Security

Where your email goes

And where it doesn’t. LetterLeaf is built and operated from Sweden, AI processing stays inside the EU, and this page says exactly what happens to your mail.

processing

Where things run

AI models

Microsoft Azure, EU data zone

Categorisation, summaries, sentiment and drafts run on OpenAI models hosted by Microsoft Azure with EU data-zone deployments. Prompts and responses are processed inside the EU, are not used to train models, and are never sent to OpenAI’s own servers.

Application and database

[CONFIRM] Railway, EU region

The LetterLeaf API, mail sync and PostgreSQL database run on Railway in its European region. [CONFIRM region in the Railway dashboard before publishing.]

Mail sync

Self-hosted EmailEngine

IMAP, Gmail and Microsoft sync runs on EmailEngine operated by LetterLeaf on the same infrastructure. No third party sees your mailbox credentials.

Sign-in and billing

Supabase and Stripe

Authentication is handled by Supabase [CONFIRM project region]. Payments go through Stripe; card details never touch LetterLeaf’s servers.

access control

OAuth sign-in, two-factor, and private inboxes

Gmail and Microsoft connect through OAuth, so you sign in on their page and LetterLeaf receives a revocable token. IMAP credentials go to the mail sync service and nowhere else.

  • Two-factor authentication is available for every account.

  • Organisations and roles decide who can see a shared mailbox. A private inbox is never visible to the organisation, not even to its owner.

  • Ownership transfer lets you hand an organisation to a colleague without sharing a login.

in detail

What we store and never do

What LetterLeaf stores

  • Synced messages from the inboxes you connect, so they can be sorted, searched and replied to. Disconnect an inbox and its synced copy is removed.

  • Your categories, Smart Views, drafts and workflow rules.

  • Smart Docs: the documents and web pages you choose to upload, split into searchable chunks so drafts can cite them.

  • A writing-style profile learned from your sent mail, and your email signature, so drafts sound like you and sign off like you.

  • Usage records for AI credits, so the workspace owner can see who used what.

What LetterLeaf never does

  • Sell or share your data. Nobody outside LetterLeaf and the processors named above receives it.

  • Train models on your mail. Azure OpenAI does not use customer prompts or responses for training, and neither do we.

  • Read your mail as humans. Access to message content by the LetterLeaf team is only for support you ask for, and every such access is written to an audit log.

Deleting your data

Disconnecting an inbox removes its synced mail. Deleting your account removes your profile, documents and drafts. [CONFIRM retention window for backups.]

Questions

Write to us through the contact page and the founder answers. If you need a data processing agreement for your company, ask and we will send one.