Security

Security and data handling

Emails carry orders, invoices and personal data, so ParsedMail keeps as little as it needs for as short as you choose. This page explains what happens to an email from the moment it arrives until it is deleted.

Encrypted in transit

Inbound mail, the dashboard, the API and webhook deliveries use TLS. Webhooks only go to https endpoints on public addresses.

Signed webhooks

Every POST carries an HMAC-SHA256 signature with a timestamp, so your endpoint can reject forged or replayed requests.

Retention by plan

Raw bodies and attachments are deleted after 7, 30 or 90 days, or after the period you set on Scale. Zero retention deletes the raw email right after parsing.

No training on your data

Email content goes to the language model only to produce your JSON. It is not used to train models.

Roles and two-factor sign-in

Owner, admin, member and reviewer roles; two-factor authentication for every account; SSO with SAML on Scale.

Audit log

On Scale, changes to schemas, inboxes, webhooks, API keys, settings and billing are recorded with user, time and IP.

Allowed senders

Restrict an inbox to known senders. Mail from anyone else is logged but never parsed or delivered.

Data processing agreement

Scale customers get a DPA covering processing on their behalf, sub-processor categories and deletion.

Who processes your data

We use a small set of service providers by category: a hosting provider for the application and database, an inbound mail provider that receives email for inbox addresses, a language model provider that reads the email during parsing, an email delivery provider for account messages, and a payment operator for billing. Each processes data only to provide its part of the service.

Reporting a security issue

Write to [email protected] with the subject "Security". We reply within two business days.

Frequently asked questions

Is my email content used to train AI models?

No. Emails are sent to the model only to produce your JSON, under terms that exclude training on the data.

How long do you keep raw emails?

7 days in the sandbox, 30 days on Starter, 90 days on Growth, and a configurable period up to 365 days or zero retention on Scale. Parsed JSON stays until you delete it.

Can I delete data on request?

Yes. Delete single emails or whole inboxes in the dashboard or with the API, or delete the account, which removes all its workspaces.

Do you sign a DPA?

A data processing agreement is part of the Scale plan.

See your own email as JSON

Paste one into the demo, describe the fields and look at the result. No account needed.

Parse an email Pricing