Your inbox is yours. Here is how we keep it that way.

Independently verified

NexaMails is a Google-verified OAuth application. Because we request access to Gmail and Calendar, Google requires an independent security assessment before granting that access, and we passed it.

• Assessed under Google's CASA Tier 2 program (Cloud Application Security Assessment, based on the OWASP Application Security Verification Standard) by an independent, Google-authorized security lab.
• Result: zero vulnerabilities found, top-tier security score.
• The assessment is repeated every year, so this is an ongoing commitment, not a one-time badge.

We do not store your email

This is a design choice, not a setting. Your messages stay in your Gmail or Outlook account.

• Email bodies and attachments are read on demand when you or the assistant need them, and are not saved to our database.
• We keep only the minimum needed to make the app fast and useful (for example a small index of message metadata and your assistant's memory), and you can delete your data at any time.

Encryption everywhere

• In transit: every connection uses HTTPS with modern TLS and HSTS.
• At rest: the access tokens that connect your mailbox are encrypted with AES-256-GCM before they are written to our database, and the database itself is encrypted at rest by our hosting provider.

You sign in with Google or Microsoft, never a password we store

Authentication is delegated entirely to your provider using OAuth 2.0. We never see, set, or store a password, and any two-factor protection you have with Google or Microsoft continues to protect your NexaMails access.

Your data is never used to train AI

NexaMails uses AI to help you read and write email, but your content is used only to serve you. In line with Google's Limited Use requirements, your Google Workspace data is never used to train generalized AI or machine-learning models. We send only the minimum text needed for each request to our AI providers, and it is not retained to improve their models.

Payments handled by Stripe

All billing runs through Stripe. Your card details are entered on Stripe's own secure checkout and never touch our servers.

Least privilege and access control

• Every request is scoped to your own mailbox. Our code cannot serve one user another user's data.
• We request the minimum Google and Microsoft permissions each feature needs, nothing more.
• Administrative access to production is limited to named individuals, protected by multi-factor authentication.

Report a security issue

We welcome reports from security researchers and act on them in good faith. Email support@nexamails.ai, or see our machine-readable policy at /.well-known/security.txt. Full details are in our Privacy Policy, which also lists every sub-processor we use.