The Legitimate Security Question
Giving any third-party application access to your email inbox is a significant trust decision. Your inbox contains sensitive business communications, personal data, financial information, and confidential contracts. The question is not whether to be cautious — it is what specific questions to ask and what answers constitute acceptable risk.
How OAuth Authorization Works
Modern AI email assistants, including AI in Mail, use OAuth 2.0 — the same authorization protocol used by every major enterprise integration. Here is what happens when you connect:
- You click "Connect Gmail" or "Connect Outlook"
- You are redirected to Google's or Microsoft's own login page
- You authenticate directly with the provider — AI in Mail never sees your password
- You review and approve a specific set of permissions
- Google or Microsoft issues an access token that AI in Mail uses for API calls
The access token can be revoked at any time from your Google or Microsoft account settings, immediately cutting off access.
What Permissions AI in Mail Requests
AI in Mail requests the minimum permissions necessary:
- Read emails: Required to summarize and categorize your inbox
- Send emails: Required to send AI-drafted replies on your behalf
- Manage labels/folders: Required for auto-archiving and organization
- Read calendar events: Required for meeting-context briefings (optional)
We do not request access to contacts, Drive/OneDrive files, or any other data outside of email and calendar.
Data Storage and Processing
Email content is processed in-memory to generate summaries and drafts. Processed summaries are stored temporarily (24-48 hours) to enable conversation context in WhatsApp. Full email content is never stored on our servers beyond the processing window.
AI processing uses enterprise-grade APIs (OpenAI, Anthropic) with data processing agreements that prohibit training on your data.
Compliance and Certifications
AI in Mail is SOC 2 Type II certified, GDPR compliant, and follows HIPAA-aligned data handling practices for healthcare customers. Enterprise customers can request a Data Processing Agreement (DPA) and our full security documentation package.
Questions to Ask Any AI Email Service
- Do you store full email content, or just metadata?
- Do you use my email data to train AI models?
- What happens to my data if I cancel?
- Are you SOC 2 or ISO 27001 certified?
- Can I revoke access instantly?
Keywords