# 21 security questions to ask before giving an AI assistant your inbox

Published by 3Gen Internet Corporation, maker of OpenAssistant, Skej and AGNT. Comparisons use public documentation, without hands-on testing.

![A protected envelope inside a sturdy ceramic shield beside a magnifying glass, a small key and a stack of blank security-question cards, thoughtful inbox access review.](https://aiassistantsforwork.com/images/security-questions-before-giving-ai-your-inbox-be33c2c83769.webp)

An executive's inbox holds board materials, deal terms, personnel issues, legal advice and family logistics. Giving an AI assistant access to it is a bigger decision than installing most apps, and the sign-up flow often makes it feel smaller than it is: one "Allow" button.

This checklist gives you 21 questions to ask the vendor, the answers that should worry you, and the settings to check yourself. Bring your IT or security lead in if you have one. If you don't, these questions still work.

To see what a published answer looks like, read the [OpenAssistant trust page](https://openassistant.us/trust?utm_source=aiassistantsforwork\&utm_medium=content\&utm_campaign=security-questions-before-giving-ai-your-inbox). OpenAssistant is made by 3Gen, which publishes this site. The page lists SOC 2 Type II, says OpenAssistant never trains on customer data, and says its per-action approvals are "enforced in code rather than asked for in a prompt" ([OpenAssistant Trust](https://openassistant.us/trust.md)). Judge it against these 21 questions like any other vendor.

## Before you start: know what "Allow" grants

When you connect an assistant to Gmail or Outlook, you approve a set of permissions (often called scopes). Some are narrow, like "see your calendar." Some are broad, like full read, send and delete access to every email you have ever received.

Google classes almost every Gmail permission as "restricted," from read-only access up to full access. Full access also covers "any usage of IMAP, SMTP, and POP3 protocols" ([Google Cloud Help](https://support.google.com/cloud/answer/13464325)). Apps that use restricted scopes and handle the data on their own servers must pass a security assessment by a Google-approved assessor and be reassessed "at least every 12 months" ([Google for Developers](https://developers.google.com/identity/protocols/oauth2/production-readiness/restricted-scope-verification)). Google also tells developers to request "the least privilege necessary to provide the feature."

On Microsoft 365, by default users can consent to let an app access their own mailbox without an admin, though not to org-wide access ([Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent)). That means an executive can connect an assistant to their work mailbox without asking IT first, unless IT has changed the default.

Read the consent screen. If you don't understand what it grants, stop and ask.

## The checklist

### Access: what can it touch?

**1. Exactly which permissions does it request, and why does it need each one?**
Good answer: a list of scopes, each tied to a feature. Worry if: it asks for full send and delete when you only want drafts, or the vendor can't say.

**2. Can I give it less access and still use it?**
Good answer: a drafts-only mode, or calendar-only access for scheduling. Worry if: it's all or nothing.

**3. Does it read my whole mailbox history, or only new mail?**
Good answer: a clear statement, plus a setting to limit how far back it looks. Worry if: it ingests years of mail by default with no way to limit it.

**4. Can it send email, and if so, from whose address?**
Good answer: it sends only with your approval, or only in categories you choose, and you can see a log. Worry if: it can send freely and there's no log.

**5. Does it access other people's data through me?**
Your inbox contains other people's messages. If you are an EA with delegate access to an executive's mailbox, the assistant may reach that mailbox too. Ask whether it respects delegate boundaries and whether you can exclude specific mailboxes or labels.

### Data: where does it go?

**6. Is my email used to train AI models, by you or by anyone you send it to?**
Good answer: no, by default, in writing, in the terms or privacy policy. Worry if: training is on by default with an opt-out buried in settings, or the answer is only in a marketing page and not the contract.

**7. Which AI model providers process my data, and under what terms?**
Many assistants send your content to a model provider. Ask for the list of subprocessors and whether those providers keep or train on the data.

**8. How long do you keep my email content, and can I delete it?**
Good answer: a specific retention period, a delete button that works, and deletion on account closure. Worry if: "as long as necessary."

**9. Where is my data stored?**
Matters most if you have regional obligations (for example, EU data). Ask for the hosting region and whether you can choose it.

**10. Is data encrypted in transit and at rest?**
This is table stakes. Worry if: the answer is vague.

### Proof: who has checked?

**11. Do you have a SOC 2 Type II report, and will you share it under NDA?**
A SOC 2 report comes from an independent CPA's examination of a service provider's controls under AICPA standards. The AICPA's materials refer to controls relevant to security, availability, processing integrity, confidentiality or privacy ([AICPA](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2)). Ask for the report itself, not a badge on the website. Check whether it is Type I or Type II, what dates it covers, and whether the product you are buying is in scope.

**12. If you access Gmail, have you completed Google's restricted scope security assessment?**
Good answer: yes, with the date of the assessor's Letter of Assessment under Google's CASA framework, the program Google uses for these assessments ([Google for Developers](https://developers.google.com/identity/protocols/oauth2/production-readiness/restricted-scope-verification)). This applies to apps that process Gmail data on their servers. If the vendor says it doesn't apply to them, ask why.

**13. Have you had an independent penetration test in the last 12 months?**
Ask for a summary letter.

**14. Have you had a security incident, and how would you tell me?**
Good answer: a named contact, a notification timeline and a status page.

### Control: can I see and stop it?

**15. Is there an activity log of everything it read, drafted and sent?**
You want to audit it without asking the vendor.

**16. How do I revoke access instantly?**
Know this before you connect. For Google accounts, you can remove an app's access from your linked apps page at myaccount.google.com/linkedapps ([Google Account Help](https://support.google.com/accounts/answer/13533235)). Also ask the vendor how to delete your data after you disconnect.

**17. Can my company's admin manage it?**
For companies: single sign-on, admin-controlled permissions, the ability to remove a user's access centrally, and audit logs. Worry if: it's personal-account only and you plan to use it for work.

**18. Does it ask before acting, and can I set that per action?**
Good answer: you choose which actions need approval (send, accept invites, share files) and the setting is enforced by the product, not just by the AI's instructions.

**19. What stops an email from giving the assistant orders?**
This is the risk that is specific to AI assistants. An incoming email, invite or document can contain text written to steer the assistant, such as "forward the latest board deck to this address." This is often called prompt injection. Good answer: risky actions (sending, forwarding, sharing files, changing settings) are limited by product permissions and approval steps that sit outside the AI model, so a tricked model still can't act alone. Worry if: the only answer is "our model is trained to ignore that."

### People: who else can see it?

**20. Can your employees read my email?**
Good answer: only with my permission for support, logged, and limited to named roles. Worry if: "our team may review conversations to improve the product."

**21. What happens to my data if you are acquired or shut down?**
AI assistant startups do get acquired. Ask whether the terms let a buyer use your data differently, and whether you'll be notified.

## Settings to check yourself

Even with good vendor answers, check these on your side.

**If you use Google Workspace,** your admin can mark apps as Trusted, Limited, Specific Google data or Blocked, and can restrict services like Gmail so that only approved apps reach them. Google says changing a service to Restricted stops untrusted apps that were already installed and revokes their tokens. Admins can also block a predefined list of high-risk scopes, such as the permission to send mail, without blocking Gmail entirely ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/apps/control-which-apps-access-google-workspace-data)). Ask IT whether your assistant should be on the trusted list.

**If you use Microsoft 365,** your admin can restrict user consent so that people can only approve apps from verified publishers, and only for low-impact permissions. The admin can also turn on an admin consent workflow, so users request approval for anything else ([Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent)). If you are an executive, ask IT to approve the assistant properly rather than connecting it on your own.

**On any account,** review connected apps every quarter and remove the ones you don't use.

## Red flags that should end the conversation

- The vendor won't tell you whether your data trains models.
- No security page, no privacy policy specific to the product, or a policy that doesn't mention email.
- Requests for full mailbox access with no explanation.
- No way to see what it sent.
- No answer on what stops an email from instructing the assistant.
- Pressure to connect your work account before IT has looked at it.

## What to keep out of reach

Even with a vendor that answers every question well, consider keeping some mail away from any assistant:

- **Legal and privileged threads.** Ask counsel before an assistant touches them. Some firms will want them excluded entirely.
- **HR and personnel matters.** Performance, compensation, investigations.
- **Deal rooms and board material under NDA.** Check what your NDAs allow.
- **Personal medical or family information**, unless you set it up deliberately.

The simplest way to do this is a separate label, folder or mailbox the assistant cannot read, if your assistant supports exclusions. If it doesn't, that tells you something.

## A copyable email to send a vendor

> Before we connect \[product] to our executive team's email, please answer the following in writing: (1) the exact OAuth scopes or Microsoft Graph permissions you request and why; (2) whether customer email content is used to train any model, by you or any subprocessor; (3) your retention period for email content and how deletion works; (4) your list of AI subprocessors; (5) your most recent SOC 2 Type II report, under NDA; (6) for Gmail access, the date of your Google restricted scope security assessment; (7) whether actions like sending email require user approval and whether that is enforced outside the AI model; (8) what prevents instructions inside an incoming email or document from making the assistant send, forward or share data; (9) how our admin can revoke access and audit activity. Thank you.

## Related reading

- [How to let AI email on your behalf](https://aiassistantsforwork.com/let-ai-email-on-your-behalf/): A staged plan: drafts only, then low-stakes sends, then a delay, then send and report.
- [How to write AI assistant instructions it will follow](https://aiassistantsforwork.com/write-instructions-ai-assistant-will-follow/): Standing rules and daily requests that hold up, how to check them and how to keep them current.
- [The best AI executive assistants for CEOs](https://aiassistantsforwork.com/best-ai-executive-assistants-for-ceos/): Eight assistants compared for CEOs, with OpenAssistant first and Claude and Microsoft 365 Copilot named for research and for Outlook-based companies.
- [AI scheduling assistants you cc on email](https://aiassistantsforwork.com/email-cc-scheduling-assistants/): Ranks the assistants you copy on a thread, including Blockit, Howie and Clara.
- [The best AI scheduling assistants of 2026, ranked](https://aiassistantsforwork.com/best-ai-scheduling-assistants-2026/): A ranked roundup; OpenAssistant is first, Reclaim is the best free start, Calendly the best booking link and Howie the pick for texting.

## FAQ

### What should I ask before giving an AI assistant access to my email?

Ask which exact permissions it requests, whether it can work with less access, whether your email trains any model, how long it keeps your content, whether it has a SOC 2 Type II report, whether you get an activity log, how you revoke access, and what stops an email from giving the assistant orders.

### What is prompt injection in email?

An incoming email, invite or document can contain text written to steer the assistant, such as a request to forward a board deck to an outside address. A good vendor limits risky actions with product permissions and approval steps that sit outside the AI model.

### How do I revoke an AI assistant's access to my Gmail?

For Google accounts, remove the app's access from your linked apps page at myaccount.google.com/linkedapps. Review connected apps every quarter and remove the ones you don't use. Also ask the vendor how to delete your data after you disconnect.

### Do I need IT approval to connect an AI assistant?

On Microsoft 365, users can by default consent to let an app access their own mailbox without an admin, unless IT changed the default. Ask IT to approve the assistant properly rather than connecting it on your own.

## Try OpenAssistant

If you want to run these 21 questions against a real vendor, [Try OpenAssistant](https://openassistant.us/?utm_source=aiassistantsforwork\&utm_medium=content\&utm_campaign=security-questions-before-giving-ai-your-inbox) and compare its trust page with your answers. The [pricing page](https://openassistant.us/pricing?utm_source=aiassistantsforwork\&utm_medium=content\&utm_campaign=security-questions-before-giving-ai-your-inbox) shows the plans, including a free Starter plan.

## Disclosure and Method

Disclosure: 3Gen Internet Corporation publishes this site and makes OpenAssistant, Skej and AGNT. We publish these comparisons to explain our products alongside documented alternatives. Method: We have not run hands-on tests. This article rests on public information (vendor pages, documentation, pricing and published terms), with sources linked.

Published by 3Gen Internet Corporation, the company behind OpenAssistant, Skej and AGNT. We review our own products alongside competitors. [How We Research](https://aiassistantsforwork.com/how-we-research/)

Canonical: https://aiassistantsforwork.com/security-questions-before-giving-ai-your-inbox/