Security: How We Handle Your Email and Passwords

Credentials

Control	How it works
No credentials in chat	Every connect flow hands you a link you open yourself: a Google or Microsoft sign-in page, or a masked password form. The secret goes straight from that page into encrypted storage, never through a tool argument or your agent's context.
Encrypted at rest	OAuth refresh tokens and mailbox app-specific passwords are stored encrypted with AES-256-GCM under a server master key (Fly secrets in production). We store those credentials because sync needs them, and we would rather say so than imply we hold nothing.
Tested before stored	An iCloud or IMAP password is tested live against the mail server before it is accepted. A failed test is rolled back and nothing is kept.
Agent API keys hashed	Only a SHA-256 hash is stored. The raw key is shown once, at creation.
Revoke any time	Disconnecting an inbox from Account deletes the inbox record and the encrypted mailbox credential immediately. Revoking an agent API key cuts that agent's access without touching mailbox secrets.

Your mail

Control	How it works
Read-only sync	Reading mail for triage never marks it read on the server.
Triage window	Only the newest ~300 messages per selected folder are synced (Gmail reaches that over its first few syncs): INBOX, Sent, and Drafts by default. Trash and Spam are never synced.
What we store	Headers, a plain-text body excerpt for the synced window, and attachment names and sizes. Attachment bytes are not stored. They are streamed once, on request, when your agent asks for them.
What we don’t store	Your full mailbox history, attachment file contents, or your regular Apple ID / Google / Microsoft account password (OAuth or app-specific passwords only).
Never used for training	Your mail is never used to train any AI model. We do not sell mail content.

Your agent

Control	How it works
Draft first, then you approve	The default write path creates a draft in your mailbox. Account `sendEnabled` defaults to off until you opt in. Sending only happens after you enable send and approve in the app prompt or on the approval page (`send_draft`): IMAP/iCloud via SMTP, Gmail via `users.drafts.send`. There is no silent auto-send. An operator-only immediate-send switch exists for iCloud and IMAP. It is off by default and is not the product send path.
Gmail labels	Label apply/remove, star, and archive use the `gmail.modify` scope with explicit message and label ids and a per-call batch cap. Connected agents moving more than 25 messages at once get a preview first, and once connected agents have moved 500 messages in an hour, the person approves each further move. Every move can be undone for 7 days. We do not request the full-access `mail.google.com` scope.
Audit of sensitive actions	Connect (OAuth), disconnect, draft create, approved send, trash, and Gmail label/archive/star changes are recorded in the account activity log. It is not a security monitoring system.
Prompt-injection guard	Message bodies returned to an agent via `get_message` are wrapped as untrusted, quoted data with an instruction not to follow anything inside.
Trash is reversible	`trash_messages` moves a message to Trash/Deleted Items. It is never a permanent delete.
Demo data until connected	An inbox with no credential on file shows demo messages (every sender ends in `.test`) so you can try everything before connecting anything real.

Reporting a security problem

If you find a security problem in Inbox Triage, email help@getinboxtriage.com with "Security report" in the subject. Our contact details are also at /.well-known/security.txt.

What to send

What you found and where: the page, API route, or MCP tool.
Steps to reproduce it, and what an attacker could do with it.
How to reach you for follow-up questions.

What we do

We reply within 3 business days to say we have your report.
We confirm the problem and tell you how serious we think it is within 10 business days.
We aim to fix critical and high problems within 30 days, and others within 90 days. We tell you when a fix ships.
If people's data was exposed, we tell the affected people. See how we handle incidents below.
With your permission, we credit you when we describe the fix. We do not pay bounties today.

Testing rules

We will not take legal action against research done in good faith that follows these rules:

Test only against accounts and mailboxes you own. Never open, change, or delete someone else's data. If you reach anyone else's data by accident, stop, do not keep a copy, and tell us.
No denial of service, load testing, or automated scanning that slows the service for others.
No phishing, social engineering, or physical attempts against us or our users.
Do not send email through a connected mailbox to anyone but yourself.
Give us a reasonable time to fix a problem before you talk about it publicly.

Out of scope: problems in Google, Microsoft, Apple, Stripe, Fly.io, or an AI app itself (report those to them), reports that only list missing best practices with no way to exploit them, and attacks that need a device the attacker already controls.

If something goes wrong

If we learn that someone got into data they should not have, we contain it first: we cut off the access, revoke affected sign-ins and keys, and change our own secrets. We then tell the people affected, without undue delay, what happened, what data was involved, and what we did. We also tell the mail providers and regulators when their rules or the law require it.

Compliance and documents

Item	Status
SOC 2, ISO 27001	Not held. We publish the controls we ship instead of claiming certifications we do not have.
HIPAA	Out of scope. Do not use Inbox Triage for protected health information.
Google security assessment (CASA)	Not completed yet. Google requires it before the Gmail connection leaves Testing mode.
Data processing agreement (DPA)	We do not offer a standard DPA today.
Service providers	Every company that runs part of the service, and whether it receives mail content, is listed in Privacy: Sharing and transfer.
Policies	Privacy, Terms, and how to report a security problem.
Security contact	help@getinboxtriage.com, also in security.txt.

Trust FAQ

What do you store?

Encrypted mailbox credentials (OAuth tokens or IMAP app-specific passwords), a small synced window of message metadata and plain-text bodies (~300 per selected folder), hashed agent API keys, and a short account activity log (connect, disconnect, sync errors, key revoke). See also the Privacy page.

What don’t you store?

Attachment bytes, your full mailbox, any password typed in chat (no connect flow asks for one), or your primary Apple ID / Google / Microsoft login password.

How do I disconnect?

On Account, use Disconnect on an inbox, which deletes the stored credential and synced mail, Disconnect under Connected agents in Settings to end an AI app's access, or Revoke on an agent API key. For Gmail, Disconnect also asks Google to remove Inbox Triage's access. To remove access on the provider's side too, see the steps below.

How do I remove Inbox Triage from my Google, Microsoft, or Apple account?

Disconnecting an inbox or deleting your account removes what we store. For Gmail we also ask Google to remove our access. Your mail provider may still list Inbox Triage, and you can remove it there too:

Google: open Google Account, Third-party connections, choose Inbox Triage, then Delete all connections.
Microsoft (personal account): open Apps and services, choose Inbox Triage, then Remove these permissions.
Microsoft (work or school account): open My Apps, or ask your IT admin to remove Inbox Triage.
iCloud: open Apple Account, go to Sign-In and Security, then App-Specific Passwords, and revoke the one you made for Inbox Triage.
Other IMAP mail: delete or change the app password you gave Inbox Triage in your mail provider's settings.

Do you train on my mail?

No. Mail is never used to train models.

Is this HIPAA / SOC 2 / “bank-grade”?

No. HIPAA is out of scope. We do not hold SOC 2 today. We publish the controls we ship. We do not claim certifications or uptime numbers we do not have.

What Google permissions do you ask for?

Sign in with Google asks only for openid, email, and profile. Connecting Gmail asks for one scope, gmail.modify. It covers reading your synced mail, drafts, sending a draft you approved, labels, archive, star, spam, and moving mail to Trash. We do not request mail.google.com, so Inbox Triage cannot permanently delete mail. After a scope change you may need to reconnect (Google re-consent). While the Google app is in Testing mode, refresh tokens are short-lived and you may need to reconnect about every seven days. Google's production verification is a later step and is stricter for mail scopes.

How does the spam filter learn, and what does it share?

The spam filter learns from your decisions (a spam report you confirm, a message you drag back out of Spam), from mail sent by senders you already trust, from mail you read and kept for a week, or left in your inbox for a month, with nothing flagged, from your own sent mail, from your mail service's own junk folder (once a day, and when you ask it to train), and from messages your assistant checks and marks as fine. It never trains itself on its own verdicts. Each inbox has its own statistical model that nothing else can train. Those same learns also feed one shared model across all inboxes, except from Gmail and Google Workspace inboxes, whose mail only ever trains their own model. The shared model holds hashed word-pair counts, never message text, addresses, or subjects, and cannot be turned back into mail. The shared model is a tie-breaker: its weight is capped below the level that flags a message, so on its own it can never send mail to Spam, and one inbox's reports can only tilt, never decide, another's. Each inbox can contribute a bounded number of learns a day. Word-pair counts that stop being seen are dropped after 100 days.

More detail: Privacy · Terms · iCloud connect (app-specific password) · Help center.