Frequently Asked Questions

Looking for some quick answers? We’ve got you covered. Find your answers for some of our most frequently asked questions here.

Pre-Built Secure Mailbox:

We offer a variety of pricing plans ranging from our free, personal accounts to enterprise-level secure exchange bundles to suit the needs and budgets of any customer. View our pricing plans to find the one that’s right for you.

To log into your DataMotion account, first navigate to either your secure mailbox or the DataMotion Customer Self-Service Center, enter your email address and password in the logon window and click “Enter” to login. If your organization has single sign on enabled, simply click the identity provider button to login. You will then be routed through the identity providers verification process.

Yes, during initial setup of your DataMotion account, you will be prompted to select a delivery method such as encrypted PDF push and web delivery. You always have the option of changing it later through your preferences.

Your mailbox storage space varies based on your pricing plan and is counted using the messages SENT from your account, not received. Please visit our pricing plans page for more information.

Yes, messages do expire. To protect the sensitive nature of your messages, the DataMotion system stamps each message you send with an expiration date. By default, SENT messages expire after 30 days. The DEFAULT maximum expiration period of your sent messages can be extended to 2 or more years. Increasing your default expiration period will cause your mailbox to fill up quicker. There is also the option to change the expiration period on a PER message basis.

After a message has expired, the contents and any attachments associated with that message will no longer be available. Metadata of the message will still be available forever in the form of message tracking and reporting.

The Outlook add-in can be configured to route secure messages to the DataMotion secure mailbox in three (3) different ways:

  • Client-Side Encrypting: In this version of the add-in the message is sent as an encrypted payload to the DataMotion secure mailbox for processing. An additional feature of the add-in is that it downloads an unencrypted version of the message from your secure email inbox directly to your Outlook inbox. This version of the Outlook add-in does not require the DataMotion secure content filter.
  • Server-Side Encrypting: This version of the add-in redirects a secure message over an encrypted channel to the DataMotion secure mailbox. This version of the add-in requires the DataMotion secure content filter to process and redirect the message.
  • Subject Line Tagging: If your policy is not to modify message headers for secure messages, then the tagging option is also available. With this option, a tag is added to the subject line of a message which can be scanned by the content filter and routed securely to the DataMotion secure mailbox. When the content filter recognizes the tag in a subject line, it strips it out before the message is forwarded to the DataMotion secure mailbox.

Note: In order to implement the tagging option, ALL of your messages will need to be routed through the DataMotion secure email content filter.


Secure Email Content Filter:

The content filter has some of the most common PHI and PII rule patterns built-in, including financial policy rules, healthcare rules, and personal identifying information rules.

Additional built-in rules include tags to scan a subject line of an email and take the appropriate action.

There are multiple actions that can be specified when a condition is matched. Some of the common ones are to send the message securely, route the messages to another SMTP server, and delete the message. In any of these cases, the sender and other individuals (administrators, managers) can be notified by the content filter.

Yes, the DataMotion secure email content filter includes the ability to use Regular Expressions for pattern matching, as demonstrated by many of the pre-configured rules. You can create custom rules using your own set of Regular Expressions as well. While the secure content filter has the most common PHI, PII, and HIPAA compliant patterns built-in and has been tuned over DataMotion’s years of experience, it is flexible enough to give you free reign over writing your own patterns (rules). The content filter is also capable of exact matching; meaning you can create a flat file with the exact keywords that you wish the content filter to scan.

Yes, the content filter can be installed in an active / passive cluster, VMWare or in a load balanced configuration.

Yes, there are various methods such as implementing user groups and rules whereby you can control your accounts.

The message will be received by the DataMotion secure mailbox and will sit in the ‘Drafts’ folder of the sender’s account. The sender will receive a notification that they do not have permission to send a message and to contact their IT administrator. Once their account has been fully licensed, the message in the drafts folder will automatically be sent out. The sender does not need to resend the message.


Single Sign On

SSO with industry-leading Identity Providers offered by DataMotion follows strict security measures put in place by these vendors to protect their users. Ultimately, safeguarding access to user accounts (whether via SSO or regular user ID/password combination) is in the hands of users, who must take all necessary precautions so as not to compromise their account credentials.

DataMotion customers concerned about providing users within their companies with SSO, have an option to disable it for their licensed users (auto-created recipient users will still have it available).

Any users who use the Outlook Add-in that requires authentication or DataMotion APIs, must continue using their current authentication method with email/user ID and password.


Clinical Direct Secure Messaging

The DataMotion HISP Technical Support Agreement, part of the overall DataMotion HISP Agreement outlines the support mechanism for the DataMotion HISP. The SLA specifies the response time for different levels of support issues.

Integrating an EHR system with a HISP typically involves the following steps:

  1. Establish Direct addresses for the EHR users who need access to Direct
  2. If the EHR supports connectivity via the XDR protocol, establish an XDR connection
  3. If API integration is involved, use the developer sandbox provided by DataMotion to develop and test the application calling into the DataMotion APIs.

The DataMotion Direct Software Developer Kit (SDK) offers up a set of robust APIs that integrate into your workflow without any disruption. DataMotion will setup all the Direct addresses, certificates, encryption, and message routing. DataMotion provides assistance all the way through and is also recognized by our customers as a reliable integration partner.

You can send a Direct message to (or receive a Direct message from) any EHR that is in DataMotion’s HISP, or to any EHR that is in another HISP.

Yes, it is possible to access your Direct Messages in a secure manner from your cell phone, tablet, and any other mobile device, using the DataMotion mobile-optimized Direct Messaging Portal.

To enable developers and compress development cycles, DataMotion’s connectivity methodologies are incorporated into a developer’s sandbox with open web standards such as web services, S/MIME, SMTP, etc. to test your system. Developers familiar with standard web communication protocols, including HTTP, XML, and SOAP will be able to use the sandbox with minimal training and support. The sandbox contains:

  • Integration code samples
  • API documentation
  • Implementation guide

DataMotion offers the following categories of Direct addresses:

  • Individual Direct Address
  • Group Direct Address
  • Workflow Direct Address

Read more about these types of addresses here

As per DataMotion HISP agreement, the standard data retention period for each DataMotion Direct mailbox is 30 days.

DataMotion adheres to DirectTrust LoA3 for all Direct Users (equivalent to NIST 800-63-1 Level 3 or Kantara Level 3 or FBCA Basic or Medium). Read more here

Yes. DataMotion Direct Secure Messaging has achieved Office of the National Coordinator of Health Information Technology (ONC-HIT) 2015 Edition Modular Certification, see Certified Health IT Product 10017.


Secure Message Delivery API

The secure message delivery API is a subset of our family of APIs for the secure message center. It does not include APIs for administration and provisioning. Unlike the secure message center APIs, it only supports the sending of messages in one direction.

No, the secure message delivery API only supports the sending of messages and attachments in one direction.

The direction that your secure messages are sent depends on your application. It can be coded to support user-initiated secure messages from your app or portal, or you can enable emails to be sent automatically or manually from your system to your end-users.

Your developer account has a 10GB limit for storing sent messages. You can release the storage taken by a message by deleting it via API.

The maximum attachment size is 20MB. Your users can choose to send one attachment up to 20MB in size or multiple attachments totaling up to 20MB.

You can retract the message, review its delivery status and delete the message from your account to release the storage taken by it.

Pay-per-use means that you only pay for the transactions that are actually made while using this API. Transactions are based on the number of recipients per message. So, one message sent to one recipient is billed as one transaction. However, one message sent to five recipients would be billed as five transactions.

A member of our sales team will be reaching out to you once you run out of credits on your developer account to inform you of your next steps to refill your balance.

For in-depth documentation, including base URLs, endpoints, response and request body formats, and more, please visit our customer center. To learn more about this API and what it does, head on over to our secure message delivery API page on our website.


Mobile App

The DataMotion mobile app is available for Apple iPhones and iPads iOS version 11 or higher.

Yes. The DataMotion app links to your existing DataMotion account, disk quota and message retention period. (No account? No problem—the app can create a free DataMotion Personal cloud account.)

Please note, customers with 2FA enabled on their DataMotion account will be unable to link to our mobile app. For those using 2FA, please continue to enjoy our mobile-optimized secure message portal at

Of course it is! Our mobile app uses the same level of security as all of our DataMotion services. With zero-trust design and a governed database core packed into an application on your mobile device, you can now enjoy the power of our secure messaging services from anywhere.

No, the DataMotion app is free for all new and existing DataMotion customers.

QR Code (located in your DataMotion dashboard)

  1. Go to your DataMotion portal
  2. Click on the “Link to the DataMotion Mobile App”
  3. You will see a page with a QR code and instructions
  4. On your mobile device, click on the “Link Your Existing Account” prompt at the bottom of the application
  5. On the next screen, click on the purple “Scan” icon at the bottom of the app—your phone or pad’s camera will be activated
  6. Point your camera at the code on your computer screen
  7. Line up your iPhone or iPad’s screen so the QR code is in the middle
  8. Code will scan automatically
  9. Voila! You’re all set and ready to send!

Connect Your Account Manually

  1. Download and open the DataMotion mobile app
  2. Tap on the login prompt
  3. Enter the e-mail and password for your DataMotion portal account
  4. You will receive an email from us with a multifactor authorization code, which you will then enter into the app
  5. You’re all done and ready to scan and securely send!

Please check your spam or junk mail folder first. If you have a Gmail account, it can take up to three to four minutes before receiving your second two-factor authentication email. Please wait until the second code comes through, and use that code to access.

If you have a Gmail account, it can take up to three to four minutes before receiving your second two-factor authentication email. Please wait until the second code comes through, and use that code to access. If you still cannot find the code, you can send us a support request via our website.

Yes, you can! Just like when you send a secure message, email, or document using one of our products online or on desktop, the recipient will be prompted to create a free, DataMotion personal account to read and respond to the message.

At this time, our application only supports the sending of secure documents, images, files, and more. You will not be able to view any incoming messages through the mobile app. To view these messages, you will need to visit our secure message portal.

Yes, you can share documents, files, images, and more directly through the app as well as any apps which support the iOS share functionality.

Please note, if the DataMotion mobile app does not initially appear as a sharing option, please follow the steps below:

  1. Go the app you would like to securely exchange an item from and click to share as you normally would.
  2. Scroll to the end of your available sharing options.
  3. Click “More.”
  4. Scroll through your list of suggested apps.
  5. Select the DataMotion app. (If the DataMotion app does not appear as an option – please skip to step #7).
  6. Click “Done.”
  7. If the DataMotion app does not appear as an option, click “Edit.”
  8. Ensure the DataMotion app is toggled on. You will know that it is toggled on when the button on the right side of the screen turns green.
  9. Select “Done.”
  10. Return to your list of suggested apps.
  11. Select the DataMotion app.

If you are still having issues getting the DataMotion app to appear as a sharing option through iOS Share, please contact support.

Yes, you can! Our DataMotion mobile app supports file sharing from cloud storage services. To connect your existing cloud storage service to your mobile app, simply follow the steps below:

  1. First make sure the cloud storage app you would like to connect is downloaded on your mobile device.
  2. Open the DataMotion app.
  3. Click the “+” symbol at the bottom of the screen.
  4. Click “files.”
  5. Click the “browse” folder on the bottom right-hand side of the screen.
  6. If you would like to turn on iCloud Drive, do so by clicking the blue button stating, “Turn on iCloud Drive.” If you do not want to turn on your iCloud Drive, you can skip this step.
  7. Click the “browse” text in the upper left-hand side of the screen.
  8. Click the ellipses button in the upper right-hand side of the screen.
  9. Click “edit.”
  10. Choose the cloud storage you would like to connect by toggling the button green.

Alternatively, you can share directly from your cloud storage app. Simply go to how you would normally share a document, file, or image from the app, and select the DataMotion app icon.

To add more storage to your message history on the DataMotion app, you will need to upgrade your account to one of our paid plans. To view our pricing plans, please visit our pricing page.


HITRUST CSF® Certification

According to the HITRUST Alliance, the HITRUST Certification “is a globally recognized certification of an organization’s compliance to the rigorous comprehensive security and privacy protection requirements specified in the HITRUST CSF.” The certification provides a framework for compliance with top security and privacy regulations, including ISO, NIST, PCI, HIPAA, and GDPR.

Learn more about what the HITRUST CSF Certification is in our blog post “HITRUST CSF® Certification: What Is It and Why Does It Matter?

Any organization that earns HITRUST CSF Certification is considered to have demonstrated “the highest commitment to excellence.” HITRUST also states that that those who achieve the certification have proven that they implement the highest security controls and place a strong emphasis on protecting their data’s security and reducing risk.

In other words, the HITRUST Certification provides verified assurance that an organization is performing the greatest level of diligence to protect your data.

To become HITRUST CSF Certified, an organization must complete a minimum of 156 (typically, many more) rigorous controls (requirements). These controls span across fourteen categories, including risk management, security policy, compliance, and business continuity management. After implementing each control, the organization must be verified via self-assessment or third-party assessor. An organization must be recertified every two years.

For more information on the HITRUST CSF Certification requirements, stop by the Introduction to the HITRUST CSF whitepaper.

Each HITRUST CSF-certified company must undergo a full reassessment bi-annually and a partial one in the interim.



Didn’t find your answer in one of our frequently asked questions? Contact DataMotion support now.