Ask Secure Message a question. Answers come from this site's docs only. I will cite a page. I will not invent a product claim.
If your practice or clinic sends patient information by email, you have probably been through the same loop: a hosted encryption service, a per-user bill, and a nagging question about where the messages and keys actually live. With Microsoft folding Office 365 Message Encryption into Purview Message Encryption, many small IT teams are taking another look.
This guide is for the people making that choice. It covers what a self-hosted email gateway is, when it makes sense, and what to check on any shortlist — including ours.
A gateway sits in front of the mail you already run. You point your MX record at it for inbound mail and relay outbound mail through it as a smart host. Your mailboxes stay where they are. Nobody moves to a new email system.
The difference with a self-hosted gateway is ownership. The gateway runs on a host you control, and the keys stay on that host. The message path doesn't route through someone else's cloud on the way out.
Three reasons come up again and again:
Ask every vendor to show you the recipient's side. With Secure Message, a recipient doesn't install anything, join a chat, or create an account. They open a link and enter a one-time code sent to the mailbox they already have. That one-time-code portal is part of the Professional plan.
If a product can't make that step simple, your front desk will hear about it.
There is no official HIPAA certification for an email product. What you can look for is a product built to support the safeguards you are responsible for: encryption at rest under your keys, audit logs, and a message path on infrastructure you own. That's how we describe Secure Message — built to HIPAA safeguards, not certified. Your compliance obligations stay yours, and any vendor who says otherwise is overselling.
Hosted services like Paubox, Proofpoint and Virtru are mature and easy to switch on. They make sense when you would rather not run a server. Secure Message is for teams who want the gateway on their own host. If you are weighing a specific vendor, our side-by-side pages are straightforward: vs Paubox, vs Proofpoint, vs Virtru, vs Mimecast, vs Purview.
Prices from the Rubix Hub (checked 2026-10-22):
| Plan | Price | Fits |
|---|---|---|
| Community | Free | One administrator, 1 domain, licensed for up to 10 users, inbound filtering on your host |
| Professional | $690/year | Licensed for up to 100 users, 10 domains, adds the one-time-code recipient portal |
| Enterprise | $1,490/year | Unlimited users and domains; adds Autopilot, eDiscovery and DLP |
Full details are on pricing.
You don't need a migration project to try it. Install Community on a host you control, point a test domain at it, and see how it fits. Setup steps live in the install docs, with DNS and TLS and architecture covered there too. Before you change MX, our free email authentication checker shows where your SPF, DKIM and DMARC stand.
Need to sign forms before you send them? Rubix PDF Sign is a free desktop app that fills, signs and flattens PDFs on your own workstation, with no cloud account.
No product can be HIPAA certified. Secure Message is built to HIPAA safeguards: encryption at rest under your keys, audit logs, and a message path on infrastructure you own.
No. They open a link and enter a one-time code sent to their existing mailbox. The recipient portal is on Professional.
No. The gateway sits in front of the mail you already run. You point MX at it and relay outbound through it.
Yes. Community is free for one administrator, 1 domain, licensed for up to 10 users.
It's an option for teams who want the keys and message path on their own host. See the OME replacement page.
Get a free Community license → Then follow the install guide. Want the recipient portal? See Professional.