Security and Compliance FAQ – mxHero Help Center

Answers to common security, privacy and compliance questions about Mail2Cloud and mxHERO Shares. For a full description of how mxHERO handles data, see Security and Data Handling. For AI-related questions, see AI FAQ.

Certifications and agreements

Is mxHERO SOC 2 certified?

Yes. mxHERO is SOC 2 Type II certified. Customers and partners can request the report from success@mxhero.com. More information is on the mxHERO Trust page at www.mxhero.com/trust.

Does mxHERO sign a HIPAA Business Associate Agreement (BAA)?

Yes. mxHERO signs BAAs with customers for the part of the email and attachment handling that mxHERO performs. Your cloud storage provider holds the stored files, so you also need a BAA (or equivalent) with that provider, for example Box or Google. Contact sales@mxhero.com or your account team to request a BAA.

Can mxHERO help with HIPAA, FERPA or SEC record-keeping requirements?

mxHERO provides controls that help: it removes attachments from email, delivers them as expiring, password-protected or authenticated links, and files messages into your compliant storage. Whether your configuration meets a specific regulation is for your compliance team to decide. The shortcodes #secure, #hipaa, #ferpa, #compliant and #sec in a subject trigger Secure Email rules that are configured for them. See Secure Email.

Data handling

Does mxHERO keep copies of our email?

For rules that save to your own cloud storage (Box, OneDrive, SharePoint, Google Drive, Egnyte, Dropbox), mxHERO processes the message in transit and does not keep the content after the file is stored and the message is delivered. Some features do store data with mxHERO:

Feature	What mxHERO stores	How long
mxHERO Shares	Files and email content you send to mxHERO Shares	One year or permanently, per your Retention policy setting
Temporary Hold and Request Approval	The held message, until it is released, rejected or expires	Until the hold or approval ends
Email Flow Logs	Processing events and message metadata (sender, recipients, subject, Message-ID, sizes)	Searchable for 12 months
User Activity	Dashboard actions with IP address and user agent	1 year
Notifications	Notification records	30 days
Mail2Cloud Advanced (Store in AI)	Sender, recipients, subject, date, body text and attachment text in your AI index	Until deleted on request: a retention period (minimum 30 days), a one-time purge or deletion of a scope

Where is our data processed and stored?

mxHERO runs on Amazon Web Services. Mail processing runs in the AWS US East (N. Virginia) region. Content stored in mxHERO Shares stays in the region you choose when you set it up: US (AWS US East, N. Virginia) or JP (AWS Asia Pacific, Tokyo). Files saved to your cloud storage provider are stored wherever that provider keeps your data. See mxHERO Shares Overview.

Can we move mxHERO Shares from the US region to Japan?

The region cannot be changed in the dashboard after setup. Email support@mxhero.com with the organization IDs you want moved. Find the organization ID in Settings › Organization and domains.

Is email encrypted in transit?

mxHERO's mail servers accept and use TLS whenever the other server supports it. mxHERO does not force TLS by itself. To require TLS, enforce it on your side: the connectors that the Office 365 Configuration Service creates require TLS, and Google Workspace and border gateways have similar settings. Connections from mxHERO to cloud storage APIs, the dashboard and mxHERO Shares use HTTPS.

Does mxHERO scan files for malware?

Files stored in mxHERO Shares are scanned. If malware is found, the file is blocked: recipients and the owner can no longer download, preview or share it, the owner gets an email and administrators get a notification. Administrators can review and release false positives in mxHERO Shares › Malware. Files saved to other providers rely on that provider's scanning. See Malware Detection.

Access control

Administrators sign in to the Admin Dashboard with a password, Google, Microsoft or SAML single sign-on. You choose the allowed methods in Settings › Security. You can require two-factor authentication for the whole organization; mxHERO then emails a 6-digit code at each sign-in, valid for 10 minutes. See Security Settings.

What are the password rules for dashboard accounts?

Passwords must have at least 12 characters, with at least one uppercase letter, one lowercase letter and one character that is not a letter or number.

How long do dashboard sessions last?

A session ends 3 hours after the last activity. Managing users, changing roles and changing sign-in options require signing in again if the last sign-in was more than 1 hour ago.

Which roles exist in the dashboard?

Two: Owner and Admin. Owners have full access and manage roles. Admins have the same dashboard access but cannot create or change Owners. Owners decide whether Admins get the admin views in the End User App. See Users and Roles.

Can we audit what administrators do?

Yes. Reports › User Activity records each change with the user, time, IP address, user agent and the before and after values. Events are kept for one year. See User Activity.

Who can open the links mxHERO puts in email?

You decide per rule with a security definition: anyone with the link, people in your organization, the email's recipients, or (on mxHERO Shares) only the intended recipient after signing in. Links can expire, require a password, or allow preview only, depending on the provider. See Link Security Options by Provider.

Email security

If our email is breached, are attachments exposed?

Not if they were replaced with protected links. The email only contains a link. Access to the file is controlled by the link's security (expiration, password, sign-in) and by your storage provider, and you can revoke access after sending. Files the recipient has already downloaded are outside that control.

Does mxHERO replace our DLP or antivirus products?

No. mxHERO works alongside them. It adds control over attachments after delivery, including for mail sent outside your organization. Keep your existing DLP and antivirus systems in the mail path.