Security model: delegated permissions instead of a shared service account.
AI access to Microsoft Exchange mailboxes without bending your permission model: every user only with their own permissions, mailbox content passed through without storage by default, hosted in Germany - with a DPA from day one.
Six principles that make the difference
The same commitments are binding in the data processing agreement (Annexes 1 and 2) - this is the plain-language version.
Delegated permissions, no shared account
Every employee accesses their mailbox with their own existing Exchange permissions. There is no central service account with access to all mailboxes and no application impersonation - the classic “master key” simply does not exist in Postgate AI.
Caching: off by default
By default we do not store mailbox content. It only passes through. What we keep are encrypted credentials and technical metadata (who, when, which function). If you want to, you can switch on an encrypted short-term cache per organization: converted mail text and text from attachments, 7 days by default and at most 32 MB per mailbox. You can switch it off again in the portal at any time, and mail above a confidentiality level you set stays out of it.
Encrypted credential vault
Exchange credentials are stored RSA-4096-encrypted in a vault in Germany. Cross-user isolation: nobody sees anyone else’s mailbox.
Tenant separation
Each organization runs a dedicated, hardened instance with its own configuration and data set - no shared environment with other customers.
Data location: Germany
Processing takes place exclusively in a German data centre (ISO 27001 certified operator). With a local AI model, even the entire processing can stay on your premises.
Limits your own administrator sets
In the portal, your organisation’s administrator decides what is allowed: per area (email, calendar, contacts, tasks, folders, rules) and per kind of access (read, write, send, delete), for the whole organisation, for individual groups or for a single user. Anything that has not been cleared, the server turns down. On top of that comes a quota for how many recipients one user may write to per hour (100 by default), and an emergency stop that blocks every further request, at once and without a restart. Security-relevant events are audited without content.
What happens to a request?
Your AI assistant sends a request to Postgate AI. Our server in Germany (with the self-hosted license, your own server) fetches the requested data from your Exchange with the permissions of the respective user and passes it through to the assistant you have chosen - like a transparent proxy, with TLS encryption on every route. After that, the process is over for us. By default no copy and no content log remain. Only if you switch the cache on do we keep mail text encrypted for the retention period you set. Your mailboxes remain in your Exchange at all times; you decide which AI model processes the content - up to a fully locally hosted model.
OWASP Top 10 for LLM Applications 2025, answered point by point
Every point on the list gets its own card, including the ones we only cover halfway. Where something is missing, it says so. A mechanism with no evidence in the code does not count as a mechanism for us.
Measured against the 2025 edition of the list. If a new edition appears, this assessment stands until we redo it. The separate OWASP list on threats to agentic systems is not the subject here.
LLM01:2025 Prompt Injection
Read functions label their result as foreign content, with an explicit note that it is material and not an instruction. A pattern scan classifies the content and counts hits.
The scan labels and counts, it removes nothing. In the instance we host, the confirmation on a second call is also missing as the last brake before sending.
LLM02:2025 Sensitive Information Disclosure
Exchange credentials are only ever stored encrypted and are resolved per identity, each with its own data key. Logs redact sensitive fields, mask addresses and carry the identity as a pseudonym. A mailbox mirror or a vector store only comes into being if the operator switches it on.
Mailbox content goes to the connected AI client as intended, and whatever happens to it there is outside this server.
LLM03:2025 Supply Chain
The base image is pinned to a fixed checksum instead of a movable name. The libraries arrive with version and checksum from a lock file, and a guard notices when someone changes the requirements without a new lock file.
There is no bill of materials for the components, and no automated comparison against vulnerability feeds either.
LLM04:2025 Data and Model Poisoning
We train no model and put no customer data into any training. Stored data comes exclusively from the mailbox of the respective identity and is kept separate per identity.
A deliberately prepared mail sits in that same mailbox and can colour a later search. There is no provenance rating for individual entries.
LLM05:2025 Improper Output Handling
HTML that goes back into a mail runs through an allow list of tags, attributes and address schemes. Database access runs through parameters.
In the default read format, the functions pass the original HTML of the mail through unchanged. What gets cleaned is the way back into a mail, not the way out. Whether the connected client treats an answer as text or renders it as HTML is not for this server to decide.
LLM06:2025 Excessive Agency
Access only with a verified identity and that identity’s own Exchange permissions, without one the server turns the request down. No shared account, no impersonation. Emergency stop and send quota halt sending without restarting the service.
The permission matrix per organisation, group and user only takes effect once the administrator arms it. The confirmation on a second call before sending and deleting runs in the self-hosted installation, in the instance we host it is off.
LLM07:2025 System Prompt Leakage
The server’s system text carries no secret, and permissions do not hang on it but on the Exchange permissions of the identity.
The text can be overwritten by the operator, and whatever stands there is visible to every connected client.
LLM08:2025 Vector and Embedding Weaknesses
Every access to the vector store requires an identity and runs against a table with row level security enforced, keyed by a pseudonym. Subject, mail body and text from attachments never go in there.
The vectors themselves are not encrypted, so whoever gets around the database role gets around the rule as well. What flows into the index is not checked for smuggled instructions.
LLM09:2025 Misinformation
The functions deliver mailbox data from the source, Exchange stays authoritative. Foreign content carries a provenance marker. A system card states provider, model and destination openly.
The server checks no model output. Whether a summary is correct is something it does not measure, and there is no requirement to cite evidence per statement.
LLM10:2025 Unbounded Consumption
The call rate is capped per identity, the work queue is bounded, concurrency against Exchange is limited and sending is capped per identity and hour.
Behind several nodes the limit applies per node, as long as the shared counter does not live in the database. The cost of a connected model is not something this server bounds.
The full sheet names the mechanism, the verdict, the limit and the place in the code for every point. We hand it out on request. Request the sheet
What works against instructions inside a mail
An email can contain text that looks like an order to the model. Three things work against that, and none of them is a filter that catches everything.
Foreign text stays recognisable as foreign text
Every read result carries the note that it is material and not an instruction. The model receives the provenance along with the content, not just the content.
A pattern scan with an honest reach
Today it recognises instruction phrasing in German and English, control tokens from chat templates, hidden text and invisible characters. It labels and counts, no more than that. Hit counter and risk level measure different things: the counter rises on the first strong hit, the level only at a threshold you set.
Recipients that come only from foreign text
If an address appears solely in text that was read in, the egress guard sharpens the question asked before sending. That takes effect where the confirmation before sending runs, which means the self-hosted installation.
The patterns do not only stand against cases we thought up ourselves. We ran them against a public attack list from a third party, garak by NVIDIA with the probe for indirect injection from document and mail content. Every case is its own test. The gaps we measured are held as deliberately failing tests, so that closing one later shows up instead of quietly evaporating. Ordinary mail raises no false alarm, and there are separate test anchors for that. We name the tool, because an unnamed list is not evidence but a claim.
Frequently asked questions
Is it GDPR-compliant?
Yes. Processing takes place in Germany, and a data processing agreement (DPA) pursuant to Art. 28 GDPR is concluded directly during registration - including documented technical and organisational measures and a list of subprocessors. Registered users can access the agreement in the portal at any time.
Why is a service account with access to all mailboxes a risk?
An account with organization-wide mailbox access is a single point of attack: if it is compromised, every mailbox is exposed - and every action runs under the same identity, without per-person traceability. Postgate AI does without it entirely.
What data does Postgate AI store permanently?
Encrypted Exchange credentials (RSA-4096, vault in Germany), portal accounts (name, work email, password hash) and technical audit metadata without content. By default, mailbox content is not part of that. It stays in your Exchange. If you switch the cache on, converted mail text and text from attachments are added, encrypted and deleted after 7 days by default.
Does the AI provider see our emails?
That is up to you: you choose the AI assistant and connect it to the service yourself - which model processes content is in your hands. With a locally hosted model (e.g. Ollama), no content leaves your environment. We do not operate an AI of our own.
Security your data protection officer will sign off on.
The DPA with TOMs and subprocessor list is concluded directly during registration - and the trial runs on exactly the model that applies in production.