AI Email Security: How CXassist Protects Your Privacy

Giving an AI access to email should make you cautious. Email contains customer identities, invoices, account context, support history, and sometimes sensitive business information. This page explains the practical security model behind CXassist: what is processed, what is retained, what is not stored, and how teams should think about safe rollout.

We never store your email content

CXassist processes emails in real time to generate replies and discards raw message content after processing. That means the assistant can read the inbound email for the purpose of creating a draft, but raw email bodies are not kept as a permanent database for staff to browse later.

What we do store

We retain the service metadata required to run the product: account settings, connected mailbox configuration, personas, training sources you provide, usage information, and billing records. Training data is different from raw mailbox content: it is the material you intentionally provide so the assistant can answer in your voice.

Compliance and controls

We follow the Google API Services User Data Policy, including Limited Use requirements, for integrations that access Google user data. Data is protected with encryption in transit and at rest, and access is limited to what is needed to operate the service. For the legal baseline, review the privacy policy and terms of service.

Safe rollout recommendations

Start with one support mailbox or alias, not every executive inbox.
Use draft mode before auto-send.
Keep legal, HR, finance, and safety-sensitive threads human-only.
Use redacted examples when training brand voice.
Review connected accounts and training sources regularly.

What your team should document

Document who approved mailbox access, which labels or folders are in scope, who can disconnect the assistant, and how incidents are escalated. Security is partly technical and partly operational: a safe tool can still be misused if teams connect the wrong inbox or train on stale policy. The rollout guidance in Outlook AI email setup and Gmail AI auto-reply setup applies here too.

FAQ

Does CXassist store my email content?

No. CXassist processes messages in real time to generate replies and discards raw email content after processing. We retain service metadata such as settings, training data, personas, and billing information.

Is CXassist GDPR-aligned?

We follow GDPR-aligned practices including TLS 1.3 in transit, encryption at rest, and limited data retention for the metadata required to run the product.

What is CXassist's relationship to Google's API policies?

We follow the Google API Services User Data Policy, including Limited Use requirements, for integrations that access Google user data.

Questions? support@cxassist.io