No model in the mail path
Core mail does not invoke a language model. Permissions, approvals, policy and webhooks are ordinary application code and SQL.
Security
What the code enforces, and what it does not
This page describes controls that exist in the current application. It is not a certification, an audit report or a guarantee.
An agent with an inbox is a piece of software that receives untrusted text from strangers and can act on it. Most of what follows is about keeping that text from turning into authority.
Enforced in code
Each of these is a property of the implementation, not a policy someone is asked to follow.
Tenancy is not advisory
Another tenant's object ids return the same not-found as a resource that does not exist, so the API cannot be used to probe for what else is out there.
Original MIME stays restricted
Agents read a normalized version. The raw inbound message stays in restricted custody; any customer-facing download is a tenant-safe redacted derivative.
Credentials are digested
API keys are hashed, shown once and revocable. Clerk authenticates a human; it does not by itself grant workspace membership.
Webhook egress is pinned
A separate service checks every resolved address, pins the connection to a public IP, verifies TLS, and refuses redirects and private networks.
Test mail cannot escape
Test projects use non-routable .mail.invalid addresses behind a fake transport. They are structurally incapable of sending internet mail.
Where the responsibility is shared
Some of the risk is ours to remove and some of it is yours to decide about, and the line matters.
You choose which client to authorise, which inboxes a grant covers, which recipients are allowed, and what your agent is told. We do not claim to be prompt-injection proof: nothing written in a message can widen a grant, because scopes are re-derived from the database on every request, but an agent can still be argued into a draft you would not have sent. That is precisely what the approval queue is for. Provider anti-spam rules also apply to live mail, and they are not ours to override.
What this page does not claim
Stated plainly, because absence is easy to misread as an oversight.
- No SOC 2, ISO, HIPAA or GDPR compliance badge of any kind.
- No independent security review has been commissioned for public launch.
- No guaranteed incident-response time.
- No end-to-end data-residency promise.
- No published uptime commitment — see status.
Reporting a security concern
Report it to us before anywhere else, and we will treat it as the priority it is.
Email support@agents.emailforagents.ai with Security report in the subject. Describe the affected feature, the time, and a minimal reproduction. Do not include credentials, unnecessary customer content, or executable attachments, and do not access another person's data to demonstrate an issue — a test inbox on a non-routable address is a safe way to show almost anything. There is no bug bounty programme.
Machine-readable contact details are published at /.well-known/security.txt.