Trust & security

This page answers the questions buyers and reviewers ask most about how alfred_ handles your data and your permission. For how approvals work in detail, see the pages below.

In this section

Will alfred_ email, schedule meetings, or message people without my permission?

A draft never sends itself. alfred_ prepares replies and waits for your approval before a draft goes out. It can also send when you ask it to directly, or when a rule or routine you set up calls for it.

Some things run on their own once they’re on: email rules, scheduled sends, and routines. Low-priority mail is filed out of your inbox by default, and you can switch to suggestions only. Team coordinators and connected AI assistants can act only within the permissions you grant.

How approvals, rules, and permissions work is covered in Approvals.

Does alfred_ train AI on my data?

• alfred_ doesn’t train AI models on your email, calendar, or conversations. Our AI model providers are contractually barred from training on your data too.
• Google data is off-limits for training. Anything from Gmail, Google Calendar, or Google Drive is never used to train machine-learning models, as Google’s API Services User Data Policy requires.
• We don’t sell your data.

Who at alfred_ can see my data, emails, or messages?

• alfred_ reads what it needs to do the work you asked for. It sorts your inbox, drafts replies, and surfaces what matters.
• Our team doesn’t read your content as a matter of routine. An authorized person, bound by confidentiality, can view it only in the cases below.
• You choose what support sees. If something goes wrong, you can ask us to look at a specific conversation or issue, and we’ll look only at that.
• Organizations set their terms in a signed data processing addendum. That can include troubleshooting a specific issue.
• Security and the law. We may view content when needed to investigate a security incident or abuse, or to comply with law.
• Google data has stricter limits. People at alfred_ don’t read it unless you agree for specific messages, it’s needed for security or to comply with law, or it has been aggregated for internal operations.

How is my data encrypted, and where is it stored?

Encrypted in transit and at rest. Connections use TLS, and your data is encrypted in our database. Sign-in tokens for your connected accounts are encrypted too.

Stored in the United States. Your account data is stored in the United States, and may also be processed in other countries where our vendors operate. See the Privacy Policy.

One honest note: this isn’t end-to-end encryption. alfred_ has to read your content to do work for you.

Do you have SOC 2 or compliance docs?

• SOC 2 Type II: in progress. The report isn’t complete yet.
• Google API Limited Use. Google user data is handled under Google’s API Services User Data Policy.

Where to find our security and privacy documentation

• Security overview: get-alfred.ai/security
• Subprocessors: get-alfred.ai/subprocessors
• AI model providers and no-training: get-alfred.ai/ai-model-providers

Enterprise: SSO, SCIM, HIPAA

For teams evaluating alfred_ against enterprise requirements, here’s where things honestly stand today:

• SSO / SAML: not available today. Microsoft 365 admins can approve alfred_ for their organization. See Microsoft 365 admin approval.
• SCIM (automated user provisioning): not available today.
• HIPAA / BAA: not available today.
• EU data residency: not available today.

Built-in protections

Beyond the controls you set, some protections apply automatically. Learn more in Built-in protections.

Does alfred_ have a privacy policy?

Yes. You can read it anytime at get-alfred.ai/privacy.