What happens to your mail when an AI is asked about it
This page is for the person who has to sign off: the IT manager, the security officer, the auditor. It says what the AI can reach, what it cannot do, and what you can show afterwards.
The path of one question
Every request takes the same route. Nothing reaches the AI before the guard has looked at it.
The person asks
In Claude or ChatGPT, about their own mail.
The guard checks
Your rules and your data filter, before the AI sees anything.
The mail system answers
The AI gets only what it needs.
The journal is written
Who, when and which button.
Six controls
Each one can be checked in the settings or in the journal.
Guard
Each request goes through it first. If a rule says no, the AI gets nothing and the person is told.
Data filter
Hide a folder, a sender or marked items. There is one filter for the whole organisation, so nothing is set per person and forgotten.
Own mailbox only
By default the AI works with the mailbox of the person who asks. Not a colleague's.
Service user
Exchange is connected through one service user you create. Nobody types a mailbox password into an AI tool.
Approval
Anything that would change a mailbox waits for a click. The AI proposes, the person decides.
Journal
Who asked, when, and which button. The text of the mail is not stored.
What the journal looks like
This is the record your auditor will ask for.
There is a time, a person, an action and an outcome. There is no message text. The exact fields are shown in the pilot, on your own system.
Questions auditors ask
The short answers, and where to verify each one.
Who is responsible for what
Security is shared. Here is the split.
What AddSync does
- Checks every request against your rules.
- Keeps the AI to search, show, draft and propose.
- Writes the journal.
- Does not copy your mail or train models on it.
What stays with you
- Choosing the AI tool and reading its terms.
- Setting the filter and deciding who may use AI.
- Telling staff what not to ask.
- Your legal basis and records under GDPR or local law.
- Looking at the journal now and then.
Questions
Does AddSync store my mail?
No. Mail stays in your mail system. The journal records that a question was asked, not the text of any message.
Where is my data processed?
AddSync chat uses a model in the EU region. If your people use their own Claude or ChatGPT, that provider's terms and regions apply. Tell us your setup and we will say exactly what applies.
Is AddSync AI GDPR compliant?
It is built to make your own compliance easier: limited access, a record of use, no copying of mail. Compliance still depends on how you use it, so write down your purpose and legal basis. This page is not legal advice. See the Privacy Policy.
Can I get a document for my auditor?
Write to us through the contact page and say what the auditor wants to see. We will tell you what we can supply.
Is there a public API?
No. Access runs through the guard.
What if one person must be excluded?
Remove them from the people who may use AI. The data filter applies to the whole organisation.
Want to see it on your own system?
Start with a few mailboxes and look at the journal yourself.