Email Hosting
Email built for privileged communications
Nearly one in three law firms has experienced a security breach (ABA Legal Technology Survey), and 39% reported one in the past year alone (Arctic Wolf law-firm survey). Email is where phishing, wire fraud, and account takeover arrive. Every mailbox we host gets the same protections for one firm price, not per seat: phishing and malware scanning, impersonation protection, encrypted messaging, hourly backups, and a standby mail server.
No Tiers, No Add-Ons
Email security isn’t an upsell
Phishing caught before you see it
Every link in every incoming message is checked against PhishTank, OpenPhish, SURBL (Spam URI Realtime Blocklist: a continuously updated list of web addresses seen in spam and phishing messages. Every link in incoming mail is checked against it before delivery.), and URIBL (URI Blacklist: a second, independently maintained list of web addresses found in spam and phishing. Checking both lists catches links that one of them has not seen yet.), continuously updated databases of known phishing and malware sites, before delivery. Pattern detection catches variants that reword a known scam, and the filter learns from your firm’s real mail over time.
Mail that fakes your domain gets rejected
Your domain gets strict SPF (Sender Policy Framework: a public record naming which mail servers may send email for your domain, so receiving servers can reject forgeries.), DKIM (DomainKeys Identified Mail: a digital signature added to each outgoing message that proves it came from your domain and was not altered on the way.), and DMARC (Domain-based Message Authentication, Reporting, and Conformance: your published instruction telling receiving servers to reject mail that fails the SPF and DKIM checks, with reports sent back to you.) from day one: a published list of authorized servers, a tamper-evident signature on every outgoing message, and a reject policy for anything that fails both checks. These are public records, so anyone can verify them.
- Forged mail is rejected outright rather than flagged or quarantined
Attachments scanned, malware blocked
Every attachment, inline image, and compressed archive is scanned against continuously updated malware signatures. Office documents are inspected for embedded macros, the scripts ransomware rides in on, and executable file types are blocked outright regardless of scan results.
Encrypted in transit, encrypted on demand
Mail server connections are encrypted to current standards, with weak, outdated methods rejected outright. For sensitive messages, add [SECURE] to the subject line and the message is delivered encrypted, read on a secure web portal carrying your firm’s name and logo. Your recipient needs nothing but a browser.
Works with your email apps, safely
Standard IMAP (Internet Message Access Protocol: the standard way mail apps read a mailbox, so Outlook, Apple Mail, and phone apps all work without anything special.) and SMTP (Simple Mail Transfer Protocol: the standard way mail apps send email through your mail server.) mean Outlook, Apple Mail, Thunderbird, and phone mail apps all work. Webmail sign-in supports passkeys (Touch ID, Face ID, hardware keys), and every device gets its own app-specific password you can revoke if a laptop or phone is lost.
- Migration and DNS (Domain Name System: the public directory that maps your domain to your website and mail servers. Anyone can look up its records, which is what makes these protections verifiable.) setup handled for you, included
- Standard formats: leave anytime and take everything with you
Backups and failover included
Your mail is snapshotted every hour. If a message or a whole mailbox is lost, contact Support and we roll it back to a point in time, quickly. Everything also goes hourly to an encrypted offsite facility with six months of retention, and a standby mail server on separate hardware catches incoming email whenever the primary is unreachable, so messages wait instead of bouncing.
Thinking About Switching?
Fair questions, straight answers
I already pay for Microsoft 365. Why would I switch?
You don’t have to give it up. Many firms keep Microsoft or Google for Word, Excel, and Teams and move only their email to us. On security, matching what we include means Business Premium, their top business tier, at more than double our whole-firm price for each user, plus configuration Microsoft leaves to you: strict SPF (Sender Policy Framework: a public record naming which mail servers may send email for your domain, so receiving servers can reject forgeries.), DKIM (DomainKeys Identified Mail: a digital signature added to each outgoing message that proves it came from your domain and was not altered on the way.), and DMARC (Domain-based Message Authentication, Reporting, and Conformance: your published instruction telling receiving servers to reject mail that fails the SPF and DKIM checks, with reports sent back to you.) come set up here on day one, along with six months of point-in-time snapshots you can restore from and a standby mail server, things you would otherwise configure and pay for yourself. And our price isn’t per seat: one flat firm price covers everyone who works there (the numbers are on the pricing page).
Aren’t Google and Microsoft more secure than a small provider?
They run excellent infrastructure, but their filtering is tuned to move billions of messages a day for every kind of user. A phishing email written specifically for lawyers, a fake court filing notice or a DocuSign from opposing counsel, is the kind of message generic filters miss. In our side-by-side tests, phishing-style messages that Gmail and Microsoft 365 delivered to the inbox were caught by our filters. And our protections are verifiable: the DNS (Domain Name System: the public directory that maps your domain to your website and mail servers. Anyone can look up its records, which is what makes these protections verifiable.) records are public, and our security practices document, written to share with your bar association or malpractice insurer, is available on request.
Is switching risky? I can’t afford to lose email.
Migration is handled by us and included. Your existing mail is copied over standard IMAP (Internet Message Access Protocol: the standard way mail apps read a mailbox, so Outlook, Apple Mail, and phone apps all work without anything special.) while your current service keeps running, and delivery doesn’t switch until the copy is verified. After cutover, the standby server queues mail any time the primary is unreachable, so messages wait instead of bouncing. Your old mailbox stays intact until you confirm everything arrived.
Will it work with Outlook and my phone?
Yes. We use standard IMAP (Internet Message Access Protocol: the standard way mail apps read a mailbox, so Outlook, Apple Mail, and phone apps all work without anything special.) and SMTP (Simple Mail Transfer Protocol: the standard way mail apps send email through your mail server.), so Outlook, Apple Mail, Thunderbird, and the mail apps on your phone all work. Each device gets its own app-specific password that can be revoked individually if a device is lost or stolen.
What if I want to leave later?
Your mail is stored in standard formats and accessible over standard protocols, so you can export your entire mailbox with any email client, whenever you choose, at no charge.
We’re a three-person firm. Is anyone really targeting us?
Yes. Wire fraud and business email compromise are not aimed at big firms in particular: the same fake "updated wiring instructions" message goes to any firm that moves client money, and one in five law firms reported being targeted last year (Proton law-firm survey). The FBI logged 193,407 phishing complaints in 2024 alone (FBI IC3 2024 Internet Crime Report). When a breach lands, it costs clients: 56% of breached firms lost client data (Arctic Wolf law-firm survey), and in a 2025 Integris survey of 750 legal clients, 39% said they would fire or consider firing a firm that had a breach and 37% said they would warn others about it. The protections here are the same for a three-person office and a ten-attorney firm: forged mail rejected, links checked against live phishing feeds, attachments scanned, and encrypted delivery when you need it.
My IT person already handles our email security.
Then this is easy to check: the protections that matter most, like SPF (Sender Policy Framework: a public record naming which mail servers may send email for your domain, so receiving servers can reject forgeries.), DKIM (DomainKeys Identified Mail: a digital signature added to each outgoing message that proves it came from your domain and was not altered on the way.), and DMARC (Domain-based Message Authentication, Reporting, and Conformance: your published instruction telling receiving servers to reject mail that fails the SPF and DKIM checks, with reports sent back to you.), are public DNS (Domain Name System: the public directory that maps your domain to your website and mail servers. Anyone can look up its records, which is what makes these protections verifiable.) records. Ask us for a free, read-only security check of your domain and we’ll show you exactly what’s configured, no access to anything needed. If everything passes, you didn’t need us, and we’ll tell you so.
Where do the statistics on this page come from?
Four sources, each named where its number appears. The breach rates come from the ABA Legal Technology Survey and from Arctic Wolf and Proton law-firm surveys, as compiled in DeepStrike’s Law Firm Data Breach Statistics 2026 (updated July 28, 2026). The phishing complaint count is from the FBI Internet Crime Complaint Center’s 2024 report. The client-reaction figures are from the 2025 Integris Report, Law Firms, Cybersecurity and AI, a survey of 750 legal clients conducted in October 2024. Integris sells IT services, so we cite its survey responses and not its conclusions.
Switching is the hard part.We bring your data over, and it stays yours to take with you.
One platform for your entire practice
Cases, billing, trust accounting, marketing, intake, payments, and reporting, plus secure hosting for your firm’s email and website: all under one roof, built exclusively for firms of 1–10 attorneys. No major practice management vendor hosts your email and website too.
Free to start. No credit card required.