Built like it is reading your mail. Because it is.
How Sektra connects to, encrypts, processes and deletes your team's email and messages.
In short
Sign-in per channel
Gmail and Outlook connect through Google or Microsoft, so we never see those passwords. IMAP and WhatsApp credentials are stored encrypted.
Encrypted in transit and at rest
TLS 1.2 or higher in transit. AES-256 at rest for content, attachments, the database and backups.
Never used for training
Data goes to a model to produce a result and is not retained, shared or used to train anything.
Deleted within 30 days
When a workspace is deleted, everything in it, including the memory layer, is permanently deleted within 30 days.
The details
1. Connecting mail
Gmail and Outlook connect over OAuth 2.0. You grant access through Google or Microsoft, we never see or store those passwords, and you can revoke the grant at any time from your Google or Microsoft account. Sektra asks only for the permissions it needs: to read and label mail, and to send the messages your team writes. An IMAP mailbox has no sign-in handoff, so it connects with its email address and password. Sektra checks the login over TLS before saving anything and refuses unencrypted connections. The password is encrypted with AES-256-GCM under a key that lives only on our servers, never logged and never returned.
2. Connecting WhatsApp
WhatsApp numbers connect through your own WhatsApp Business API provider. The provider credentials you give us are encrypted with AES-256-GCM before they are stored, and the key lives only on our servers, never in the database. Inbound webhooks from the provider are verified before anything is processed.
3. Connecting a calendar
A calendar connects separately from mail, through Google or Microsoft sign-in, and asks only for calendar permissions. On Google that is the calendar events scope; on Microsoft the calendar read and write scope, plus mailbox settings for your time zone. The calendar grant never carries mail permissions and the mail grant never carries calendar ones. Sektra reads your main calendar only, the refresh token is encrypted with AES-256-GCM, and disconnecting deletes Sektra’s copy of your events and clears the credentials.
4. Encryption
Everything moves over TLS 1.2 or higher, between your browser and Sektra and between Sektra and Google, Microsoft, your mail server, your WhatsApp provider and our own services. Message content, attachments, the database and backups are encrypted at rest with AES-256.
5. Where data lives
Application servers, message storage and AI processing run in Amazon Web Services in the United States. The memory layer runs on servers we operate inside AWS. Data is not stored on laptops or in third-party tools beyond the providers listed in our privacy policy.
6. AI processing
Your data is sent to a model to produce a result and is not retained by the model service, not shared with the companies that built the models, and never used to train anything. We do not train our own models on customer data either.
7. Access inside your workspace
Access is granted per inbox, so a member sees only the inboxes they have been given. Roles decide who can invite people, manage integrations and handle billing. Only the workspace owner can change the plan or payment details.
8. Access on our side
Production access is limited to a small number of named engineers, over key-based access, and is used only to operate the service or for support you have asked for. We do not read customer data.
9. Application security
Sign-in is handled by Clerk with short-lived session tokens. Every request is checked against the caller’s workspace and role, and assistant runs are rate limited per user. Payment webhooks are verified by signature and timestamp, and card details never touch our servers. Errors are monitored and reviewed.
10. Deletion
Disconnecting an inbox stops syncing and removes it from the workspace. When a workspace is deleted, everything in it, including message content, attachments, derived data and the memory layer, is permanently deleted within 30 days. Backup copies expire on the rotation schedule after that.
11. Compliance
We follow the Google API Services User Data Policy, including the Limited Use requirements, for all Gmail data, and the equivalent Microsoft terms for Outlook data. A data processing agreement and a security review are available with an Enterprise plan.
12. Reporting a vulnerability
If you find a security problem in Sektra, email hello@sektra.ai with enough detail for us to reproduce it. We acknowledge every report within 48 hours and keep you informed.
Questions a reviewer would ask?
Security reviews and data questions are answered by the people who build the system. A DPA and a security review are available with Enterprise.