Is AI Email Safe?

In Australian data centres. Both the processing — the reading, categorising and drafting the AI does — and the storage of what it needs to keep occur onshore, not in the United States or elsewhere. This matters because letting an AI handle your inbox means the contents of that inbox pass through whatever model does the work, and where that model sits is a real privacy question, not a technicality. Under the Australian Privacy Act 1988 and the Australian Privacy Principles, your business remains accountable for personal information in your email regardless of who processes it, so we keep the processing where you can answer for it. We will document the specifics in writing during the free consultation for anyone who needs to sign it off.

No, and we are going to say that plainly rather than let a security page imply otherwise. Yes AI is a small independent Australian business and we do not currently hold SOC 2 or ISO 27001 certification. Plenty of vendors display those badges, and if your procurement process hard-requires a certified provider then you should choose one — we would rather tell you that now than have you discover the gap after signing. What we do provide are the controls those frameworks exist to assure: processing and storage in Australian data centres, encryption in transit and at rest, access controls and audit trails, a human-in-the-loop approval model, and a written account of exactly how your data is handled. We compete on being genuinely transparent about the architecture, not on a logo we have not earned.

Your email is used to serve you — to triage your inbox, learn your writing voice, and draft your replies — and it is not pooled with other customers’ data or used to train models that serve other businesses. Your correspondence is yours. This is a question worth asking every AI vendor directly, because the answer varies enormously and some consumer-grade tools reserve broad rights to use your content, so read the terms rather than assume. Ours is straightforward: your data trains nothing beyond your own assistant’s understanding of how you work, and it is not a training corpus for anyone else.

It is one of the most real and least-discussed issues in AI email, so here is the plain version. Many AI email tools route your messages through large overseas model providers, typically in the United States. Under Australian Privacy Principle 8, disclosing personal information to an overseas recipient is a disclosure you are accountable for, with obligations attached — it is not merely a hosting choice, and for regulated industries or government-adjacent work it can be a genuine compliance problem or a contract breach. The uncomfortable truth is that a lot of "AI email" marketing quietly skips over this. Our position is to process onshore and to put our offshore-disclosure stance in writing, so you are not taking a reassuring sentence on trust. This is general information about how the obligation typically applies, not legal advice — take the specifics to whoever owns privacy in your business.

Only if you explicitly configure it to, and even then only for the categories you choose. The default posture is human-in-the-loop: the AI drafts, a person approves, and only then does the message send. For sensitive, regulated or high-stakes correspondence we recommend keeping it that way — draft-first mode with one-click approval means nothing goes out in your name until you have decided it should. Some businesses do choose to auto-send certain low-risk, high-volume categories once they trust the drafts, and that is your call to make deliberately, category by category, rather than a default we impose. You are always accountable for what leaves your business, so the system is built to keep you in control of it.

Your data is handled according to the retention terms you set, and on cancellation it is deleted rather than retained indefinitely — you are not signing up to have your correspondence sit on someone’s servers forever. During onboarding we configure retention to suit your industry’s obligations, which for some regulated sectors means keeping records for a defined period and for others means minimising what is kept at all. If you leave, the offboarding covers deletion and, where relevant, export. As with the rest of this page, we will put the specifics in writing rather than ask you to trust a summary, and this is general information rather than legal advice about your particular retention obligations.