What IT cares about
- Data security: OAuth tokens encrypted at rest (AES-256-GCM); the app refuses to boot without its encryption key. Email content is treated as untrusted data with prompt-injection boundaries, so a crafted message can never hijack the AI.
- Minimal permissions: read & organize, plus send only on explicit user action. No password is ever seen.
- Per-user isolation: one user's mail is never mixed with another's; disconnect deletes stored access immediately.
- Provider as source of truth: Gmail keeps working if Inbox Hero is unavailable — no lock-in, no single point of failure for mail delivery.
- Verification & assessment: Google OAuth verification is underway, including an ADA-CASA (OWASP ASVS Level 1) security assessment for the restricted Gmail scope.
The ROI
Knowledge workers lose several hours a week to email triage. Even conservative time savings across a team pay for a $10/mailbox tool many times over — while reducing phishing risk through automatic quarantine.
Frequently asked questions
Is Inbox Hero secure enough for enterprise use?
It encrypts access tokens at rest (AES-256-GCM), uses minimal Gmail scopes, isolates each user, treats email as untrusted data to prevent prompt-injection, and is completing Google OAuth verification including an ADA-CASA (OWASP ASVS L1) assessment.
What data does Inbox Hero access?
The minimum needed to triage and act on mail — headers and snippets for sorting, and full message content only when a user explicitly asks the assistant about a message. Full bodies are never sent to the model for routine triage.
What is the ROI of deploying it?
Time saved on email triage typically exceeds the $10/mailbox cost many times over, plus reduced phishing risk from automatic fraud quarantine.
Take back your inbox today
Connect Gmail or any mailbox in one click. Inbox Hero files the noise, drafts your replies, and quarantines phishing. It is free for 30 days ($0 today).
Get started free