Security

We check your email. We never keep it.

Giving a service access to your mailbox is a big decision. This page explains what Optima Mail Guard looks at, what it keeps, and the promises we make about your data, in plain English.

What we keep

Whether each email was kept or moved aside
A confidence level and a category, such as “cold sales”
A short reason for each decision
Daily totals for your dashboard
The rules you choose, and your account and billing details

What we never keep

Email bodies or message text
Subject lines
Attachments
Your contacts or address book
Your Microsoft password

What we look at, and why

To keep your inbox clear we look at each new email as it arrives and, when it's unwanted, move it into the Optima Mail Guard folder in your own mailbox. We don't copy your mailbox history, we don't read your sent mail and we never send email on your behalf.

Microsoft 365 and Outlook.com: you sign in with Microsoft and approve access. We never see your Microsoft password, and you can withdraw access from your Microsoft account at any time.
Google and Gmail: you sign in with Google and approve access. We never see your Google password, and you can withdraw access from your Google account at any time.
Other business email: you give us your email address and password once, and we find your mail server for you. If your provider offers app passwords, we recommend using one so it can be revoked without changing your main password.

How checking works for you

Checking is fully automated. No person at Optima reads your emails.
Each email is looked at once, for a moment, and then let go. The content is never saved.
Personal details are removed before any automated assessment takes place, and your emails are never used to train anyone's systems.
Nothing is marked as read, nothing is deleted, and anything moved can be put back with one click.
If anything ever goes wrong, the email simply stays in your inbox. We always fail safe.

Your mailbox login details are encrypted the moment you enter them and locked away where our website, our support tools and our staff cannot read them. They are only ever unlocked for the few seconds it takes to check your new mail, and they are never written to any log. Disconnecting a mailbox destroys them immediately.

Keeping every customer separate

Every account is kept apart from every other at the deepest level of our systems, not just in the screens you see. Even in the unlikely event of a mistake in our software, one customer's information cannot be shown to another.

Your account

Two-factor authentication with an authenticator app is available on every account, and we recommend turning it on.
Passwords must be strong, and repeated sign-in attempts are automatically slowed down.
Everything is encrypted in transit and at rest.
You can see recent security activity on your account from your dashboard.

Where data is held

We choose UK and EU data regions wherever our providers offer them, and every provider we use is bound by a data processing agreement. More detail is in our privacy policy.

Retention and deletion

Filtered email stays in your own mailbox. You choose whether it's moved to your Trash after 7, 14, 30 or 60 days, or never.
Individual decisions are kept for up to 120 days so you can review and correct them. After that, only daily totals remain.
Deleting your account removes your organisation's data from our systems.

Reporting a security issue

If you believe you've found a vulnerability, please email security@optimawebdesign.co.uk. We'll acknowledge your report promptly and keep you updated. Please don't access other people's data or disrupt the service while testing.