Privacy & security
What happens to your email
When you ask Mobiweb AI Mail to reply, draft, summarise, rewrite or translate, the text you are working on travels from Outlook to our servers, then to an AI model, and the answer comes back. This page explains each step and what is kept.
The path, step by step
- Outlook to our API. The add-in sends only the email you have open or the text you selected, over TLS 1.2 or later, to our servers at Hetzner in Germany. It cannot read the rest of your mailbox.
- Placeholders. Before anything leaves our servers, email addresses, links and international phone numbers are replaced with placeholders such as [EMAIL_1]. They are put back into the answer before it reaches you.
- AI processing in the EU. The prompt is sent to Claude models running on Amazon Bedrock in the European Union. Amazon Bedrock does not store model inputs or outputs by default, and Anthropic has no access to the prompts or results.
- Back to you. The answer streams back to the add-in. You review and edit it. Nothing is sent from your mailbox unless you send it.
What we keep
| Data | Kept? | Why and for how long |
|---|---|---|
| Email bodies, subjects, senders, your instructions, AI answers | No | Processed in memory to produce the answer, never written to our database or logs. An automated test checks this before every release. |
| Usage records | Yes | Feature, mode, model, token counts, time and status. Needed for plan limits and billing questions. Deleted after 13 months. |
| Account details | Yes | Your Microsoft account ID, tenant ID, name and email address, your writing preferences and your company's writing guidelines. Kept while you use the service; you can delete your own data from the add-in. |
| Subscription details | Yes | Plan, seats and status from Microsoft, and who bought it. Seat assignments are removed 30 days after a subscription ends. |
Training
We do not train AI models on your email, and our AI provider does not either.
Where things run
- Application servers and database: Hetzner Online, Germany.
- AI models: Amazon Web Services (Amazon Bedrock), European Union regions.
- Sign-in and billing: Microsoft (Entra ID and the Microsoft commercial marketplace).
The full list, with what each provider does, is on the sub-processors page. Our infrastructure providers hold ISO 27001 and SOC 2 certifications; these certifications belong to them, not to Mobiweb AI.
Access and security
- Every API call is authenticated with a Microsoft Entra ID token issued for this app. We never see your password.
- Email you receive is treated as untrusted input: the AI is instructed never to follow instructions written inside an email, and AI output is escaped before it is inserted into your message.
- The add-in asks Outlook for the lowest permission that lets it read and write the item you have open (ReadWriteItem).
- Access to production systems is limited to named Mobiweb AI staff.
Honest limits
- The AI model has to read the text in plain form to work on it, so we do not describe the service as end-to-end encrypted.
- Our claim about the EU covers AI processing and our servers. Outlook itself, Microsoft sign-in and Microsoft billing are run by Microsoft under your agreement with Microsoft. Mobiweb AI staff who support the service may work from the United Arab Emirates.
- Providers may keep data where the law requires it or to investigate abuse.
- We do not hold our own SOC 2 or ISO 27001 certification yet. We do offer a data processing agreement based on the EU standard contractual clauses.
Questions
Security questionnaires and data protection requests: privacy@mobiweb.ae.