What happens to my data?

Email is among the most sensitive data an organization holds, and AI raises the stakes. Before compliance teams approve any AI tool, they ask what it stores, for how long, and which audits back it up. Here are the answers.

Questions in this article

Do you store our email?

No, not your normal mail. Messages are read through the API, analyzed in memory and discarded. AegisAI keeps only the metadata needed to run the service (message IDs, counts) and the content of messages flagged as suspicious.

That suspicious content is scanned with Google Cloud Sensitive Data Protection before storage, which redacts names, phone numbers, card and account numbers, passport numbers, credentials and keys. It is encrypted at rest and stored separately for each customer. In quarantine mode, the original copy of a quarantined message is held for at most 48 hours to carry out the quarantine.

How long do you keep data in the console?

Threat history is available in the console for 90 days by default. Enterprise customers can request extended retention.

Can we control the encryption keys?

Yes. AegisAI supports customer-managed encryption keys (CMEK). You hold the key in your own key management service; AegisAI never possesses it. Revoking our access to the key makes all stored data unreadable at once, and every decryption request is logged in your own environment. For organizations that need data to stay in their own cloud, a bring-your-own-cloud deployment is available.

Are you SOC 2 and ISO 27001 certified?

AegisAI is SOC 2 Type II certified. We are working toward ISO 27001 certification. Until then, our security team is glad to walk your reviewers through the compensating controls that map to your ISO requirements.

Can you work with healthcare organizations under HIPAA?

Yes. AegisAI signs Business Associate Agreements with healthcare customers. Combined with data minimization, inference-only processing of benign mail and redaction before storage, PHI exposure is limited by design.

We're a UK/EU organization. Is GDPR a barrier?

No. AegisAI protects organizations headquartered in the UK with large US operations. The same principles that satisfy security reviewers (minimal storage, redaction, encryption and per-customer segregation) support your GDPR obligations. Our team can provide the documentation your data protection officer needs.