Security & data

What happens to your email in JAAR

Our own servers in the European Union, and we never sell data. This page explains what leaves our servers and where it goes.

Google OAuth verification passed Google CASA assessment completed Data hosted in the EU

Last updated: October 22, 2026

Our own infrastructure in the EU

Your data is stored on our own servers located in the European Union. We don't use multi-tenant public cloud.

Encrypted channel

All traffic travels over TLS 1.2 or higher. The credentials used to access your mailbox are encrypted with AES-256-GCM.

Verified by Google

Verified OAuth app in production, with a completed CASA security assessment.

We never train on your email

Your content is not used to train artificial intelligence models, neither ours nor third parties'.

What leaves our servers, and where it goes

To classify your email, a language model needs to read it. That means the subject and body of the message are transmitted to our artificial intelligence providers. We'd rather tell you here, on the security page, than in the fine print of the terms.

Attachments are the exception, and it matters:

Your provider (Gmail / Outlook)→JAAR server, pass-through only→Your browserAttachments are never sent to the AI or stored by JAAR. When you open one, our server fetches it from your provider and hands it to you immediately, without storing it. That way your browser never receives the credentials to your mailbox.
AnthropicEmail classification and drafting using a language modelUS
TypeSafe AI (via OpenRouter)Email classification using a language model, supporting the one aboveUSA
Your email providerAccess to the mailbox you authorize (Gmail, Outlook, iCloud, or IMAP)Global
Recording and transcription providerMeetings, only if you turn on the optional featureUS
Transactional email providerService notifications: password recovery, alertsUS
StripePayments. We don't store your card detailsUS · Ireland
Network and CDN providerTraffic routing and encrypted access tunnelGlobal

If your organization can't accept transfers outside the European Union, JAAR's standard configuration isn't right for you. Write to us and we'll talk about alternatives: a dedicated instance or metadata-only classification.

The Data Processing Agreement includes the complete list of sub-processors, by name, and the transfer safeguard for each one (European Commission Standard Contractual Clauses or adequacy frameworks, depending on the provider). We provide it to customers evaluating JAAR.

Verifications and status

What's done, what's in progress, and what we don't have yet. The list is complete on purpose.

Frequently asked questions

Do you read my emails?

Not in the human sense. They're processed by an automated system to classify them. JAAR staff don't access the content of your messages during normal operation of the service.

Do you train models on my email?

No. Your content is used only to generate the classification you see, and not to train or fine-tune any model, neither ours nor our providers'.

Where is my data physically located?

On our own servers located in the European Union. We don't use public cloud shared with other customers.

What happens if I stop using JAAR?

When you disconnect an email account, we revoke and delete its access tokens immediately. You can also request complete deletion of your data at any time.

Can you sign a Data Processing Agreement (DPA)?

Yes. Write to us at [email protected] and we'll send you our DPA template, which covers the declared sub-processors and the international transfer safeguards.

Who has access to the servers?

A small team, bound by a confidentiality obligation, that doesn't access the content of emails during normal operation.

What do you do if there's a security breach?

We notify you without undue delay and no later than 72 hours after becoming aware of it, with the information required by Article 33 of the GDPR.

My company has stricter requirements. Are there options?

Yes. We offer a dedicated instance (no shared infrastructure) and a metadata-only classification mode, without transmitting the message body to third parties. Write to us and we'll look into it.

Documentation

Privacy policyHow we process your data and what rights you have · publicly available

Evaluating JAAR for your organization?

We provide our Security Overview and our Data Processing Agreement (DPA, Art. 28 GDPR) to security, compliance, or legal teams that need them. Write to us at [email protected] and we'll send them to you.

Security contact

Found a vulnerability? Write to us at [email protected]. We respond within 48 business hours and will not take legal action against anyone researching in good faith.

Exercising your rights and data protection: [email protected]