Last updated: 18 April 2026
Plain-English summary: We treat access to your mailbox like money. EU-hosted, tokens held in a key-management vault with audit logging, encrypted in transit and at rest, passkey sign-in. DPA, breach process, and DPIA available on request.
Specific algorithms, vendors, and configuration are documented in our DPIA, available under NDA on request.
We use a small set of vetted third parties to deliver the service. Each is bound by a written data-processing agreement. Categories:
The full, named subprocessor list and each DPA is available on request via the privacy request form.
Enterprise and business customers can request the following under NDA — email the sales contact form or the privacy request form and mention which you need:
If your policy rules out SaaS handling of mail — regulated industry, internal-only, or just preference — Skub is available as a self-hosted Enterprise install. In that mode, Provenance Tags ApS is not a data processor; your team operates the deployment in your own infrastructure with your own LLM keys and your own mail-provider credentials.
All application and database instances run inside the EU, in Amsterdam. No customer data is transferred outside the EEA for storage.
Yes. OAuth tokens for your connected mailboxes are held in a dedicated key-management vault with per-decrypt audit logging. Account data, skubs, and preferences are stored in an EU-hosted Postgres database with encryption at rest provided by the infrastructure layer.
No. Our AI provider is contractually prohibited from retaining your content beyond the individual request and from training any model on your data. Skub itself does not run any model training. We do not aggregate your mail data with other users'.
Yes — pre-signed by Provenance Tags ApS and activated on your counter-signature. Request via the privacy request form (pick “Other”, write “DPA” in the details) or through the Enterprise form.
Not at our current stage. Our underlying infrastructure and payment processors carry SOC 2, ISO 27001, and PCI DSS certifications in their own right; our processing of personal data is governed by the DPA above and the mitigations described in our DPIA. We are happy to complete vendor security questionnaires on request. Self-hosted Enterprise installs bring the regulatory boundary entirely inside your own environment.
Mail operations fail closed — we would rather return an error than serve a stale cached credential. Active Skub delivery would pause until the vault is reachable again. Your data is unaffected.
Every row tied to your account is removed within minutes: skubs, preferences, sender states, mail-connection tokens, actions. The Hanko passkey identity is also deleted so the username frees up. See our privacy policy for the full list.
If we identify a personal-data breach that affects you, we notify the Danish Data Protection Authority (Datatilsynet) within 72 hours and you without undue delay, as required by GDPR Art. 33 & 34.
Categories are listed above. The full, named list with each DPA is available under NDA on request via the privacy form.
Yes. Every action — tap, rule hit, auto-acted message — is recorded in your action log, visible to you in the app. A daily digest of silent automation (rule hits, auto-archives) is on the roadmap.
See below.
We maintain a Data Protection Impact Assessment under GDPR Art. 35 covering scope, lawful basis, risks, and mitigations. Full document available under NDA on request via the privacy form — mention “DPIA” in the details.
Submit security reports via the request form on our privacy page — pick “Other” and write “Security report” in the details. We acknowledge within 48 hours and aim to remediate critical issues within 30 days. We won't pursue researchers who act in good faith.
Provenance Tags ApS · Denmark