Security and privacy

Your mailboxes

• Mailbox passwords and sending-service API keys are encrypted in Google Secret Manager, with encryption keys SendPath controls. They're used only to send, test the connection, and read replies and bounces, and staff can't read them.
• Google Workspace connects through the access your Workspace admin grants in the Google Admin console: SendPath stores no password or key, and the admin can remove that access at any time.
• Microsoft mailboxes connect with Microsoft sign-in: SendPath stores an encrypted sign-in token, never the password, and you can revoke it in your Microsoft account.
• SendPath reads your mailbox only to find replies to your campaigns, bounce reports and warm-up mail. Other mail is skipped and not stored.
• SendPath never changes your DNS. It shows you what to add.

Signing in

• There are no passwords: you sign in with Google, Microsoft, a passkey or a one-time email link. See Profile and signing in.
• A human check runs at sign-in, and SendPath signs you out after 12 hours without activity.
• Each person's access is set per workspace by its owners. See What each kind of access allows.

SendPath staff

Staff reach workspaces only through a separate admin system: every action there is logged, and it's blocked from reading mailbox credentials.

SendPath AI

• Reply labels, reviews and drafts send the text they need (a reply, an email, your business memory) to Google's Vertex AI in the United States. Under Google's terms it isn't used to train Google's models. Your contact lists aren't sent.
• SendPath AI never sends an email or a reply, and never changes anything without your click.
• Connect your AI can only read, as you, in the workspace you chose. See What it can see.

Your data

• Data is encrypted in transit and at rest, and stored in the United States (Google Cloud, Iowa).
• Your contacts are yours: SendPath doesn't sell them, use them for advertising, or use them for anything but your workspace.
• Deleting a workspace (its owner, in Settings) deletes its data and destroys its stored credentials at once.
• A read-only workspace (trial ended, or a payment lapsed) keeps its data so you can pick up where you left off.