How Aftercomm handles your communications data

Security reviews stall on this question, so here is the exhaustive answer, split into the two lists that actually matter — the parties that read your mail, and the vendors Aftercomm itself engages.

Your email is read by:

• Microsoft — where the message already lives. Nothing is copied out to be reviewed; Aftercomm’s software reads it in place through the read-only Graph API. Microsoft is not a vendor Aftercomm introduces, it is your own tenant.
• Anthropic — its Claude model makes the review. By default this runs on Aftercomm’s Anthropic account, with Anthropic as its subprocessor (listed below) and the usage on your Aftercomm invoice at Anthropic’s list price, with no markup. If you provide your own Anthropic API key, the review runs under your organisation’s own agreement with Anthropic instead, and Aftercomm is not a party to it.
• Aftercomm’s software — holds the message in memory for the seconds a review takes, then drops it. No person at Aftercomm reads it. Nothing about the body is written down, so there is nothing to retain, back up, breach, or hand over.
• Your own reviewers — only messages the AI flagged, only while content viewing is on, and every view is logged.

That is the entire list. Microsoft already holds the mail, Anthropic never trains on it, and Aftercomm keeps none of it.

Aftercomm’s sub-processors — only Anthropic receives message content, and only for the review:

No other third party touches your data. Website analytics (Google Analytics) runs on Aftercomm’s public marketing pages only, never in the console, so it never sees your data. Product telemetry is scoped to usage counters and error rates; message content is never included, and Aftercomm trains nothing on your mail. Self-hosted Enterprise deployments run the application inside your own infrastructure, which removes Render from this list entirely and lets you point alert delivery at your own relay.

Worth knowing before you route this to IT, because the ask is smaller than most tools in this category and the parts that aren’t needed matter as much as the parts that are.

• A Microsoft 365 Administrator, once, to approve two read-only permissions on the consent screen. About two minutes, and revocable in one click from the same admin center.
• Nothing for the AI. Reviews run on Aftercomm’s Claude account by default, where your email is never used to train AI models, with the usage on your Aftercomm invoice at Anthropic’s list price. If your policy requires AI processing under your own Anthropic contract, you can provide an API key from your organisation’s Anthropic account instead.
• The list of mailboxes to review — chosen from a searchable picker, not typed by hand. Start with a pilot group and expand later.
• Email addresses for alerts — a reviewer, or a distribution list for your compliance, HR, and legal team.
• Optionally, your own policy. A sensible default ships, so this can wait until after you have seen it running.
• Optionally, an Exchange admin to run one PowerShell script, if you want Microsoft to also enforce which mailboxes Aftercomm can reach. Recommended, and covered under provider-level enforcement.

What is not required:

• No MX record changes, mail routing changes, or SMTP journaling.
• No connector, gateway, or anything sitting inline with delivery.
• No software installed on endpoints, servers, or in the browser.
• No firewall or network changes; nothing inbound to your network.
• No mailbox delegation granted to your reviewers.
• No migration, and no copy of your mail archive.

These are different questions, and this page answers both plainly — a vendor that blurs them is not one your security team should trust.

Each message is fetched from your platform’s read-only API (Microsoft Graph today; equivalents on other platforms as they are added), converted to plaintext in memory, sent to Claude for a verdict, and dropped. The body never touches persistent storage on Aftercomm’s side — which also means it is in none of its backups, because a backup can only contain what was written down.

There is no exception. Alert emails carry the verdict — severity, categories, the sending employee, and the AI’s categorical explanation — and never the message body, subject line, or recipient list. A reviewer who needs to read the message opens it in Aftercomm, where it is fetched from your tenant at that moment, displayed, and dropped, with the view recorded.

This is the complete list. If a field is not on it, Aftercomm does not have it.

• Sender address, recipient addresses, subject line, timestamp. For messages your policy clears, the recipients and subject line are erased after 30 days (see below).
• The number of attachments — not their names, sizes, or contents.
• The AI’s verdict: flagged / not flagged, severity, category tags, brief reason.
• Microsoft’s own deep link to the message, so a reviewer with mailbox permission can open it in Outlook. The link is an identifier, not content, and it resolves only for someone Microsoft already authorises.
• Which version of your policy was in force when the verdict was made.
• Timestamp of when Aftercomm notified your reviewers, and how the review was dispositioned.
• A log of every time a reviewer opened a flagged message: who, when, and which one.
• An audit log of every change and sign-in in your workspace: settings, policy, team, mailboxes, the Microsoft connection, billing, exports and reviewer decisions, with who, when and from which IP. Never a secret or message content. Append-only, exportable, and kept for the life of your workspace.

The AI’s reason is a short, categorical description of the concern — not a verbatim quote of the message. The AI is instructed not to quote, and Aftercomm’s code also removes any quoted or copied wording from the reason before it is stored or sent.

Attachment filenames are not retained. A name like Q3-Financials-CONFIDENTIAL.xlsx conveys nearly as much as the body does, so it is treated the same way the body is: read during review as a risk signal, held in memory for that one AI call, and dropped. If a reviewer opens the message, the names are fetched from your tenant at that moment alongside the body. What Aftercomm keeps is a count — enough to show that a message had two attachments, and nothing about what they were. File contents are never downloaded.

Message content has no retention period because it is never retained. What follows applies only to the metadata and verdicts listed above.

Flagged messages are kept for the life of your workspace. They are the compliance record, along with what your reviewers did about each one, and a record that silently deleted itself would be worse than useless to the team relying on it.

Messages your policy clears are cut to a receipt after 30 days. Most of what Aftercomm reviews is ordinary mail that raised no concern, and a running list of who your company emails about what is not something Aftercomm should hold. Thirty days after review, a cleared message’s subject line, recipients, Outlook link and the AI’s note are erased. What stays is proof of review: the mailbox, the sent and review times, Microsoft’s message identifiers, and the policy version that cleared it. Customer-configurable windows are on the roadmap; if you need a different one, get in touch.

You can erase everything yourself, right now. A workspace owner can delete the workspace from Settings. Every table carrying your data cascades from that single row — users, monitored mailboxes, policy versions, reviewed emails, billing day-counts, and the content-access log — so nothing is left orphaned in a corner of the database. You confirm by typing the workspace name rather than ticking a box, and the response hands back a count of exactly what was destroyed. That receipt is the closest thing to proof Aftercomm can give you, and it does not require emailing anyone or waiting on a support queue.

The one thing deletion cannot reach is your own mail — it never left Microsoft 365, which is the whole point of the architecture. The other is the permission grant in your directory, which only your admin can remove; Aftercomm returns the deep link to it in the same response, because after deletion you can no longer sign in to come looking for it.

What Anthropic retains. On Aftercomm’s Claude account (the default), Anthropic processes each review as Aftercomm’s subprocessor under Anthropic’s commercial terms, which bar training on the data. Anthropic may keep a copy for a limited time for its own safety checks; its retention periods are on Anthropic’s data-retention page and in Aftercomm’s Privacy Policy. Aftercomm has no access to that copy: Anthropic doesn’t return it to API customers, and Aftercomm’s Anthropic organisation sends no prompt content to any logging, tracing or inspection tool, so no one at Aftercomm can read your mail through it. On your own Anthropic account, your agreement with Anthropic governs instead: if your organisation has negotiated zero data retention, it applies to these reviews automatically.

Turning Aftercomm off and erasing your data are deliberately separate actions. Disconnecting stops all collection immediately but leaves your history intact and exportable — conflating the two would make the off switch frightening to press for exactly the customers who should feel free to press it.

Aftercomm’s Microsoft app holds two application permissions in your tenant, both read-only, both named below:

• Mail.Read — read access to mail. Aftercomm uses it for one thing: the Sent Items folder of the mailboxes you designate. Aftercomm never requests inboxes, drafts, or any other folder. Be aware that the permission itself is broader than that use. Microsoft grants mail permissions across the whole directory and offers no way to narrow them at the consent screen, so the limit to your chosen mailboxes is enforced by Aftercomm’s software unless you also apply the Exchange policy described under provider-level enforcement. Better you hear that here than find it in a permissions audit.
• User.ReadBasic.All — returns display name, email address, and UPN so the admin console can show a searchable mailbox picker during setup. Directory-only; does not grant access to any user’s mail.

That is the entire list — two permissions, both read-only. Aftercomm holds no ability to send, modify, or delete anything in your tenant. Alerts are sent from Aftercomm’s own domain and contain no message content.

No inline interception. No MX changes. No SMTP journaling. You can revoke everything in one click from Enterprise applications in your Microsoft admin center, without involving Aftercomm.

Google Workspace and other platforms use the same least-privilege, provider-native scoping pattern as they are added.

Aftercomm stores no message bodies, so when a reviewer opens a flagged item the message is fetched from your Microsoft 365 tenant at that moment, displayed, and dropped. It is never written to Aftercomm’s database, never cached by the browser, and never emailed anywhere.

This is what lets a compliance officer read a flagged message without anyone granting them mailbox permissions over your employees. The alternative designs are worse: mailbox delegation gives a reviewer everything in that mailbox forever, and emailing the content out creates a permanent, forwardable copy in a second inbox.

Every retrieval passes six gates, and each one is enforced server-side:

• The reviewer is a signed-in member of your workspace. Aftercomm staff have no account in it, so they can’t open your messages.
• The message was flagged by your policy. Messages the policy cleared can never be opened — Aftercomm is not a window into the mailbox.
• The mailbox is still monitored. Stop monitoring someone and their flagged history becomes unreadable too.
• The reviewer is under the per-hour view limit, counted from the audit log.
• Your workspace has content viewing switched on at all.
• The reviewer has entered a code from their authenticator app recently, in that browser: one code covers a working session, closing after 30 idle minutes and after an hour at most, so a session cookie stolen later can’t open anything.

Every view is logged — who, when, which message, from which IP, and whether it was allowed or refused. Refusals are recorded too, because a burst of them is what probing looks like. The log is kept for the life of your workspace, and your owners and admins can view and export it in Settings. It matters more than it might appear: Aftercomm reaches Microsoft under its own application identity, so in your Microsoft audit trail every fetch looks the same whether it was Aftercomm’s worker classifying mail or a named person reading it. This log is the only record that distinguishes them.

You can turn it off. An owner or admin can disable content viewing for the whole workspace in Settings, after which no one can retrieve a message body through Aftercomm, and the product runs on verdicts alone.

An integration you can’t easily switch off is one you should think twice about switching on. Aftercomm has a one-click disconnect in Settings, available to any workspace admin, with no support ticket and no notice period.

Pressing it stops everything on Aftercomm’s side immediately:

• Polling halts — no further messages are read.
• No further alerts are produced.
• No one can open message content through Aftercomm.
• Monitored mailboxes are deactivated, so billing stops.

Then you finish the job at Microsoft. Aftercomm deep links you straight to the Aftercomm entry in your own Entra portal, where deleting it revokes the permission grant itself. Aftercomm deliberately can’t do that step for you: removing its own service principal from your directory would require Application.ReadWrite.All, a permission far more dangerous than anything Aftercomm holds — and asking for it in order to provide an off switch would defeat the point. It also means the final revocation is enforced by Microsoft rather than resting on Aftercomm’s assurance.

Disconnecting does not delete your data. Turning off collection and destroying an audit trail are different decisions, and conflating them would make this button frightening to press for exactly the customers who should feel free to. Past verdicts stay available and exportable; workspace deletion is a separate, explicit action.

Aftercomm only ever polls the mailboxes you selected. It is worth being precise about how that is enforced: Microsoft grants application permissions tenant-wide and offers no way to narrow them at the consent screen, so by default the limit lives in Aftercomm’s software. That is a real control, but it is Aftercomm’s.

Teams who would rather Microsoft enforced it can apply RBAC for Applications in Exchange Online, granting Application Mail.Read over a scope containing only the mailboxes under review, then removing the organization-wide Mail.Read approval in Microsoft Entra. Microsoft adds the two together, so the scope restricts only once the wide approval is gone; the script’s last step removes it. This is the control that survives a compromise of Aftercomm itself — someone holding Aftercomm’s credentials would still be refused every mailbox outside your scope, because the refusal comes from Microsoft.

And Aftercomm will prove it. The admin console can try to read a mailbox you never selected and show you the result. A refusal from Microsoft is evidence from the party doing the enforcing, which is worth more than any assurance written here.

RBAC for Applications replaces Application Access Policies, which Microsoft has marked legacy with a deprecation announcement to come — so the script below configures the current mechanism rather than one you would have to redo. Your admin can verify independently at any time with Test-ServicePrincipalAuthorization -Identity … -Resource …. Note that permission changes take 30 minutes to 2 hours to propagate; that cmdlet bypasses the cache.

• Aftercomm’s servers authenticate to Anthropic by workload identity federation: the hosting platform issues each service a short-lived identity token, which Anthropic exchanges for an access token that expires within the hour. No long-lived Anthropic key exists in Aftercomm’s production environment.
• If you connect your own Anthropic account, its API key is encrypted at rest with Fernet (AES-128-CBC plus an HMAC integrity tag). The encryption key is held in the hosting platform’s encrypted environment settings, never in the database alongside the ciphertext, and the API key is never shown again once saved. Switching back to Aftercomm’s account deletes it. On the Enterprise self-hosted tier the key is generated and held entirely within your own infrastructure.
• Workspace isolation is enforced twice: every read and write is scoped to the signed-in user’s workspace, and Postgres row-level security refuses another workspace’s rows even to a query that forgot to ask, so no customer can reach another customer’s data.
• Admin session cookies are signed tokens and carry three browser-enforced hardening attributes: HttpOnly (JavaScript can’t read the cookie, defeating XSS token theft), Secure (cookie is only transmitted over HTTPS), and SameSite=Lax (mitigates CSRF). Behind that, the API refuses any change a browser marks as coming from another site.
• Sessions end after 30 minutes without activity and 12 hours after sign-in regardless (OWASP ASVS level 2), are bound to the password and two-factor state so changing either signs out every other device, and end everywhere on sign-out. Two-factor sign-in is required on every account.
• A signed-in session isn’t enough for the changes an intruder would make first. Adding, removing or promoting a teammate, changing who gets alerts or what the policy flags, stopping a mailbox’s monitoring, and opening a message each need a recent code from the authenticator app, on that browser only. One code covers a working session, closing after 30 idle minutes and after an hour at most, so malware that copies a session cookie can’t do them. Five wrong codes end every session on the account.
• Admin console is served over HTTPS only, with HSTS enabled — HTTP requests are 301'd to HTTPS at the load balancer.
• All external traffic (Microsoft Graph, Anthropic, mail delivery) is TLS 1.2+.
• Passwords are stored only as salted bcrypt hashes.
• Access to production systems is restricted to authorized Aftercomm personnel who need it, and every administrative account requires two-step sign-in (a security key or passkey where the provider supports one). No one at Aftercomm can read your mail through the product or through its AI provider’s console.

• SOC 2 Type II — in progress.
• GDPR-ready DPA available on request.
• Pre-filled CAIQ and SIG security questionnaires available under NDA.
• Customer-led penetration testing supported for Enterprise deals.

If you believe you have found a security issue, email info@aftercomm.com with enough detail to reproduce it. Aftercomm will acknowledge your report and keep you updated through to a fix, and does not pursue legal action against researchers acting in good faith who report privately and allow a reasonable window before disclosing.

Today: US region (Render, US East in Virginia). EU region planned. Enterprise customers can request a dedicated tenant in a specific region as part of a custom deployment. The AI review is processed by Anthropic on its standard global routing, which can run inference outside the US; Anthropic’s US-only inference is available for a dedicated deployment.

• Store your message bodies, attachment names, or attachment contents. Anywhere. Ever.
• Block, delay, or modify outbound messages.
• Reply to, message, or notify the person who sent the flagged message.
• Send email as anyone, anywhere. Aftercomm holds no send permission at all.
• Put message content, subject lines, or recipient lists in an alert email.
• Train a model on your mail, or let anyone else do so. Anthropic’s commercial terms bar training on API data.
• Share your data with a third party for training or analytics.
• Read a message the policy did not flag, on a reviewer’s behalf.
• Give anyone at Aftercomm a way to open your messages.
• Read attachments.