Skip to content

Security

Email is a large attack surface. We take security seriously. AgentMail combines protection, policies, and access to control what reaches your workflows.

AICPA SOC 2 Type II certified

Live uptime and incident history for the AgentMail API.

Live uptime and incident history for the AgentMail API.

Trust Center

View live service status

Live uptime and incident history for the AgentMail API.

View status

AI Companies building
on AgentMail

Replit, Salient, eve, Factory, Alchemy and Polsia

incoming message

agent analyzes

agent takes action

An email can steer your agent’s next move. Put checks between what it reads and what it does.

AgentMail checks messages for spam and malware. Infected messages are rejected, while spam is available for review.

Agent Armor flags a suspicious message and passes a safe one through
Beta

Agent Armor uses a custom model trained on our own dataset to detect prompt injection in email. It screens for attempts to override instructions, extract sensitive information, or redirect your agent’s behavior.

Trained on legitimate email and adversarial examples, the model learns to distinguish everyday requests from attempts to manipulate your agent.

Boundaries & reputation

Allowed and blocked domains for an agent

Set allow and block policies for email addresses and domains so your agents don’t suddenly start sending spam.

Set separate rules for sending, receiving, and replying.

Review controls for encryption, access management, monitoring, and incident response. Discuss data residency with our team.

Data protection

encryption in transit for service/API communications and at rest.

Deployment

EU hosting and customer-cloud options through Enterprise.

Assurance

SOC 2 documentation and report access.

Access and operations

Access controls, monitoring, and incident response.

Security FAQ

Questions, answered.

Yes. Use address and domain lists, with separate policies for received messages and replies.

Yes. Scope its key to the resources it needs and grant only the relevant permissions.

No. It adds inbound screening. Your application still determines which actions the agent may take and when review is required.

Yes. Use the report request route in the SOC 2 documentation to contact the team about your needs.

Prompt

Give yourself access to AgentMail by following the guide at:

https://agentmail.to/docs/get-started/agent-signup

and refer to:

https://agentmail.to/llms.txt

for the documentation index.

Install the SDK and start building with AgentMail