We will not be the reason your security review stalls.

"Something reads our email" is a hard no by default

Any product that touches message content lands on the security team's desk, and rightly so. The default answer is no until the data path, storage, and access model are understood. Most "AI writing" tools fail here because they are vague about where content goes.

VerbaPulse is built the other way around: the smallest possible data footprint, nothing in the delivery path, and an architecture that is easy to verify. This page is the short version; the Security page has the specifics.

A deliberately small footprint

• Only the draft a user is actively composing is analyzed, never existing mailboxes or background mail.
• Content travels over TLS 1.2+ and is analyzed in server memory. Never written to disk; the result for an identical draft stays in memory for up to 4 hours.
• By default no message content is stored. Only event metadata is retained: risk type, severity, action, no text, no user identity.
• Nothing is used to train AI models, by VerbaPulse or by the model provider (Microsoft Azure OpenAI).
• No person-level tracking; analytics are aggregated by department, and groups smaller than three people are folded together.

Nothing in the mail flow, nothing new to host

VerbaPulse is delivered as an Outlook add-in and a Chrome extension, with analysis on our EU-hosted service. There is no inbound connector, no journaling rule, and no server you have to stand up or patch.

• Outlook add-in deploys org-wide from the Microsoft 365 admin center, no per-user installs or tickets.
• Chrome extension covers Gmail and browser text fields.
• If VerbaPulse is unavailable, mail sends normally; it cannot block delivery at the transport layer.
• No new attack surface in your mail pipeline, because it is not in your mail pipeline.

The rest of the questionnaire

• Access: SAML SSO and SCIM provisioning on Enterprise plans and pilots; policy lists, NDA records, and dashboards are admin-managed.
• Residency: application, database, and AI inference all run on Microsoft Azure in the EU (Sweden Central).
• Sub-processors: Microsoft Azure (hosting, backups and Azure OpenAI language analysis, all EU Sweden Central), Cloudflare (DNS, TLS and network protection for all web traffic in transit), Twilio SendGrid (transactional email) and Stripe (billing), documented on the Security page.
• Contracts: a DPA is available, and we will complete your security questionnaire.
• Disclosure: a documented vulnerability disclosure path.

For the full processing description, transport details, and sub-processor table, see the Security page, our privacy stance, and the DPA Imprint Sustainability.

Common questions