passband

Trust · updated November 5, 2026

Where your mail goes. All of it.

Passband reads your mail so it can decide what needs you. This page is the full account of what that involves: every place a byte of it goes, who runs that place, and how long it stays.

Training on your mail
Nevernot by us, not by our model provider
Isolation
One per accountown daemon, own database, own key
Subprocessors
9all listed below
Login codes to agents
Neversealed away from the assistant and AI tools

01 · DATA FLOW

One tenant. Every wire out of it.

Your hosted account is its own instance of the Passband daemon with its own database. Nothing else runs in it and no other account can reach it. These are the only ways data leaves.

We run the daemon for you. Every channel below is live. You run the daemon. Every channel we operate is off; what is left talks to Google, to your devices, and to a model provider only if you give it your own key.

Source

Your Gmail

Google, via the Gmail API. OAuth, scopes you approve.

sync in · your actions out
Your tenant · Hetzner, US Your tenant · your hardware

squelchd

The daemon that syncs, triages, and serves your mail.

  • Mail messages, attachments, search index
  • Google token sealed to a key only this tenant holds
  • Triage scores, rules, extracted cards
Never leaves

Your Google token, after signup

Sealed login codes, to the assistant or any agent

Its own container and volume. Network default-deny: no other tenant can reach it.

On your disk. We hold no copy and no key.

Your devicesThreads, search results and actions, between the daemon and the Passband apps you paired. The apps also tell your daemon which messages you opened, how long each was in front of you and how many links you followed, as counts and never which link, so Passband can tell which mail you have stopped reading. It stays in your mailbox database with the mail it describes.
Passband for Mac and iPhoneTLS, per-device tokens
mail content
Triage and the assistantThe parts of a message a model needs to score it, summarize it, or answer a question you asked. Triage is also what recognizes login codes, so it reads them once; after that they are sealed away from the assistant.
Anthropicthrough our gateway on AWS, which meters spend and keeps no bodies
mail contentoff
BackupsThe mailbox database, streamed continuously so a lost disk costs minutes, not your history. Encrypted on our server before upload.
Cloudflare R2ciphertext only; Cloudflare holds no key
encryptedoff
Push notificationsA fixed alert, an event id, and the Gmail thread id so repeat alerts collapse. The phone fetches the mail itself, from the daemon.
Apple Push Notification servicevia our relay on AWS, which stores nothing
no mail content
Read receipts opt-inIf you turn on open tracking for mail you send, a self-hosted daemon that uses our relay has it hold an opaque token, a time and a user agent until the daemon collects them. A hosted account serves the pixel from its own daemon, so its opens never reach the relay.
Our relay on AWSself-hosted only; only your daemon can tie a token to a message
no mail contentoff
Unsubscribing in a browserWhen you ask to unsubscribe and the sender's page cannot be finished without a real browser, the daemon opens that sender's unsubscribe link in a remote one and works the page for you. The browser gets the link, the page, and your address if the form asks for it. Nothing else from your mailbox goes with it.
Browserbaseone browser per unsubscribe, closed when it ends, nothing recorded
one link, no message textoff
Health metricsCounts and timings, like messages synced and triage latency, labelled with your account's label and nothing finer.
Our monitoring on AWSaggregate by design, never per message
no mail contentoff

Outside the tenant

These never see your mailbox. They are how an account comes to exist and how we know the apps work.

Your account recordThe address you signed up with, your account label, your invite, and timestamps. No mail, no Google token.
Our control plane, Postgres on AWS
Your inviteWhen you come off the waitlist, one email with your invite code.
Resend
App usageEvents like "a thread was archived", from a fixed list enforced in code, keyed to a random id rather than your address. On the Mac, a recording of each session's layout: grey boxes, the app's own icons, and clicks. Never text, pictures, what you type, or anything inside an email, though it shows which kinds of cards were on screen. You can turn it down or off in Settings.
PostHog, US
Images and iconsThe apps load images in your mail directly from the sender's servers, with cookies off and tracking pixels stripped. Switch to On demand in Settings to load none. Icons for automated senders come from DuckDuckGo's icon service, by domain.
The sender's servers, DuckDuckGo

02 · SUBPROCESSORS

Who we hand data to.

Every third party that processes data on our behalf for the hosted service. We give 30 days' notice before adding one; see the DPA below.

ProviderWhat forWhat it seesWhere
Hetznerhetzner.com Servers that run hosted tenants Your mailbox database and sealed Google token, at rest and in memory
mail content		 United States
Anthropicanthropic.com Language model inference for triage, summaries and the assistant Message excerpts, in transit. Not used for training
mail content		 United States
Amazon Web Servicesaws.amazon.com Our control plane, LLM gateway, push relay and monitoring Mail excerpts passing through the gateway, not stored. Your account record
mail content		 United States
Cloudflarecloudflare.com Backup storage (R2) and DNS Mailbox backups, encrypted before they arrive
encrypted only		 Global
Browserbasebrowserbase.com A remote browser that finishes an unsubscribe on the sender's own page Only when you ask to unsubscribe and the sender's page needs a real browser: that sender's unsubscribe link, the page it opens, and your email address if the page's form asks for it. One browser per unsubscribe, closed when it ends, with recording and logging off
one link, no message text		 United States
Appleapple.com Push notification delivery Device token, event id, thread id
no mail content		 United States
WorkOSworkos.com Sign-in for AI agents you connect to your mailbox (AuthKit) Your email address and the grants you approve for each agent. It issues the tokens those agents present, so it is trusted to vouch for who may read your non-sealed mail
no mail content		 United States
Resendresend.com Sending invite email Your email address and invite code
no mail content		 United States
PostHogposthog.com Product analytics from the apps Allowlisted usage events, layout-only session recordings with no text or pictures, a random id; for hosted accounts, your email address and name
no mail content		 United States

Google is where your mail comes from, not a processor of ours: Passband reaches it with the Gmail API scopes you approve and no others. On self-host, none of the providers above are involved unless you choose them.

03 · RETENTION

How long anything stays.

Most of what passes through our services is never written down. The rest is on a clock, or kept until you ask us to erase it.

What
Not storedDaysWeeksLife of account
Push notificationsrelaynever stored
never stored
Model requestsat our gatewaybodies never stored; token counts kept
bodies never stored; token counts kept
BackupsCloudflare R2, encryptedrolling 24 hours
rolling 24 hours
Server snapshotsHetzner, system disk, no mail7 days
7 days
Model requestsat Anthropic; longer only if flagged for abuseup to 30 days
up to 30 days
Read-receipt eventsrelay, until collectedup to 90 days
up to 90 days
Your mailboxmail, attachments, search index, triageuntil you delete it
until you delete it
Google tokensealed to your tenantuntil you delete it
until you delete it
Account recordcontrol planeuntil you delete it
until you delete it
  1. Ask. Email us from the address on the account. You do not need a reason.
  2. We erase it within 30 days. The mailbox volume, the Google token and its key, every backup, the gateway key and the account record.
  3. We confirm in writing. The only thing left is a server snapshot of our own system disk, holding no mail, and it ages out in 7 days.

Revoking Passband at myaccount.google.com/permissions ends our access to your mailbox at once, whether or not you have asked us to delete anything.

04 · CONTROLS

How it is held.

The short version of the threat model. The long one is public.

Sync never writes

Google grants Passband one Gmail permission, and it can read and write. Passband keeps the two apart in its own code: the sync and triage path loads its own credential slot and has no code that archives, labels or sends.

One instance per account

Your own container and volume, user-namespaced, behind a default-deny network policy. Tenants cannot reach each other.

Keys you can count

Your Google token is sealed to a key only your tenant holds. Cluster secrets are encrypted at rest. Backups are encrypted before they leave the server.

Login codes are sealed

Verification codes, sign-in links and password resets are sealed as they are recognized, by rules first and triage second. Sealed mail is never shown to the assistant or to AI agents, and opens only when you reveal it.

Agents draft, you send

The interface Passband offers to AI agents serves mail as text only, never HTML and never sealed mail. Agents can leave drafts for you to review. Sending is off unless you turn it on, and then each message needs your approval.

Mail renders sandboxed

Email is sanitized when it arrives and shown with scripts off, navigation blocked and nothing written to disk.

What we do not have yet

Said here so you do not have to find it in a questionnaire. No SOC 2 report. Hosted tenants run in one region on one server, and the mailbox volume is not encrypted at the disk layer; the Google token and the backups are. The people who run Passband can, in principle, reach a hosted mailbox, and do so only to answer a request you made or to investigate a security problem. If that is more trust than you want to extend, self-host: then we hold nothing at all.

More questions? Email braelyn@passband.app

05 · DPA

We sign your DPA.

If your company processes personal data under GDPR, UK GDPR or a US state privacy law, send us your data processing agreement and we will review and sign it. Whatever paper it is on, these are the terms we commit to.

Send us your DPA →

Or email braelyn@passband.app for a call with your security team.

  • Your instructions only. We process your data to run Passband for you and for nothing else.
  • Named subprocessors. The list above, with 30 days' notice before we add one and the right to object.
  • Breach notice within 72 hours of our becoming aware of one that affects your data.
  • International transfers under the EU Standard Contractual Clauses and the UK Addendum. Hosted data lives in the United States.
  • Deletion on exit. Everything erased within 30 days of termination, confirmed in writing.
  • Help with requests from your people to access, correct or delete their data.
  • Security as described here, as the DPA's technical and organisational measures, with this page and a completed questionnaire for audit.