Your data, protected.
alfred_ handles your most sensitive professional data: email, calendar, and tasks. Here's exactly how we keep it safe.
AES-256
Encryption at rest and in transit
OAuth 2.0
We never see your password
Row Level Security
User-level data isolation
No AI training
Your data never trains models
Data encryption
- At rest
- All stored data encrypted with AES-256, the same standard used by banks and governments.
- In transit
- All connections secured with TLS 1.3. Data is encrypted between your browser, our servers, and third-party APIs.
- Database
- PostgreSQL with encrypted storage volumes. Automatic daily backups, also encrypted.
Authentication
- OAuth 2.0
- alfred_ connects to Gmail, Outlook, and Google Calendar via OAuth 2.0. We never see, store, or ask for your email password.
- Scoped permissions
- We request the scopes needed for the features you connect: read/write email and calendar, read-only contacts, and cloud file access. The exact list is always shown on Google's or Microsoft's consent screen.
- Token security
- OAuth tokens are encrypted at rest and refreshed automatically. You can revoke access at any time from your provider's settings.
Data privacy
- What we access
- Email metadata and body content for AI processing, calendar events for scheduling intelligence, contact names and addresses for recipient autocomplete, and cloud files when you use file features.
- What we don't
- Nothing outside the accounts you connect. No browsing history, no location, no data brokers, and no advertising use, ever.
- Search index
- For subscribers, alfred_ keeps a searchable index of recent email (cleaned message text plus embeddings) so it can answer questions and cite the right message. Encrypted, isolated to your account, never used for training, deleted with your account.
- Voice stays on your device
- Speech recognition runs on your own device and only the text reaches us. alfred_ never receives or stores recordings of your voice.
- No training on your data
- Your emails, tasks, and calendar data are never used to train AI models. Your data is yours.
Infrastructure
- Supabase + PostgreSQL
- Production database hosted on Supabase with enterprise-grade PostgreSQL infrastructure.
- Row Level Security (RLS)
- Database-level access control ensures every query is scoped to the authenticated user. No cross-user data leaks.
- Automatic backups
- Daily automated backups with point-in-time recovery capabilities.
AI processing
- Processing-focused
- AI processes your emails to sort them, summarize them, and keep track of what is waiting on you. Your chat conversations with alfred_ are stored so you can pick up where you left off, protected like everything else, and deleted with your account.
- No data sharing
- Your email content is not shared with third parties for advertising, analytics, or any purpose beyond providing alfred_ functionality.
- Model providers
- AI processing uses the Anthropic (Claude), OpenAI, and Google (Gemini) APIs under commercial API terms. Your content is sent for inference only.
Access control
- User-level isolation
- Every user's data is isolated at the database level. There is no shared data pool between accounts.
- Session management
- Secure session tokens with automatic expiry. Sessions are invalidated on password change or account actions.
- Admin access
- Internal access to production data is strictly limited, logged, and requires multi-factor authentication.
Compliance & practices
- GDPR-friendly
- Data deletion on request, data export capabilities, and transparent data processing practices aligned with GDPR principles.
- Data deletion
- Delete your account at any time from Account Settings. After a 14-day grace period (during which you can cancel), your data is permanently deleted.
- Payment security
- Payments processed by Stripe (PCI DSS Level 1). alfred_ never sees or stores your credit card number.
Does alfred_ store my email password?
No. alfred_ uses OAuth 2.0 to connect to your email provider. We never see, ask for, or store your email password.
Can alfred_ send emails without my permission?
No. alfred_ sends a reply only when you say so. The only email alfred_ sends from your account on its own comes from automations you created yourself, such as a forwarding rule or a scheduled send, and you can pause or delete those anytime.
Is my email data used to train AI models?
No. Your emails, calendar data, and tasks are never used to train AI models. Your data is processed only to provide alfred_ functionality.
How do I delete my data?
Go to Account Settings and select "Delete Account." After a 14-day grace period (during which you can cancel), your data is permanently removed from our systems.
Does alfred_ keep a copy of my email?
If you are a subscriber, yes: alfred_ keeps a searchable index of your recent mail (message text with quotes and signatures stripped, plus embeddings that let it search by meaning) so it can answer questions and point you at the right message. It is encrypted, reachable only by your account, never used to train models, and deleted when you delete your account or ask us to remove it.
Does alfred_ record my voice?
No. Speech recognition runs on your own device, and only the resulting text is sent to us. We never receive or store your voice audio. When alfred_ speaks, that audio is streamed to your device and not stored either.
What happens if alfred_ is breached?
All data at rest is encrypted with AES-256, so even in a breach scenario, data is not readable without encryption keys.
Can I revoke alfred_'s access to my email?
Yes, at any time. You can revoke OAuth access from your Google or Microsoft account settings.
Where is my data stored?
Data is stored on Supabase-hosted PostgreSQL databases with encrypted storage volumes in SOC 2 compliant data centers.