The Email Nobody Has to Remember to Encrypt

At a lunch in Honolulu, Siana Austin Hunt described a problem with no glamorous solution. Make-A-Wish Hawaii had to pass sensitive information among families, hospitals, vendors and other chapters. The messages had to be trustworthy. They also had to be read. A vault that nobody opened would protect the data beautifully and help the family hardly at all.

Hoala Greevy listened. His early work for the organization involved branded, encrypted storage. But the recurring need was communication, and Make-A-Wish Hawaii became Paubox’s first customer. The company that followed, founded in 2015, would make a rather unfashionable wager: the best security feature might be the one nobody notices.

The little checkbox with a large job

Consider the old ritual of sending a secure message. A clinician writes an email, remembers a keyword or button, sends a notice to the patient, and the patient follows a link to a separate portal. Each step is quite reasonable on its own. Together, they turn a routine exchange into a small obstacle course. On a busy afternoon, the sender can miss the trigger; the recipient can ignore the notice. The technical protection may be strong while the process remains frail.

Paubox’s answer sits behind the existing business email account. Email Suite encrypts every outbound message and attachment by default. Where the receiving mail server accepts modern TLS, the recipient reads the message in an ordinary inbox. Where it does not, Paubox uses a secure message center link. That fallback matters: “no portal” describes the normal path, not every possible destination.

This is the company’s sharpest distinction from a portal-first product. It does not ask the sender to become a security specialist or the patient to acquire another password. Greevy put the thesis plainly in a 2018 customer interview: “We figured if we could remove the friction while maintaining the compliance, you know we could have something very special.” It is a product argument, but also a management argument. A rule that requires perfect recall is a rule designed to be broken.

One inbox, several businesses

The first buyer is a healthcare organization that sends protected health information: a clinic, hospital, mental-health practice, insurer or business associate. Standard Email Suite handles automatic outbound encryption. Plus adds inbound protection against phishing, malware, spoofing and other unwanted messages. Premium adds archiving and data loss prevention. Paubox says the suite works with Google Workspace and Microsoft 365, which means customers do not have to move their staff into a new email client.

The second buyer is a developer. Paubox Email API sends transactional messages from healthcare software: appointment reminders, test-result notices or referrals. It offers REST and SMTP routes, templates and delivery information. The third buyer is a patient engagement team: Paubox Marketing supports personalized campaigns and drip sequences that may involve protected health information. Paubox Forms collects patient data, files and signatures. Cost Plus Drugs is a tidy example of the bundle: its published case study describes Email Suite for staff mail, Marketing for its Team Cuban Card program and Forms for support inquiries.

The business model follows those different jobs. Email Suite is billed by sender, with a five-sender minimum. API charges follow monthly message volume; a free tier covers 300 emails a month. Marketing charges by stored contacts. Paubox offers monthly and annual billing, plus enterprise quotes. Published older plan comparisons put Email Suite starting at $29 a month for five users, but buyers should check the live calculator because the plan page is interactive and prices can change. The definite cost is the ongoing subscription; the less visible cost is the time needed to configure domains, routing and policies correctly.

The company sells an email security product. The thing a patient experiences is the absence of a new chore.

What broke before it could grow

The earliest published origin is almost comically modest: a customer had a real problem, and Greevy built for it. The original need at Make-A-Wish Hawaii concerned secure storage and trusted communication. After conversations with that first customer and others, he saw a repeating pattern. That changed the size of the idea. A bespoke fix for one organization became a product for many, designed around the user rather than the elegance of the technical implementation.

A later admission is unusually candid for a founder’s memo. In a 2022 essay sharing an internal six-page narrative, Greevy said the company learned too slowly from experiments and that its architecture could break unpredictably with production sprints. He argued for smaller teams with clearer ownership and a more AI-driven operating model. Those are not triumphant launch metrics. They are the sort of operational problems that appear when a useful product becomes a growing platform.

Arthur Ventures had led a $4 million Series A and added $10 million in August 2022. At that point Paubox named AdaptHealth, Curative, Summit Health and The Queen’s Health System among its customers. The company’s LinkedIn profile now says more than 8,000 organizations use Paubox. These are company-reported numbers from different dates, but the direction is plain. A workflow irritant proved large enough to support a sizeable subscription business.

Security after the send button

Making outbound encryption automatic solves only one part of email risk. Malicious mail arrives from the other direction; authorized employees can also send sensitive material to the wrong place. Paubox has moved into both areas. Its inbound product combines sender checks, link and attachment analysis, spoofing defenses and quarantine controls. In September 2026, it added DLP Chat, which drafts data loss prevention rules from an administrator’s plain-language description, and Observe and Report, which looks for patterns in messages without holding them.

That “observe” option is more interesting than it sounds. An overzealous rule can interrupt referrals, results or routine patient care. Looking at the traffic first gives an administrator a chance to see what would be caught before turning on enforcement. Paubox’s own guidance stresses human review of AI-drafted rules. The lesson from its original product has survived the new technology: protection is useful only when the communication still works.

There is also a less commercial thread through the company. Greevy is Native Hawaiian, and Paubox began its Kahikina STEM Scholarship with one recipient in 2019. The scholarship awards Native Hawaiian students $1,000 each year until graduation. By 2022, Paubox said 22 recipients were receiving support at the same time. It is a specific, recurring commitment rather than a decorative line on an “about” page.

The part worth stealing

Paubox is not a universal answer to every healthcare communication problem. It needs a supported business email setup, sensible configuration, and recipient servers that can either accept modern encryption or use the secure-link fallback. Nor can an email tool settle questions of consent, access rights or the wisdom of a message’s contents. But its founding insight travels well beyond healthcare: find the action that people are required to remember, and ask whether the system can perform it reliably for them.

There is a temptation in security to admire the visible ritual: the extra prompt, the special portal, the emphatic warning. Paubox’s more useful trick was to make a protected message look dull. A person sends it. Another person reads it. That ordinariness is the design achievement.