Built to be trusted.
Honest, current state of MailGeni's security posture, data handling, and compliance — including what we have, what's in progress, and what we haven't done.
Last updated October 6, 2026
The controls behind that promise
HTTPS connections
Connections to the MailGeni web service use HTTPS to protect data in transit.
Protected credentials
Mailbox credentials are handled by the server. Privileged service keys are not included in the browser extension.
Authentication via Clerk
Industry-standard OAuth and session management. MFA available.
Server-only privileged access
Service-role key never leaves the server; client uses anon keys with RLS.
In-app data deletion
Manage optional history or delete your account from Settings. Provider retention and separate record-retention rules are explained in our Privacy Policy.
In-app provider disconnect
Disconnect Gmail, Calendar, or Outlook from mailgeni.ai → Settings (linked from the extension's Settings) — Google access is revoked at the same time.
Rate limiting
Per-user limits on AI, mailbox-write, bulk, and credential endpoints.
Token expiry + audit trail
Extension bearer tokens expire after 90 days. Created and last-used timestamps recorded.
Documented incident response
Severity classes, regulator notification (Qatar / EU-UK / India), runbooks for key compromise + mass token revoke.
Dependency hygiene
Dependabot, GitHub Actions CI (typecheck + npm audit), secret-scanning push-protection.
RoPA + DPIA
Records of Processing Activities and Data Protection Impact Assessment maintained as living documents.
Optional document analysis
Choose whether to send a document to AI. You can view and sign it without AI analysis, and withdraw remembered permission in Settings.
What is processed and saved
Reply generation uses the conversation and relevant context. Other enabled features, including search and categorisation, can process additional messages.
Optional reply and invoice history can retain selected content. Saved invoices, contracts and signing records have separate retention rules. Manage optional history in Settings.
MailGeni does not use your content to train models. Provider training policies and retention are separate; see the privacy policy and applicable commercial API terms.
Document AI uses Anthropic’s direct Claude API. The permission notice identifies the provider before analysis; there is no automatic fallback to another provider.
Direct AI processing is not guaranteed to stay in the UK or EU. Anthropic’s standard API retention is generally up to 30 days, with exceptions under its policy. We do not claim a zero-retention agreement.
Stated plainly
MailGeni is not ISO 27001 certified and has not completed a SOC 2 audit. Our suppliers’ certifications do not certify MailGeni. Security controls and privacy commitments are separate from independent certification.
Verified by Google (June 2026) for restricted and sensitive scopes: Gmail (gmail.modify), Calendar, and Contacts. Subject to Google's required annual security reassessment.
Completed with an ADA-authorized lab as part of Google OAuth verification. Reassessed annually.
Attested in the Privacy Policy and confirmed through Google's OAuth verification review.
Operator's home jurisdiction. Privacy Policy reflects PDPPL principles.
Practical compliance: lawful basis, sub-processor disclosure, in-app rights, DPIA, RoPA, breach process. Enterprise DPA on request.
Practical compliance for the data categories we process. Email content is not classified as 'critical personal data' under DPDPA.
No SOC 2 report. An audit is not currently being pursued.
Not certified. Certification is not currently being pursued.
Not in scope. MailGeni is not designed for handling Protected Health Information.
Who touches your data, and where
Authoritative list lives in the Privacy Policy.
Database and private document storage: Stockholm, Sweden, EU. Authentication, hosting, rate limiting and AI may process data outside the EU. Cross-border transfers to US-based AI sub-processors are covered by Standard Contractual Clauses or equivalent under each provider's DPA.
Found a security issue?
Email us with the heading SECURITY: and a description. Acknowledged within 24 hours, triaged within 72.
Need a DPA, RoPA or DPIA?
Enterprise customers can request our Records of Processing Activities, DPIA, or a signed DPA. Response within 5 working days.