for malware. A file that fails the scan is blocked for everyone until an administrator reviews and releases it. See Malware detection.
Link passwords are stored only as a one-way hash.
Download links that recipients receive are signed and expire after 1 hour. Sign-in codes sent to recipients expire after 10 minutes and work once.

What mxHERO keeps, and for how long

mxHERO is not a mail archive. It processes messages and passes them on, and keeps message content only where a feature needs it. The table lists what mxHERO stores.

Data	Contents	Kept for
Messages in transit	The message, while rules run and until it is handed to the next server	Until delivered. If the next server can't be reached, mxHERO retries for up to 24 hours.
Held messages (Temporary Hold, Request Approval)	The full message	Until it is released, rejected, cancelled or expires
Messages waiting to be saved again	Messages that a storage service could not accept, kept so you can retry them from Rules › Reprocess Emails	Until reprocessed
Email Flow Logs	Message details (sender, recipients, subject, Message-ID, size, attachment names) and processing events	Searchable for 1 year
Email Flow Logs CSV exports	The fields you choose	5 days
Notifications	Alert details	30 days
User Activity	Changes made in the dashboard, with user, IP address and browser	1 year
Usage statistics	Counts only (messages, rule runs, files and bytes uploaded)	About 1 year
Link tracking (if you enable it)	Opens and clicks, approximate location and device	30 days per message
mxHERO Shares files	Files and email content your rules store there	1 year or permanently, as set in mxHERO Shares › Settings
Mail2Cloud Advanced index	Sender, recipients, subject, date, body text and attachment text from rules that use Store in AI	Until deleted on request: a retention period (minimum 30 days), a one-time purge by age, or deletion of a scope. Copies in backups remain until the backups expire.
mxMCP sign-in	Your email address and the OAuth clients (assistants) that connected	Sign-in codes 15 minutes; sessions up to 30 days after last use

Files saved to your own cloud storage stay there under your control. mxHERO does not delete them.

Access to your systems

Mail. For gateway processing, mxHERO receives only the mail your routing rules send to it. You decide the scope, from a pilot group to the whole organization.
Mailboxes and directories. For mailbox rules and directory synchronization, an administrator grants access through Microsoft 365 admin consent, Google Workspace domain-wide delegation or an IMAP login, or a user authorizes their own mailbox. You can revoke this access in your Microsoft 365 or Google Workspace admin console at any time.
Cloud storage. mxHERO keeps the authorization tokens it needs to upload files for you. It doesn't store your storage passwords. You can revoke access in your storage provider's admin console.

Dashboard access controls

Sign-in with a password, Google, Microsoft or SAML single sign-on. Passwords must have at least 12 characters, with uppercase and lowercase letters and a symbol.
Optional two-factor authentication for the whole organization, with a 6-digit code sent by email.
Sessions end after 3 hours of inactivity. Managing users, roles and sign-in options requires a recent sign-in.
Every change in the dashboard is recorded in Reports › User Activity.

See Security settings and Single sign-on with SAML.

AI features

AI questions in rules are sent to your own AI provider account, using a key you supply in Settings › Integrations. By default, mxHERO sends the message subject, sender, recipients, date and body, not attachments. You can change what is sent when you write the question. Nothing is sent unless you configure an AI question. See AI question conditions.
Mail2Cloud Advanced indexes captured email only for rules where you turn it on. mxHERO does not train AI models on customer email. See Mail2Cloud Advanced overview.

Availability and failure behavior

If processing fails, mxHERO delivers the original message rather than losing it. See How mxHERO processes email.
To stop processing quickly, disable rules in Rules › Rules List, or turn off the routing rule in your mail system.
mxHERO's historical uptime is 99.95%.
Current service status and incident history are at https://status.mxhero.com. Subscribe there to receive updates.

Certifications and agreements

mxHERO holds a SOC 2 Type II attestation. For the current list of certifications, security architecture and how to request reports, see https://www.mxhero.com/trust. For HIPAA business associate agreements and other compliance questions, see the Security and compliance FAQ.