Guide
Is it safe to give an AI access to your email?
A vendor answering that question about itself is worth nothing, so this page is 8 questions to put to any vendor, phrased to work on a competitor, with our own answers underneath, in full.
- Reading About 8 minutes
- Questions 8, usable on anyone
- Ours All 8, in full
The short version
The risk lives in the connector, not the AI. Ask who holds the credential, what it can reach, what is stored, and how you revoke it without their help. If any answer is vague, that is the answer.
Framing
The question is about the connector, not the AI
"Is it safe to give an AI access to my email" sounds like one question and is really 2, aimed at 2 different companies.
The assistant sees whatever passes through the conversation. That is between you and whoever makes it, it is governed by their terms on retention and training, and no mail connector can answer it for you.
The connector holds a credential to your mailbox and can use it. That is the part with the interesting failure modes, it is almost never the company whose name is on the assistant, and it is the one nobody asks about.
Nearly all the useful scrutiny belongs to the second. An assistant with no connector cannot touch your mail at all; a connector with a bad answer to question 4 can touch it whether or not an assistant is involved.
The checklist
8 questions to ask any vendor
Written so you can send them to somebody else. A vendor who answers all 8 plainly is one you can assess; a vendor who answers in adjectives has told you something too.
- What credential do you hold, and can I revoke it without asking you? The second half is the important half. Access you can only end by emailing support is access you do not control.
- What exactly can that credential reach? "My mailbox" is not an answer. Can it reach the calendar, the contacts, the files, other people's mailboxes in the same organisation?
- Do you store my messages, and where? Ask for the storage rather than the intention. "We do not read your mail" and "we keep a copy of your mail" are both true of a great many products at once.
- Does reading a message change it? A tool that marks everything read while surveying is a tool that has destroyed your unread count, which is a signal you were using.
- What can it do without me asking? Rules, schedules, background jobs and auto-replies are all things that act while you are asleep. Some products want them. You should know which.
- Who is the legal entity, and where? A trading name with no company behind it is a company you cannot pursue.
- What have you NOT done? Nobody volunteers this. A vendor who names a gap is a vendor doing an inventory; one who claims none is one who has not looked.
- What happens to my access if you disappear? If the answer involves your mail being somewhere other than your mailbox, that is worth knowing before rather than after.
The one that separates them
Question 7. Everything else can be answered well by a careful marketing page. A specific, uncomfortable, checkable gap cannot be, and a vendor willing to publish one is telling you the other 7 answers were written by somebody who meant them.
Our answers
Our own answers, including the bad ones
The same 8 questions, put to ourselves. Answer 7 is the one worth checking rather than taking on trust.
-
1. Which credential, and can you revoke it?
An app password (Gmail), an OAuth grant (Microsoft 365) or an IMAP password. All 3 are revoked from your own account without our involvement.
A connected calendar adds one of the same kinds: the Microsoft grant already covers it, a Google calendar is a Google grant of its own, and a CalDAV calendar is a password for that server.
A connected CardDAV address book is a password for its server in the same way, revoked there. Google contacts are a Google grant of their own, revoked in your Google account or from the control panel. Outlook contacts on a Microsoft 365 mailbox ride the same grant as the mail, and are revoked with it.
-
2. What can it reach?
One mailbox, one calendar if you connect one, and one address book where the mailbox has one: your Google contacts or a CardDAV book, either connected as a separate step, or the Outlook contacts a Microsoft 365 sign-in brings with it.
A contact is looked up in your own address book when you ask, and never copied here. No file store: it reads the files on your mail, and nothing on a drive.
An Exchange shared or delegated mailbox, the kind with no sign-in of its own, can't be connected, so your account doesn't expose the team's.
What a connection may do with the mailbox is capped twice over: by the permission level you approved it at, and by a limit you set on the mailbox itself that no connection can exceed.
-
3. Do you store messages?
No. A message is fetched from your provider when your assistant asks for it, returned, and not kept: no copy, no cache and no index.
What we do hold is your credentials, encrypted at rest with AES-256-GCM, and a record of each call that never includes a message. The full list, with how long each is kept, is on the security page.
-
4. Does reading change anything?
No. Message source is fetched with IMAP's BODY.PEEK, which doesn't set the Seen flag. Marking read is a separate tool.
-
5. What acts without you?
Nothing of ours. The server runs no rules and no background jobs, and schedules nothing itself. Nothing reacts to new mail arriving.
Every action follows a tool call from an assistant: in a conversation, or in a routine your own Claude or ChatGPT runs on the schedule you gave it. A routine reads, saves drafts or flags, and never sends.
Where you've shared a mailbox through Team Access, the activity log says which person.
-
6. Who is the entity?
BSolve IT Limited, company 04607330, registered in England and Wales. The registered address is on the terms.
-
7. What have you not done?
Exchange shared and delegated mailboxes (the kind with no sign-in of their own), a copy of your contacts (a connected address book is looked up, never synced), a file store, backup and export, a message held on our server to send later, and any scanning of attachments for malware.
Each is a deliberate boundary, and each is written on the page it belongs to rather than left to be found later.
-
8. If you disappear?
Your mail is in your mailbox, and there's no copy anywhere else. Nothing about your mail changes.
Where the boundaries are written down
Answer 7 is the one worth checking rather than taking on trust, so it's worth saying where to check it. Every page on this site ends with a section headed "what it does not do", and the entries are specific enough to test.
Exchange shared and delegated mailboxes can't be connected. Attachments are capped at 20 MB per message in total, across every file rather than per file. And nothing archives, backs up or exports a mailbox.
A vendor whose limits section says "some restrictions apply" hasn't answered the question.
The advice above is to start on a mailbox you would mind least. The free tier lets you do exactly that, with no card.
Realistic
What you are actually exposing
Worth being concrete, because "access to your email" covers everything from a signature block to a decade of legal correspondence and people picture the wrong end of that.
To the connector
The ability to act on one mailbox: read, search, send, reply, forward, move, delete to Trash, flag. That is genuinely a lot, and it is the same access your desktop mail client has had for years with the same kind of credential. It is also the most a connection can have: one you approved at read only, or on a mailbox whose limit you have lowered, gets less.
To the assistant
Only what passes through the conversation. If you ask it to read 4 messages, 4 messages are in the conversation. A routine you set up is a conversation your AI holds on a schedule, and the same is true of it.
Nothing is indexing your mailbox in the background.
To anyone who gets the credential
This is the real risk and it is the one worth thinking about, because it is the same risk as any other stored credential anywhere. It is why question one matters most, and why "revocable by you, without us" is the property to insist on rather than any promise about intentions.
Practice
How to reduce the exposure
5 things that cost nothing and are worth doing whichever product you choose.
- Start on a mailbox that is not your main one. An old domain, a side project, an enquiries address. You learn the same lessons with a fraction of the exposure.
- Use an app password rather than your account password wherever the provider offers one. It is revocable on its own and it does not unlock anything else.
- Prefer OAuth where it exists. On Microsoft 365 no password reaches us at all, and you can see and withdraw the grant from your own account page at any time.
- Read the consent screen properly. It is the one moment the true permission list is put in front of you. Ours asks for 6 Microsoft permissions, each listed with what it is for; if a consent screen asks for more than the product needs, that is the moment to stop.
- Revoke when you stop using it. Dormant access is the access nobody remembers to review.
Connect an old domain or a side-project address first, and revoke it from your own account whenever you like.
Limits
What this guide cannot tell you
-
Your assistant's terms
Whether your assistant provider trains on your conversations. That is in their terms, not ours, and it changes.
-
A vendor's answer
Whether any other vendor's answers are true. The questions are checkable; the answers are theirs to give and yours to weigh.
-
Your employer's rules
Whether your employer permits any of this. On a work mailbox that is a question for your IT department first, and an administrator can block it regardless.
-
Past the security page
Anything about our own security beyond what is on the security page, which is deliberately specific about what has not been done.
Is it safe to give an AI access to my email?
It depends almost entirely on the connector rather than on the AI. The assistant is one party and the thing holding your mailbox credential is another, and they are usually different companies with different answers. Ask the 8 questions on this page of whoever holds the credential, and judge from the answers rather than from the assurance.
Can the AI company read my messages?
They see the messages you ask it to read, in the conversation, the same way they see anything else you put in front of it. What they do with that is governed by your agreement with them, not with us. It is a real consideration and it is not one any mail connector can answer for you: read your assistant provider's own terms on training and retention.
What happens if I change my mind?
You revoke it from your own account and it stops working immediately, without needing our cooperation. An app password is revoked in your Google Account, an OAuth grant in your Microsoft account, and an IMAP password by changing it. That is the property worth insisting on: access you can end without asking anyone.
Is a local MCP server safer than a remote one for mail?
Less than it appears. A local mail server keeps the credential on your own disk, but your messages still travel to Gmail or Microsoft over the same connection either way. What changes is who holds the key, not whether the mail moves.
Could it send email as me without my asking?
Not on its own. A tool call happens when your AI client makes one: in a conversation, or in a routine your own Claude or ChatGPT runs on a schedule you set. A routine reads, saves drafts or flags, and never sends. The server itself has no rule, no scheduler and no background process, and nothing reacts to new mail arriving.
What happens to my mail if you go out of business?
Nothing. Your mail is in your mailbox with your provider, where it has always been, and there is no copy of it anywhere else. Stopping using this changes nothing about your mail, which is the practical benefit of a connector that does not keep anything.
Is it safe to connect Claude or ChatGPT to my Gmail or Outlook?
The same 8 questions apply to either assistant, because the risk sits with whatever holds the mailbox credential. With Claude's or ChatGPT's own connectors, the vendor holds it. With a connector like this one, we do: an app password or Microsoft sign-in you can revoke yourself, nothing of your mail kept, and a permission level the server enforces. Prompt injection, a message carrying instructions aimed at the assistant, is a risk on every route; the security page covers it.
Attribution
Sources
- MCP specification: Authorization What an MCP server must do with an access token, including that it must not accept or transit tokens issued for anywhere else.
- Google: sign in with app passwords How an app password is created and revoked from your own Google Account.
- Microsoft: Deprecation of Basic authentication in Exchange Online Why Microsoft 365 uses OAuth rather than a password, and what that changes about revocation.
- Our security page Every claim in the answers table, in full, including the section on what is not finished.
Keep going
Read next
Start on a mailbox that does not matter.
That is the advice above and it is also the free tier: 5 calls a day, no card, on whichever mailbox you would mind least.