Security & Privacy
Your email data security is our top priority. We adhere to the strictest data protection standards and never compromise on your privacy.
Compliance
GDPR
Compliant
CASA Tier 2
Compliant
OAuth 2.0
Secured
TLS 1.2+
Encrypted
AES-256
Encrypted
Microsoft 365 & Google Workspace Compliance
Draftr's use of information received from Microsoft 365 APIs (including Outlook and Calendar) and Google APIs (including Gmail and Google Calendar) adheres to their respective API Services User Data Policies, including Limited Use requirements.
Security Checklist
Draftr never sends emails
Draftr drafts email responses and provides suggestions, but cannot send emails without you pressing the send button.
GDPR and CASA Tier 2 compliant
Our app is Google-verified with GDPR-aligned practices and CASA Tier 2 compliance, ensuring your data is handled with the highest standards.
Your data is never used to train AI models
We do not use Gmail or Calendar data to train general-purpose AI models, shared models across users, or any system outside your individual Draftr account. Your data never improves models for other users.
No permanent email storage
Gmail message content is processed in real time and never stored. Calendar event content is also processed in real time and never stored.
Continuous monitoring and audits
All systems are continuously monitored with regular penetration testing. We notify Google and affected users promptly if any security incident occurs.
Security Features
Enterprise-Grade Encryption
TLS 1.2+ encryption for all data in transit and AES-256 encryption for data at rest, ensuring your information is always protected.
OAuth 2.0 Authentication
Secure authentication through Microsoft 365 and Google's OAuth 2.0 systems with encrypted OAuth tokens. We never see or store your password.
Minimal Data Access
We access only the minimum data required to provide your selected features. Email and calendar content is processed in real time and never stored.
Zero Data Retention
Email and calendar content from Microsoft 365 and Google Workspace is not stored. Account data is deleted within 30 days of account deletion. Your data is always yours.
Role-Based Access Controls
Strict role-based access controls with secure key management. Draftr employees cannot read your email content except in narrow, documented cases.
Incident Response
We notify Microsoft, Google, and affected users promptly if a security incident involves user data. Our team is available 24/7 for security matters.
What We Never Do
Your Microsoft 365 and Google Workspace data (email and calendar) is never used for:
Ready to experience secure email management?
Join thousands of founders who trust Draftr with their email security.