Security
Your inbox, your rules.
Prubex sits between your agents and your accounts. It is built so that an agent can only do what you allowed, nothing is kept that doesn’t need to be, and everything that happens is on the record.
Passthrough, not storage
Prubex reads your mail and events only when your agent asks, passes them through and keeps no copies of message bodies or attachments. Two short-lived exceptions: a message waiting for your approval (purged 7 days after it is decided or expires) and files you upload for an agent to attach (deleted after 24 hours).
Credentials sealed with Key Vault
Sign-ins and app passwords are encrypted with AES-256-GCM, each with its own nonce. The key that protects them is itself wrapped by a key in Azure Key Vault and lives only in memory. Disconnecting an account deletes its credentials at once.
Keys you scope, shown once
API keys are stored only as a keyed hash and shown once. Each key or connected app has its own scopes and accounts. Creating a full-access key, or relaxing an account’s rules, asks you to sign in again first.
Approval before anything is sent
Every send and invitation waits for your approval by default, and each account can limit who agents write to and how many messages a day. New workspaces start with tighter limits for their first 24 hours.
No permanent delete
No tool can permanently delete mail, mail folders or calendars. Mail an agent removes goes to the trash, and you can turn even that off per account.
Every call logged
Each tool call is recorded with who made it, on which account, and what happened. You see it live in Activity and can export it. Mail bodies never enter the log; for sends it keeps the recipients and the subject (up to 120 characters), for 30 days on the free plan or 90 on paid plans.
Untrusted content marked
Text from emails and events reaches your agent marked as untrusted, and messages that look like they try to instruct an agent are flagged, so an agent knows not to take orders from your inbox.
Hosted in South Africa
Prubex runs on Microsoft Azure in the South Africa North region, with its database and Key Vault there. Pages are served over HTTPS only, with a strict content security policy.
Google user data
Prubex’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Prubex uses Gmail and Google Calendar data only to carry out what you or your agents ask, never for advertising, and no person at Prubex reads it.
Subprocessors
| Company | What for | Where |
|---|---|---|
| Microsoft Azure | Hosting, database, key management and sending Prubex’s own email | South Africa (email data: Africa) |
| Paddle | Payments, tax and invoices, as merchant of record, once paid plans open | Paddle’s regions |
Your email providers (Microsoft, Google, Zoho and the rest) are not subprocessors: Prubex connects to them on your behalf, with your sign-in.
Report a problem
Found a security issue? Email hello@prubex.com with the details and how to reproduce it.