For the colleague who first wants to know what can't happen
This page is for the owner, the IT person and the privacy officer. No badges we don't have — just exactly how the limits work, who can do what, and what happens when you want to stop it.
- Sign-off on by default
- Irreversible never unchecked
- Emergency brake
- Audit log 12 months
- Own database schema
- Nothing trained on your data
By default nothing goes out without a person
Every draft lands in one queue for the team. You edit, record the reason and sign off. The original version can always be restored, so you can see what changed and why.
- When you correct something, you record the reason
- "Back to the AI version" stays available
- Corrections only become a lesson when you activate them
Four levels, per mailbox and per type of email
You move up when your own numbers give you reason to. Moving back is always possible, and irreversible steps never go through without checks and a second pair of eyes, whatever the level.
Learning mode
Drafts are written and signed off, but nothing goes out. Usually the first week.
Manual
Everything prepared, someone signs off every message. The default level.
Smart
Only above a confidence threshold you choose based on your own numbers. The rest comes to you.
Automatic
The team sends by itself. Shown separately under "Autonomous" and fully logged.
Fixed rules, not the model judging itself
For every irreversible step, a list of checks is fixed in the code: the right date, the right property and a second pair of eyes. The language model cannot get around that list.
One click, and automatic sending stops
For the whole company, one mailbox or one type of email. Writing drafts continues, so your team can keep working — only nothing goes out on its own any more.
Administrators of your organisation switch the emergency brake. It takes effect within one sending round, and every pause is logged with name and reason.
Recorded who did what — the team or a person
Every change is logged and kept for twelve months. What went out without a person you can see yourself under "Autonomous", so you can check it specifically.
What we do with your data — and what we don't
In short: we look things up in your knowledge, we keep your data separate from everyone else's, and we don't train any model on your email.
Only what you connect
Per mailbox and per folder you decide what the team may see. Not connected means not read.
Own database schema
Every organisation has its own schema. That separation is tested automatically with every build.
Nothing trained on your data
The team looks things up in your knowledge and earlier answers. No model is trained on your data.
Personal data removed when learning
When learning from your email history, personal data is removed, and nothing counts until you activate it.
Credentials encrypted
Integrations and tokens stored encrypted, separately per organisation.
Two-factor available
Two-factor authentication is available for accounts.
Access per mailbox
Per mailbox you set who watches along and who signs off.
Your email stays yours
Your email stays in your own mailbox and goes out from your own address.