# Security and privacy at Gravel

Gravel reads your email and calendar, so you should know what it reads, how that data is protected, who can look at it and how to delete it. This page describes how Gravel is built, and says where that has not been verified yet.

## What does Gravel read, and when?

Gravel reads the mailbox and calendars you connect, the photos, screenshots and PDFs you send it in chat (an early-access feature), and the messages you write to it. After you connect, it keeps reading new mail and calendar changes so it can notice what needs you. That is what lets it text you first. Text "pause" and all background work stops until you say so.

**It starts read-only.** When you connect Gmail or Outlook, Gravel asks for read access only. The first time you ask for something that needs more, such as sending a draft or creating an event, it asks for the extra permission then, and the action comes back to you for confirmation.

**It never sees your password.** For Google and Microsoft, Gravel receives an access token that you can revoke at any time in your own account. For iCloud Mail, GMX, WEB.DE, T-Online, freenet, mailbox.org, Posteo and other IMAP mailboxes, you create an app password and can revoke it with your provider. Tokens and app passwords are stored encrypted, and app passwords are never shown to the AI model or written to logs.

**It keeps little of what it reads.** From an email it mainly keeps the facts it found, such as a delivery date or an amount, plus at most a one-sentence summary. Raw email content is cached for 30 days at most, longer only while an open task or a memory needs that specific message.

## How is my data encrypted?

Your data is encrypted with a key that belongs to your account only. Every account has its own data key, so one key never opens another person's data. Sensitive fields, such as sender addresses, topics, memory, notes and saved logins, are encrypted with AES-256-GCM before they are stored, and each value is bound to your account and its field. Record ids, timestamps and record types stay readable so the database can find things.

**Where the master key lives.** Your account key is itself wrapped by a master key. Gravel is built to keep that master key in a key management service in the EU (Scaleway Key Manager, with a self-hosted fallback), apart from the data. That adapter is implemented and tested, but it has not yet been run against the live service.

**Isolation in the database.** Postgres row-level security means a query for one account cannot read another account's rows. This is tested against a real Postgres database.

**Deleting the key deletes the data.** When you delete your account, your key is destroyed. Every encrypted copy of your data, including copies in backups, becomes unreadable at that moment. This is called crypto-shredding.

## Where does my data live, and who else gets it?

Gravel is hosted and processed in the EU. Its servers, database, key management and AI models run on European infrastructure, mainly Scaleway in Paris, with OVHcloud in France for failover and encrypted backups. The AI models are open models, including Mistral, gpt-oss and Qwen, run on those providers.

**Two exceptions, both your choice.**

1. **Your email and calendar provider** (Google, Microsoft, Apple or another). Your mailbox already lives there under your own contract, and whatever Gravel writes there, such as a draft or an event, goes there too.
2. **The messaging app you talk to Gravel on.** Gravel works in WhatsApp (run by Meta) and Telegram (run by Telegram Messenger) today, so the messages you and Gravel exchange pass through their systems under their terms. iMessage is coming, and when it arrives those messages will pass through Apple as well. Gravel says so the first time you use one of them, and you can switch channels at any time with one message. The [privacy notice](https://gravel.chat/privacy) lists each channel and where it processes data, including channels that stay entirely in the EU.

**The website.** This public website, its visitor statistics and the waitlist sign-ups run on Vercel in the US, with waitlist sign-ups stored in Frankfurt. The website sets no cookies.

**What Gravel does not do.** Gravel does not train AI models on your data, and neither do its providers. It does not sell your data, and it shows no advertising: proactive messages contain none. It never phones businesses or people on your behalf, and it always presents itself as an AI, never as a person, in line with Article 50 of the EU AI Act. Every company that processes data for Gravel is listed in the [privacy notice](https://gravel.chat/privacy).

## Who can look at my data?

Nobody on the Gravel team can read your content by default. A person can look in only three cases: you ask for help with specific content in a support case and agree, it is needed to investigate a security incident or abuse, or the law requires it.

In each case the access needs a written reason and is recorded in your activity log before the person can see anything. You can see that entry.

**The activity log.** Gravel records what it read and did on your behalf: mail and events it looked at, documents, external checks, actions, blocked manipulation attempts and browser tasks. Ask "what did you look at today?" in chat for a summary, or open the activity view, a private link that expires after 24 hours and has a pause button. The log shows what happened, not the content, and it is kept for 12 months.

## Can a malicious email make Gravel act?

No. Gravel is designed so that text in an email, a calendar invite or a web page cannot make it send, forward, pay or delete anything through a decision that depends on the AI model. Anyone can send you an email, so Gravel treats everything it reads from other people as untrusted, in three layers.

1. **Untrusted text is marked and cleaned.** Email, calendar and web content is wrapped so the model knows it is a quote, not an instruction. Text a person could not see, such as white-on-white text, zero-size text and invisible characters, is removed before the model reads it, and common injection phrases in English and German are flagged. These checks are heuristics and will not catch every disguised instruction, so nothing depends on them alone.
2. **The model can only propose.** It has no tool that sends, confirms or executes anything. Fixed code, not the model, decides whether a proposed action is allowed, needs your yes, is handed back to you or is refused. Some things are refused outright, such as sending to an address that only appeared inside an email, unless you typed it yourself.
3. **Your yes is tied to what you saw.** Before an action that reaches other people or costs money, Gravel shows you exactly what it will do. Your confirmation counts only for that exact content, and only a message from you can confirm it. Text inside an email never can. One yes covers a whole plan, and each step is checked again right before it runs.

**Ask first by default.** Anything that reaches other people or costs money asks first, and payments and purchases are handed to you. Payments, cancellations, forwarding and deletions can never be set to run without asking. You choose one of four levels for each kind of action: just do it, only when I ask, ask me first, or hand it to me. Learn more about [autonomy levels](https://gravel.chat/learn/autonomy-levels).

**How it is tested.** The evaluation suite includes injection attempts run against a model built to obey every instruction it finds in an email, and a change cannot ship if any of them causes an action without your confirmation.

## How do I export or delete my data?

Text Gravel. Say "export my data" and it gives you a one-time link, valid for one hour, to a complete copy in a readable and a machine-readable form. Say "what do you know about me?" and it lists what it has stored. Say "forget that" and it deletes the entry. Say "delete my account" and, after you confirm, it deletes everything.

When you delete your account, Gravel revokes its access at Google, Microsoft and your other connected services, destroys your encryption key and deletes your records. Any copy left anywhere, including backups, can no longer be read. Unencrypted technical metadata in backups is gone within 30 days. The one exception is accounting records Gravel must keep by law. Your chat history inside WhatsApp or Telegram (and later iMessage) is not in Gravel's hands: delete it in that app.

| Data | Kept for |
|---|---|
| Raw email content | 30 days at most, longer only while an open task or memory needs that message |
| Documents you send | 30 days after analysis, unless you ask Gravel to keep them |
| Chat history and transcripts | 90 days |
| Audio | Not stored |
| Activity log | 12 months |
| Action proposals and confirmations | 12 months |
| Memory, settings, autonomy levels and automations | Until you delete them or your account |
| Backups | 30 days |

The full list is in the [privacy notice](https://gravel.chat/privacy).

*Example conversation (Shows what it knows, forgets on request), recorded in Apple's Messages app:*

> **You:** what do you know about me?
>
> **Gravel:** You prefer afternoon appointments, your landlord is Dana at Hollis, you fly United in an aisle seat, and Mom’s birthday is Oct 26.
>
> **You:** forget the flight stuff
>
> **Gravel:** Done. I’ve forgotten your airline and seat.

## How is Gravel checked, and how do I report a problem?

Gravel is checked by automated tests and an evaluation suite that gates every change, and not yet by outside auditors.

**What is verified.** Hundreds of automated tests cover encryption, key destruction, export, deletion and the action gate, including database isolation against a real Postgres. The evaluation suite includes attack scenarios and fails if a metric gets worse.

**What is not verified yet.** Gravel holds no certifications: no SOC 2 and no ISO 27001. It has not had an independent penetration test or security audit, and an outside review is planned. Parts of the system have been tested against recorded and sample data and not yet against live services with real accounts, such as the connection to the EU key manager and several mailbox and messaging connections. This page says so on purpose, so it does not imply more than is true.

**Report a vulnerability.** Email [victor.gulchenko@gmail.com](mailto:victor.gulchenko@gmail.com) with what you found and how to reproduce it. It reaches the founder directly. Please report privately before sharing details in public, and do not access other people's data or disrupt the service while testing. The same contact is published in machine-readable form at /.well-known/security.txt.

## Questions

### Does Gravel train AI models on my data?

No. Gravel does not train AI models on your data, and neither do its providers. It does not sell your data or show advertising either.

### Can Gravel send an email without asking me?

Not to other people. Gravel sends messages to third parties in your name only after you approve the exact text. Payments, cancellations, forwarding and deletions can never be set to run without asking.

### Who at Gravel can read my email?

Nobody by default. A person can look only if you ask for help with specific content and agree, if it is needed to investigate a security incident or abuse, or if the law requires it. Each access is recorded in your activity log before it happens, and you can see it.

### Where is my data stored?

In the EU. Gravel is hosted and processed on European infrastructure, mainly Scaleway in Paris and OVHcloud in France. The exceptions are the email and calendar provider you connect and the messaging app you choose, which the privacy notice explains.

### What happens to my data if I delete my account?

Gravel revokes its access at your connected services, destroys your encryption key and deletes your records. Because the key is gone, any copy left anywhere, including backups, can no longer be read. Accounting records that the law requires Gravel to keep are the exception.

### Is Gravel certified, for example SOC 2 or ISO 27001?

No. Gravel holds no security certifications and has not yet had an independent audit. This page describes how it is built and what is tested, and says what has not been verified yet.

### How do I report a security vulnerability?

Email victor.gulchenko@gmail.com with what you found and how to reproduce it, and report it privately before sharing details in public. The contact is also published at /.well-known/security.txt.

## Related

- [What to check before giving an AI assistant your inbox](https://gravel.chat/learn/ai-assistant-privacy-checklist.md)
- [How much should an AI assistant do without asking?](https://gravel.chat/learn/autonomy-levels.md)
- [How Gravel works, step by step](https://gravel.chat/how-it-works.md)

---

Gravel · https://gravel.chat/security · Updated 2026-10-19 · Status: Early access, €12 a month