Security & compliance
Built so your mail stays yours.
Correly handles the most sensitive data an organisation has. The architecture starts from isolation: one instance per customer, credentials encrypted, every access logged.
Architecture
- Each customer gets a separate instance: its own database, object storage and application containers. There is no shared multi-tenant database.
- The central service we use to operate instances stores no mail, no extracted data and no customer secrets — only health metrics, usage counts and the software version each instance should run.
- Instances connect out to that service; it has no way in. The agent on your host performs only a fixed set of actions — upgrade, roll back, restart, apply settings — and runs no commands it is sent.
- Standard Docker deployment; upgrades take a database backup first and roll back automatically if the new version is not healthy.
Encryption
- In transit: TLS 1.3 for every external connection; mail servers are reached over TLS only.
- Credentials: mailbox passwords, OAuth tokens and CRM credentials are encrypted with AES-256-GCM, bound to their mailbox or integration. The key lives only in your instance’s environment, never in the database.
- At rest: instances run on encrypted storage volumes of the hosting provider, or on your own infrastructure under your control.
- Webhooks are signed (HMAC-SHA256 with a timestamp) and only sent to public HTTPS addresses.
Sensitive mail
- HR and personal email is recognised when mail is classified, and from then on skipped by default: not extracted, not summarised, not embedded for search and not shown through the API.
- Distilled knowledge never describes your own staff, and personal matters (health, religion and similar) are excluded.
- Non-profit templates record beneficiary groups, never individuals.
Data protection (GDPR)
- Right to erasure: a complete purge of your instance’s mail, attachments, extracted data and credentials, with a deletion report signed by a SHA-256 checksum.
- Data portability: export every object as CSV or JSON at any time.
- Configurable retention: raw mail can be removed after a period you set, keeping the extracted records.
- A data processing agreement (DPA) for every customer.
Audit
- Every API request and every change — who, when, from where, what — is written to an audit log.
- The log is append-only: the database itself rejects updates and deletions.
- Search terms and mail content are not written to the log.
Hosting and AI processing
- You choose where your instance runs: an EU data centre by default, or your own cloud or servers.
- The AI model provider and region are configured per instance, so processing can stay in the region you require.
- Identical content is never sent to a model twice; only the text needed for each step is sent.
For your security review
Questionnaires and documents
We are happy to complete your security questionnaire and walk your IT team through the architecture.
- · Architecture and data-flow overview
- · Data processing agreement (DPA)
- · List of sub-processors (hosting, AI model provider)
- · Answers to your security questionnaire
Request them through the contact page.
Questions about security?
Talk to us before you share a single email — we can demo on sample data.