All documentation
On this page
For IT and security
Mailbox MCP for IT and security teams
The answers a vendor questionnaire asks for, in the order it asks them, with a link to the page that says more.
Mailbox MCP is a hosted MCP server. A person connects a mailbox they already own, and an AI assistant they already use can read and act on it, on their instruction, through the Model Context Protocol.
Everything below is true of the service as built on the date at the foot of the page. Every figure is the one the privacy policy states, because both read the same constant.
Company
| Legal entity | BSolve IT Limited, trading as Mailbox MCP |
| Registered in | England and Wales, company number 04607330 |
| VAT number | GB 806 170 747 |
| Registered office | 5 Epping Close, Barton Seagrave, Kettering, Northamptonshire, NN15 6TR, United Kingdom |
| Security contact | support@mailbox-mcp.com, read by the person who built the service |
| Data protection | The controller for account data; the processor for the customer's mail, calendar and address book data, under the data processing agreement |
Hosting and location
The servers are run by us, in London. Hosting is on 365i, which is part of BSolve IT Limited, the processor. The data-centre operator behind it is a United Kingdom provider whose name we give on request, and it holds no key to any customer data.
| Service and control panel | A 365i Unmanaged VPS in London, United Kingdom. No CDN and no third-party proxy sits in front of the service, and there is no other region. |
| This website | 365i hosting, also in the UK, behind the StackCDN edge cache |
| The service's own emails | Such as an address confirmation or a receipt. They go out through Brevo, in France |
Nothing that holds customer data is hosted outside the United Kingdom, with 3 exceptions. All are described under sub-processors:
- Payment, which is Stripe's.
- A support request sent from the control panel: Cloudflare stores the ticket, and Brevo sends its emails.
- Every other email the service sends goes out through Brevo: the account and security emails, such as an address confirmation, a password reset or a receipt, and the notes from us.
None is given a password, an access token or the contents of a mailbox message.
Clause 7.2 of the data processing agreement gives the legal basis each of these transfers relies on.
MoreSecurity: how connections are made
Sub-processors
4 organisations process something on our behalf, and none of them is ever given a password, an access token or the contents of a mailbox message.
Stripe holds a payment record. The data-centre operator holds an
encrypted copy of what we store. Cloudflare and Brevo handle a support
request when a customer sends one from the control panel. Every email
the service sends goes out through Brevo, from
noreply@mailbox-mcp.com.
365i is not among them. It is part of BSolve IT Limited, so the hosting is ours rather than a sub-processor's, and the organisation listed for it is the data-centre operator behind our servers.
Your mail provider, your calendar provider, your contacts provider and your AI provider are not on this list either. You chose each of them, they already hold what they hold, and the privacy policy describes what reaches each.
| Company | What for | Where, and customer data |
|---|---|---|
| StripePayment | Card details are entered on Stripe's systems and never reach ours; we hold the record that a payment happened and the account email it was made under. | United States and European Union, under Stripe's own data processing agreement and its own transfer mechanism. |
| The data-centre operatorInfrastructure | The United Kingdom provider whose infrastructure our servers run on: the 365i VPS the service and the control panel run on, the 365i hosting this website and the off-site backup copy sit on, and the 365i mail platform our support mailbox is on. Named on request. | United Kingdom. It holds no key to any customer data: everything we hold is encrypted as the privacy policy describes, and the keys are ours. |
| CloudflareUptime monitor | Requests the service's 2 public health endpoints every 10 minutes and keeps the results. | United States (San Francisco), on a global network. The health checks carry no customer data. |
| CloudflareSupport desk | Stores a support request sent from the control panel, in a Cloudflare Worker with its own database. Its Workers AI (Cloudflare's hosted model) drafts the reply we read before we answer; the customer never sees an unsent draft. A closed ticket is deleted 12 months later; one still open or answered is kept until it is closed. | United States (San Francisco). The customer's name and account email, their message, how urgent they said it is, and which mailbox it concerns if they chose one. Only if they tick to include it, diagnostic detail such as plan, account age, each mailbox's provider and connection state, recent error codes and which AI clients are connected. |
| BrevoAlerts | Delivers alert emails to us: the monitor's, when the service stops answering, and the server's own, when a backup or another scheduled job fails. | France (Paris). An alert names the check or job that failed, and nothing about any customer. |
| BrevoSupport emails | Sends the acknowledgement to the customer, with their reference, and a notification to us, when a support request is submitted. | France (Paris). The customer's name, account email and their message, as the text of the email. |
| BrevoAccount emails | The service's account and security emails: the address confirmation, the welcome, password resets, security notices such as a new device signing in or a changed password, Pro, payment and billing emails and receipts, Team Access invitations and notices, mailbox reconnect notices, the warning before an idle account with no mailbox is deleted, and the emails about a reviewer application. And the notices sent to us about a new account or a payment. |
France (Paris). The text of each email: the recipient's address, the names and addresses of the people and mailboxes it is about, a payment's amount and what it was for, and, when a new device signs in, which device and its IP address. A link to confirm an address, reset a password or accept an invitation works once and expires. A Team Access notice of a first email to a new domain also gives the domain and the message's subject. |
| BrevoAccount notes | The getting-started emails (a few short notes from us in an account's first days while it has no mailbox or its mailbox has not been used), the one note sent when an account's first call goes through, the note sent the first time a free mailbox has used its 5 calls (once per mailbox), and the occasional note about something new in the service. Each carries a one-click stop, and each is switched off for good under the account's Settings. |
France (Paris). The customer's name, account email, the address of the mailbox it is about, which AI client made the call where the note says so, and the text of the note. |
Changes to this list are announced by email to the account address 30 days before they take effect, and a customer who objects can close the account before then. The DPA sets that out.
MorePrivacy: who else is involved
What we hold and for how long
Message content is never stored. Mail, calendar and address book data pass through the server in memory while a request is served, and are not written to disk. So there is no archive of a customer's mail or contacts here to be breached, subpoenaed or lost.
A contact stays in memory for about 10 minutes after it was last asked for, so the next question about the same person is quick. It is then forgotten.
A contact the customer asks to change is written to their own book, and to nothing of ours. When the customer asks the assistant to add, correct, delete or import a contact, it is written to their own contacts server, their Outlook contacts or their Google contacts, on that instruction and with a precondition:
- A correction or a deletion is made against the card as it was just read.
- A new or imported card lands on no existing card: on a CardDAV book only where none sits at the address it is given, and on Outlook or Google contacts under an id Microsoft or Google mints.
- An imported card is skipped where the book already holds its first email address.
The audit record of the call holds the tool name and the outcome. Each argument is redacted, or reduced to a count of how many addresses, phone numbers or cards it carried.
What is held is the account, the mailbox connection settings, an encrypted credential per mailbox and per connected calendar and address book, and these records:
| Account details and credentials | Until the account is closed or the mailbox removed, then deleted |
| Record of each MCP call | 90 days, then deleted. The rolling limit reads only the last 24 hours of it |
| Audit record of each MCP call | 400 days by default, then deleted; the account's owner may shorten it to any period from 90 days under Settings |
| IP addresses | Part of the 2 records above and deleted with them |
| Web server logs | A rolling 90 days |
| Payment records | As long as UK tax law requires accounting records to be kept |
| Support emails | Up to 2 years |
MorePrivacy: how long we keep it Security: what we hold
Encryption
TLS on every path in transit, and AES-256-GCM for every stored credential.
| In transit | TLS on every path. The AI client to the service, the control panel and this website are HTTPS. Microsoft 365 and Google are reached on fixed encrypted endpoints that cannot be downgraded. |
| A custom IMAP host | Reached on the ports the customer gives, exactly as a desktop mail client does. The privacy policy says in as many words that a plaintext port is a choice available to them. |
| Stored credentials | Each encrypted with AES-256-GCM under its own random key, and bound to the mailbox it belongs to, so a row lifted from the database decrypts against nothing else. |
| The master key | Wraps each credential's key. Held outside the database and outside the source code, in a file only the machine's administrator account can read, which the operating system hands to the service at start. |
| Control panel passwords | Argon2id hashes |
| AI client tokens | The token an AI client authenticates with is stored only as a hash of itself |
MorePrivacy: how it is protected Security
Backups
Every night, encrypted, kept for 14 nights, copied off the machine, and restore-tested every week.
| Schedule | Every night, encrypted with a key of its own |
| Kept | 14 nights, so a fault that quietly corrupted rows for a week is still recoverable from before it began |
| Off-site | A verified copy is filed off the machine each night, also in the United Kingdom |
| Restore test | Every week. The newest backup is restored into a scratch database and a real credential is decrypted out of it. That is the only test that proves a customer could be put back to work, rather than that bytes moved. |
| The master key | Asserted absent from every backup, so a leaked backup file yields nothing |
| A failed job | Raises an alert rather than leaving a quiet gap |
MoreStatus: what the monitor checks
Access control
Access is bounded per account, per connection, per mailbox and per person. Every grant can be revoked from the customer's own side, without us.
The account
A password of at least 12 characters, stored as an Argon2id hash. Time-based one-time password (TOTP) two-factor authentication is available on every account and, at the owner's choice, required of everyone on it.
The panel signs you out after 30 minutes without activity in the browser. The underlying session expires after 7 days idle, or 30 days at most. Every live session is listed under Settings, where it can be ended, and changing the password ends every one of them.
Two-factor, required of everyone
A switch under Settings, Security requires an authenticator of every person on the account. It needs the owner's own authenticator first, and the owner's cannot be turned off while the switch is on, so the owner cannot lock themselves out.
While it is on:
- A person on the account without an authenticator can do nothing in the control panel but set one up, and has their AI connections refused on their next call until they have.
- A person invited without one cannot accept the invitation until they have set one up. Their own control panel is not otherwise affected.
A mailbox's pasted access token is the mailbox's credential rather than a person's sign-in, so it is outside the switch.
Each connection
A connection made by signing in carries a permission level: read only, draft and file or send and delete, with the calendar as a separate switch. It is chosen at approval, changed in the panel without reconnecting, and enforced by the server on every call, before the AI client is consulted.
Each mailbox
A limit set by the mailbox's owner on its Connector tab: one of the same 3 levels, and the calendar switch. It defaults to send and delete with the calendar on.
It is the most any AI client may do with that mailbox:
- every connection acts at the lower of its own level and the limit
- a pasted access token takes the limit as its level
- nothing can be approved or granted above it
- lowering it caps every connection above it on its next call, without rewriting any of them
Each person, with Team Access
A named person is invited by email address and given their own connector URL per mailbox. The account holder sets their level (from the same 3), the calendar on or off, a daily cap and a list of mailboxes, and changes them without reconnecting.
The invitation is accepted only by an account whose verified address is the one invited. Every call carries the person who made it in the activity record. Removal is one action, and ends every connection the person held on its next call.
Single sign-on (enterprise managed authorisation)
A Claude Team or Enterprise administrator can have Claude connect each person without a consent screen, on an identity assertion signed by the organisation's identity provider (Okta today, through its Cross App Access).
It is switched on by the account's owner, who registers that provider's issuer URL under Settings. It needs Team Access.
The server verifies the assertion against the provider's published keys, and lets in only:
- the mailbox's owner, at the mailbox's limit
- a person holding an active share of it, at the level set for them under People
Anyone else is refused, and nothing is created or widened.
The token lasts an hour, with no refresh token. Removing the person at the identity provider ends their access at the next exchange; removing them under People ends it at the next call.
Verified live on 15 September 2026: a Claude Team organisation signing in through an Okta organisation, set up as the administrators' section of the Claude.ai page describes; Claude's own connection test passed all 4 of its steps against this server, and a member's chat read a mailbox with no consent screen. Before that, on 14 September, Okta's Cross App Access playground and the server's own tests.
Revocation
From the customer's own side, at any time, without us:
- Removing a mailbox in the panel deletes its credential, and every AI client loses it that minute.
- A Microsoft or Google grant can be withdrawn at the provider, and access ends immediately.
- An IMAP app password can be revoked at the provider, or the mailbox password changed, with the same effect.
- An organisation can revoke the app for every user at once, from the Microsoft Entra admin centre or the Google Admin console, as the administrator pages describe.
On our side, the servers are administered only by the people who run the company. Nobody reads a customer's mail except where the customer has asked us to look at something specific, or where investigating a fault or abuse requires it.
MoreSecurity: what you can limit Security: per person, with Team Access Claude.ai: for Claude Team and Enterprise administrators Security: how to revoke access
Audit
Every MCP call is logged, per customer, and kept for 400 days by default.
| A row holds | Which tool ran, when, on which mailbox, whether it worked, the IP address it was called from, and, where a read raised one, the name of a warning sign as a short label |
| A row never holds | The contents of a message, a filename or a file |
| Where it is read | The control panel's Activity page, filtered by mailbox, tool and outcome |
| Export | A CSV with the same filter applied, so the file downloaded is the rows that were on screen |
| Retention | 400 days by default. The account's owner may set any number of days from 90 to 400 under Settings |
The retention is the account owner's to shorten. The record is pruned at the number they choose for their account, and at the default for everyone who has chosen nothing. 90 days is the least that still covers a charge, the statement after it and the time it takes anyone to ask.
Availability
The status page shows the current state, 90 days of history and every incident.
It is read from a monitor on Cloudflare that requests the service's 2 public health endpoints every 10 minutes, and alerts the person who runs the service on consecutive failures. The monitor keeps its own status view on its own provider, so a status page exists even when this website does not.
No service level agreement is offered, and the terms say so plainly. The service depends on the customer's mail provider, their AI provider and the network between them, none of which we control.
MoreService status Terms: availability
Incident and breach notification
The commitment
Where a personal data breach affects a customer's data, we notify that customer without undue delay and within 72 hours of confirming the breach, by email to the account address, with what was affected and what to do. Where the law requires it, we notify the Information Commissioner's Office within 72 hours.
Because message content is never stored, a breach of our systems cannot expose an archive of a customer's mail. What it could expose is the encrypted credentials and the account records, and the notification would say which.
It would also tell the customer to revoke the credentials at their provider. They can do that without us, and it ends the exposure whatever state our systems are in.
Vulnerability disclosure
A security.txt (RFC 9116) is published at
/.well-known/security.txt
and names support@mailbox-mcp.com
as the contact.
A report is acknowledged, investigated, answered with what was found, and credited if the reporter wants credit. There is no bug bounty and no payment.
Please do not test against another customer's mailbox, and give us a reasonable chance to fix something before publishing it.
MoreSecurity: reporting a security problem
Certifications
BSolve IT Limited holds a Cyber Essentials certificate. The certificate (PDF) is published here, and the IASME registry verifies it.
| Certificate number | f97b9fa1-0051-4b5c-8a3a-22cad9a487d7 |
| Issued | 17 September 2026 |
| Scope | Whole organisation |
| Question set | 3.3 (Danzell) |
| Assessed by | Zenguard Cyber, for IASME Consortium |
| Recertification due | 17 September 2027 |
Cyber liability insurance comes with it.
| Cover | £25,000 in the aggregate |
| Underwritten by | American International Group UK Limited (AIG) |
| Period | 17 September 2026 to 17 September 2027 |
| Basis | The cyber liability insurance that comes with a current Cyber Essentials certificate through IASME |
| Evidence | Sent on request from support@mailbox-mcp.com |
Beside the certificate, the evidence is published rather than asserted:
- a security page whose every claim is checked against the engine source
- a threat model that puts one of 3 words, mitigated, partially or not solved, against every attack it names, and concedes in the same table it claims
- a privacy policy that states the protection mechanisms themselves
- a changelog of every release
- the disclosure address above
MoreSecurity: Cyber Essentials certified Threat model Changelog
Administrators
If your organisation requires an administrator to approve third-party apps, there is one page for each console. Each carries the app by its identifiers, the permissions it asks for and what each is used for, the one-step approval, and the way to revoke it:
On Microsoft, the app registers delegated permissions only, and no application permissions. On Google, Gmail is connected by an app password over IMAP, and only the calendar and Google contacts have an OAuth app.
A Claude Team or Enterprise administrator setting up single sign-on has a section of their own on the Claude.ai page: the 7 steps across Okta, the Claude admin console and our control panel, in the order they were taken, and the day it was verified live.
The overview for a buyer, single sign-on first, is the teams page.
Data processing agreement
The data processing agreement is a page, incorporated into the terms of service by a sentence in their governing section, so it applies to every business customer without anything being signed.
It was written by us and has not yet been reviewed by a solicitor. If your procurement needs a countersigned copy, ask.
Contact
support@mailbox-mcp.com, for the questionnaire itself, for anything on this page that needs a longer answer, and for a security report. It reaches the person who built the service, and a reply comes within one working day, Monday to Friday, UK time.
Frequently asked questions
Where is my data stored?
In the United Kingdom. Our servers run in London on 365i, part of BSolve IT Limited, and the UK data-centre operator behind them holds no key to customer data. Your mail, calendar and address book are never stored. Account details, credentials and call records stay there, backed up nightly, encrypted, in the UK. 3 things leave the UK: payment (Stripe), support requests (Cloudflare, US) and our emails (Brevo, France). DPA clause 7.2 gives the legal basis for each.
Which certifications do you hold?
Cyber Essentials. BSolve IT Limited, the company that runs Mailbox MCP, holds certificate f97b9fa1-0051-4b5c-8a3a-22cad9a487d7, issued on 17 September 2026 with the whole organisation in scope, recertification due 17 September 2027. The certificate is published at https://mailbox-mcp.com/assets/docs/cyber-essentials-certificate.pdf and verified on the IASME registry at https://registry.blockmarktech.com/certificates/f97b9fa1-0051-4b5c-8a3a-22cad9a487d7/. Cyber liability insurance of £25,000 with American International Group UK Limited (AIG) comes with it, to 17 September 2027; the evidence of insurance is sent on request.
Is there a DPA?
Yes, published at https://mailbox-mcp.com/dpa/. It forms part of the terms of service where the service is used for a business, so it applies without anything being signed. It names the customer as controller and BSolve IT Limited as processor, and covers the processor obligations under UK GDPR, the sub-processors, the breach commitment, international transfers and deletion on termination. It was written by us and has not yet been reviewed by a solicitor; for a countersigned copy, ask at support@mailbox-mcp.com.
How do I revoke access?
From your own side, at any time, without us. Removing a mailbox in the panel deletes its credential, and every AI client loses it that minute; disconnecting a calendar does the same. Each signed-in connection can be revoked or have its level changed, and the mailbox's limit caps every connection, pasted tokens included. At the provider, withdraw a Microsoft or Google sign-in, or revoke an IMAP app password. An organisation can revoke the app for every user at once.
Who are your sub-processors?
4. Stripe takes payment, in the US and the EU, under its own data processing agreement. A United Kingdom data-centre operator, named on request, runs the infrastructure under our servers and holds no key to customer data. Cloudflare, in the United States, runs the uptime monitor and stores support requests. Brevo, in France, sends every email the service sends. None is given a password, an access token or a message's contents. Changes are announced by email 30 days ahead.
Can we require two-factor authentication of everyone on the account?
Yes. Two-factor authentication (a time-based code from an authenticator app) is available on every control panel account, and the owner can require it of everyone with one switch under Settings, Security. While it is on, a person without an authenticator can do nothing in the panel but set one up, and the server refuses their AI connections until they do. A mailbox's pasted access token is outside the switch; the mailbox's limit controls that.
Can our IT department connect everyone without a consent screen?
Yes, on a Claude Team or Enterprise plan. Claude connects each person with no consent screen, on an identity assertion signed by your identity provider (Okta today, through its Cross App Access); Anthropic calls it Enterprise Managed Auth. Your account's owner registers the provider's issuer URL under Settings and switches it on, which needs Team Access. Only the mailbox's owner, or a person holding an active share of it, gets in, at their level; anyone else is refused. Set-up: https://mailbox-mcp.com/docs/claude-ai/#administrators.
What is your breach notification process?
Where a personal data breach affects your data, we email you at the account address without undue delay and within 72 hours of confirming it, saying what was affected and what to do. Where the law requires it, we notify the Information Commissioner's Office within 72 hours of becoming aware. Message content is never stored, so a breach cannot expose an archive of your mail. It could expose encrypted credentials, which you can revoke at your provider without us.