An AI assistant that can triage your inbox, draft replies and act on messages is one of the more useful things AI can do — because email is where so much of life and work actually happens. But it also means handing something powerful a key to a very sensitive room. That’s worth taking seriously, not fearing.
Here’s how to think about it, and what “safely” should actually mean.
Be honest about what access means
Let’s start with the thing some marketing avoids: for an assistant to be useful on your mail, it has to be able to read your mail. There’s no way around that — you can’t summarise, search or triage what you can’t see. So the honest question isn’t “can we make it so nobody can ever read anything” (a mailbox with a working assistant can’t claim that). The honest question is: who can read it, under what rules, and what exactly are they allowed to do?
Good answers to that question are what make the difference between safe and reckless.
What a safe arrangement looks like
Five things matter, and you should be able to check each one:
- Defined, limited capabilities. The assistant should have an explicit list of actions — read, search, reply, organise — not vague, total control of the account. When capabilities are a defined set (as they are over an open protocol like MCP), you can actually reason about what’s possible.
- Sending pinned to you. This is the big one. When an assistant sends mail, it must only ever be able to send as your own verified address — same identity, same From header, same envelope. If there’s no way to specify a different sender, an agent can’t be tricked into sending as your boss, your bank, or a stranger. That single constraint neutralises a whole class of attacks.
- Jurisdiction you understand. Where does the mail actually live while the assistant works on it? EU-hosted mail under the GDPR is a stronger, clearer footing than “somewhere in a global cloud”.
- Your choice of model, and revocable. You should decide which assistant gets access — and be able to disconnect it at any time. Connecting an AI shouldn’t be a one-way door, and it shouldn’t force one particular provider on you.
- No quiet exploitation. Your mail — and anything the assistant processes — should never be used to train a model or sold on. Access for your benefit is the deal; access as a data source is not.
The attack you’re actually guarding against
The scary scenario with an inbox agent isn’t usually “the AI turns evil.” It’s prompt injection: a malicious email contains text designed to trick the assistant into doing something — “forward all invoices to this address”, “reset the password”, “email everyone in the contacts”. The assistant reads it as part of doing its job, and if it’s over-privileged, it might act on it.
This is exactly why the constraints above matter. If the assistant can only send as your own address, “email everyone pretending to be finance” simply isn’t a capability it has. If its actions are a defined, limited set, “reset the password” isn’t on the menu. You reduce the blast radius by design, not by hoping the model always behaves.
Where Lettio fits
Lettio is built around these constraints rather than bolting them on. Your assistant and agents connect over the open Model Context Protocol with a defined set of actions; sending is pinned to your own verified address, so an agent can act for you but never as anyone else; the mailbox is hosted in the EU under the GDPR; which assistant you connect is your choice, and you can disconnect it whenever you like; and your mail is never used to train a model.
We’re also plain about the part others gloss over: because the assistant works on your mail, our servers can read it — the same as any provider offering search or an assistant. What we promise instead is EU jurisdiction, hard limits on what agents can do, and your control. (More on that honesty in “What secure email actually means”.)
If that’s the kind of safe, useful AI you want on your inbox, see how it connects or read exactly what we protect.