Security belongs below the AI.
Everydom is building an AI desk for small businesses. Email is the only working channel today.
These statements describe automated software checks I run. They are not a review of a running public service.
The AI does not decide who can see what.
Database access rules enforce who can reach business data. Sorting has no say in that access.
The design keeps each business's data separate in the database itself. Business separation comes from database rules, not AI sorting.
What automated tests check.
Automated tests check that one business cannot read or change another business's mail, mailboxes, threads, or administrative data through the app. The checks use disposable test databases.
Tests also check that browser-facing access cannot reach internal message delivery records. The software checks signed provider events before recording them, and tests cover key rotation for those provider event signatures.
Tests check signatures on mail handed from the receiving service. That signing secret does not yet support key rotation.
What is not established.
These are automated tests I run. They are not a penetration test or independent audit. They do not prove how a running public service is configured or operated.
Access controls for a running public service and day-to-day security practices have not been independently reviewed.
Connection status.
Email is the only working channel. Website forms and business-software connections are built, in testing. Webhooks, Google Calendar, Gmail and Outlook connections are designed. Google Calendar provider testing remains ahead. None is open for customer use.
Report a security issue.
Please send reports to [email protected]. Do not include private information that is not needed to explain the issue.