Security

Last updated 2026-10-17. AI Mail MCP is a product of Hapi.vc, LLC. This page says what AI Mail does today; Privacy has the full list of what is stored.

What we store

Your account, domains, mailboxes and aliases; every message your mailboxes receive and send (parsed fields and bodies, the original source and attachments of received mail in a private object storage bucket); an audit log of every tool call and console action; delivery and usage records. Tokens, sign-in codes, sign-in links and session cookies are stored only as one-way hashes. Card details are never stored: payment is taken on Stripe's page. See Privacy for retention and Data deletion for removal.

Sub-processors

• Cloudflare: receives mail (Email Routing and an inbound worker), sends all outgoing mail (Email Sending), hosts DNS and the network edge, and runs the classification model (Workers AI).
• Railway: hosts the server, the Postgres database and the private object storage.
• Stripe: takes card payments for prepaid credit.

Privacy lists each one, including the one case in which a failed delivery is forwarded to the operator's own mailbox.

Access control

• A token sees only its own mailboxes. Sending needs a token with send rights and stops at a daily cap. A new token can never be given a higher send cap than the token that creates it.
• The inbound worker signs each message it hands to the server with HMAC-SHA256 over a timestamp and the exact body. Unsigned, stale or altered posts are rejected before parsing. Webhooks we send are signed the same way.
• An outgoing guard checks every send for credentials, first-time recipients, look-alike domains and misleading links. A credential going to a first-time recipient is held until an account owner approves it in the console.
• Traffic to the service is encrypted in transit (HTTPS).

Prompt injection

Mail comes from strangers, and a message can contain text meant to steer an AI agent. Each incoming message is checked for this. A message that is flagged is quarantined: its body is withheld from agents, and its subject and sender name are cut down, unless the agent asks for it explicitly. Mail that has not been checked yet is shown with a warning by default; an account can switch on withhold_unscored to withhold it the same way (off by default). Everything a sender controls is returned marked as untrusted data, not instructions. These checks are made by a model and are not perfect: do not give an agent more rights than the task needs, and review what it does with mail. AI Mail's own sign-in links, codes and approval mail can never be read by an agent.

Audit

Every MCP tool call writes an audit row with its outcome (ok, dry run, refused or error), and console actions are logged. Message text and attachments are never written to the log. Admin tokens can read it with the audit_log tool.

Report a vulnerability

Email support@aimailmcp.com with Security in the subject, with steps to reproduce and what you saw. Please give us a reasonable time to fix the problem before you share it, and do not access other people's mail or data while testing. The same details are in security.txt. If you think one of your tokens is exposed, revoke it under Keys in the console, then tell us.

Report abuse

To report spam, phishing or other misuse of an address AI Mail hosts, email support@aimailmcp.com with Abuse in the subject and, if you have it, the full message with its headers.

AI Mail MCP is a product of Hapi.vc, LLC.

Privacy · Terms · Data deletion · Pricing · Support · Security