Email data & security

​

Where email goes

Your customer ──▶ your Boom address (or a private reply address)
                    │
                    ▼
        Amazon SES, us-east-1  ── spam and virus scan, TLS required
          ├─ raw email ──▶ Amazon S3 (kept 30 days, then deleted)
          └─ signed notification ──▶ Boom ──▶ your inbox in Boom
Your team (or an approved AI draft) ──▶ Resend ──▶ your customer

• Region: Boom receives, processes and stores email in the AWS us-east-1 region (United States).
• Receiving: Amazon SES in us-east-1. SES scans every email for spam and viruses and requires TLS.
• Raw storage: SES writes the raw email to an Amazon S3 bucket, where it expires after 30 days.
• Notification: SES tells Boom about each email with a signed message. Boom checks the signature and that it comes from Boom’s own topic, and rejects anything else.
• Processing: Boom reads the raw email, keeps only what the sender newly wrote as the message text, and stores the message, its attachments and its HTML in your workspace. The full HTML is cleaned on every read (no scripts, forms or remote content unless a person asks to load images).
• Sending: replies from your team and approved AI drafts go out through Resend, from your verified domain.
• Queueing: the queue between receiving and processing holds the email’s delivery details and spam verdicts, never the sender’s address or the subject.

​

How long it’s kept

​

Erasure

1. Boom removes every email message from that person, the ones they wrote into other people’s threads, their attachments, and the thread index, in one step. From that moment nothing in Boom can open those files: every read goes through a record that no longer exists.
2. The stored files themselves are put on a deletion queue. The app’s own storage key has no permission to delete files, by design (least privilege), so a Boom administrator deletes the queued files with separate credentials. Boom is alerted if a queued file waits more than 7 days.
3. Raw copies in the receiving bucket are deleted, or expire with the 30-day rule.

​

Who handles email

​

What the AI sees

• only the text the sender newly wrote, not the quoted history below it. Thread history comes from Boom’s own record of the conversation, so nobody can edit a “quoted” message to put words in the agent’s mouth;
• the text of PDF attachments;
• whether the sender is verified (below);
• whether its earlier drafts were sent, edited or discarded;
• if your workspace has one conversation per email thread, and only when the sender is verified as the conversation’s own customer: the subject, status and last few messages (word for word, shortened) of that same customer’s other email threads, so it can tell when the customer refers to one. Those messages are only emails proven to come from the customer (verified as them, as in the table below) and the replies your workspace actually sent. Never internal notes, drafts, unsent or failed emails, emails from anyone else on the thread, or emails held back as unverified or spam.

​

Unverified senders

​

Signed reply addresses

• a reply lands in the right conversation in the right workspace;
• an address altered or re-signed for another workspace is ignored, and a bad signature is dropped.

​

Who can do what

• Only organization admins can turn on receiving, set the support address, open Gmail’s confirmation link, send a test email and email the IT instructions. Anyone who can view settings can copy the instructions.
• Emailed IT instructions are built by Boom from your workspace’s own setup; the person sending them picks only the provider and the recipient, not the text. Replies to that email go to the person who sent it.
• Only people with permission to reply in the inbox can approve, edit or discard an AI draft; everyone else sees it read-only.
• Boom never gets access to your mailbox. It only receives the copies your own rule sends.

​

Related