> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useboom.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Email data & security

> For security and compliance reviewers: where Boom receives and stores email, how long raw email is kept, how erasure works, which providers handle it, and what the AI sees.

This page covers email that Boom **receives**: customers' replies to emails
you sent from Boom, and copies of your support address's email. For Boom's
security program in general, see our [subprocessors list](https://www.useboom.ai/subprocessors)
and privacy policy.

## Where email goes

```
Your customer ──▶ your Boom address (or a private reply address)
                    │
                    ▼
        Amazon SES, us-east-1  ── spam and virus scan, TLS required
          ├─ raw email ──▶ Amazon S3 (kept 30 days, then deleted)
          └─ signed notification ──▶ Boom ──▶ your inbox in Boom
Your team (or an approved AI draft) ──▶ Resend ──▶ your customer
```

* **Region:** Boom receives, processes and stores email in the AWS
  `us-east-1` region (United States).
* **Receiving:** Amazon SES in `us-east-1`. SES
  scans every email for spam and viruses and requires TLS.
* **Raw storage:** SES writes the raw email to an Amazon S3 bucket, where it
  expires after **30 days**.
* **Notification:** SES tells Boom about each email with a signed message.
  Boom checks the signature and that it comes from Boom's own topic, and
  rejects anything else.
* **Processing:** Boom reads the raw email, keeps only what the sender newly
  wrote as the message text, and stores the message, its attachments and its
  HTML in your workspace. The full HTML is cleaned on every read (no scripts,
  forms or remote content unless a person asks to load images).
* **Sending:** replies from your team and approved AI drafts go out through
  Resend, from your verified domain.
* **Queueing:** the queue between receiving and processing holds the email's
  delivery details and spam verdicts, never the sender's address or the
  subject.

## How long it's kept

| What | Where | How long |
| - | - | - |
| Raw email as received | Amazon S3 (`us-east-1`) | 30 days, then removed automatically |
| The message, attachments and HTML in your inbox | Boom's database and file storage | Kept while your workspace is active, and deleted within 30 days of an erasure request |

## Erasure

Send erasure requests to [privacy@useboom.ai](mailto:privacy@useboom.ai).
Boom completes them within 30 days:

1. Boom removes every email message from that person, the ones they wrote
   into other people's threads, their attachments, and the thread index, in
   one step. From that moment nothing in Boom can open those files: every
   read goes through a record that no longer exists.
2. The stored files themselves are put on a **deletion queue**. The app's own
   storage key has no permission to delete files, by design (least
   privilege), so a Boom administrator deletes the queued files with separate
   credentials. Boom is alerted if a queued file waits more than 7 days.
3. Raw copies in the receiving bucket are deleted, or expire with the 30-day
   rule.

A download link created before the erasure keeps working until it expires,
because the file still exists until the queued deletion runs: an hour for
links opened from the inbox, and up to 24 hours for links made by journey
automations.

## Who handles email

From our [subprocessors list](https://www.useboom.ai/subprocessors), these
providers handle received email:

| Provider | Role for email |
| - | - |
| Amazon Web Services | Receives email (SES) and stores raw copies and files (S3), in the United States |
| Plus Five Five, Inc. (Resend) | Sends your replies and approved drafts |
| Neon | Database where messages are stored |
| Vercel | Runs the Boom app |
| Upstash | Queues each received email for processing and runs the AI draft workflow |
| Inngest | Wakes journeys waiting for a reply; the wake-up carries no message text |
| Ably | Delivers live inbox updates to your team's browser |
| The AI providers on the list | Write AI drafts, only if AI drafts are on for your workspace |
| Better Stack | Operational logs; logs about dropped email name the sender's domain, never the address |

## What the AI sees

Boom does not use your email to train AI models. AI drafts are written by the
AI providers on our [subprocessors list](https://www.useboom.ai/subprocessors).

AI drafts are off unless Boom turns them on for your workspace. With them on,
for each email the agent sees:

* only the text the sender **newly wrote**, not the quoted history below it.
  Thread history comes from Boom's own record of the conversation, so nobody
  can edit a "quoted" message to put words in the agent's mouth;
* the text of PDF attachments;
* whether the sender is verified (below);
* whether its earlier drafts were sent, edited or discarded;
* if your workspace has one conversation per email thread, and only when the
  sender is verified as the conversation's own customer: the subject, status
  and last few messages (word for word, shortened) of that same customer's
  other email threads, so it can tell when the customer refers to one. Those
  messages are only emails proven to come from the customer (verified as
  them, as in the table below) and the replies your workspace actually sent.
  Never internal notes, drafts, unsent or failed emails, emails from anyone
  else on the thread, or emails held back as unverified or spam.

Hidden text and invisible characters are removed before the agent reads an
email. Images are not sent to the AI.

**The AI never sends email.** It writes a draft that a person on your team
approves, edits or discards. Approved replies carry a short line saying they
were drafted with AI assistance, which can't be removed. Apart from reading
the same customer's other email threads as above, the agent can't use tools
that reach other people or other conversations, and its drafts are capped per
thread and per workspace each day.

## Unverified senders

Anyone can put any address in an email's From line. Boom judges each email
only on the checks its own receiving server ran (SPF, DKIM, DMARC, and ARC
from a short list of trusted forwarders), never on headers the sender wrote:

| Sender | What happens |
| - | - |
| Verified, and the conversation's own customer | Normal: the agent may draft a reply, use the customer's account data and read their other email threads |
| Verified, but not the conversation's own customer (for example, relayed by a forwarding service) | The agent may draft, but can't read or share account data |
| Not verified, or not part of the thread | Shown in the inbox as **Unverified sender**. No AI draft, and it doesn't move any journey forward |

Spam is dropped unless the sender's domain passes DMARC; then it's shown
labelled **Marked as spam** and automation ignores it. Viruses are dropped.
Archives, programs, HTML and SVG attachments are never stored.

## Signed reply addresses

Every email Boom sends carries a private reply address for its thread. Each
one includes a signature that ties it to your workspace's thread, so:

* a reply lands in the right conversation in the right workspace;
* an address altered or re-signed for another workspace is ignored, and a bad
  signature is dropped.

The daily check on your support address is signed the same way and expires
after 48 hours, so it can't be faked or replayed. A copy rule only counts as
working when that signed check comes back through it.

## Who can do what

* Only organization admins can turn on receiving, set the support address,
  open Gmail's confirmation link, send a test email and email the IT
  instructions. Anyone who can view settings can copy the instructions.
* Emailed IT instructions are built by Boom from your workspace's own setup;
  the person sending them picks only the provider and the recipient, not the
  text. Replies to that email go to the person who sent it.
* Only people with permission to reply in the inbox can approve, edit or
  discard an AI draft; everyone else sees it read-only.
* Boom never gets access to your mailbox. It only receives the copies your
  own rule sends.

## Related

> [card] [Email in Boom](https://docs.useboom.ai/email-replies.md)
>
> Replies, support address and your domain, step by step.

> [card] [Email setup for your IT team](https://docs.useboom.ai/email-for-it.md)
>
> What to add and how to undo it.

> [card] [Email troubleshooting](https://docs.useboom.ai/email-troubleshooting.md)
>
> Common problems and fixes.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.