Opening soon — what you're reading here is the architecture Skub will launch with.
Last updated: 20 April 2026
Plain-English summary: We treat access to your mailbox like money. EU-hosted, tokens held in a key-management vault with audit logging, encrypted in transit and at rest, passkey sign-in. DPA, breach process, and DPIA available on request.
Most AI email tools store everything they learn about you in their own databases. We don't.
When a new email arrives:
This isn't a policy. It's the architecture.
For stronger guarantees, Skub is self-hostable.
Specific algorithms, vendors, and configuration are documented in our DPIA, available under NDA on request.
By default, every connected mailbox's OAuth token is wrapped into Skub Vault — the EU-hosted key-management vault described above. No configuration required; this is what you get on skub.me.
Self-hosted Enterprise installs, regulated tenants, or anyone who wants OAuth blast-radius to end inside their own infrastructure can choose a different vault at connect time:
secretmanager.secretAccessor on a specific secret path.Honest note. In multi-tenant SaaS mode, Skub still needs a small credential to reach your external vault — that credential itself lives in Skub Vault. True “your keys, your infrastructure” only exists in a self-hosted Enterprise install, where Skub runs entirely inside your environment.
At launch: Skub Vault default for SaaS; the others available today in self-hosted installs. Google Cloud Secret Manager is next on the SaaS roadmap; others ship on demand — ask us.
We use a small set of vetted third parties to deliver the service. Each is bound by a written data-processing agreement. Categories:
The full, named subprocessor list and each DPA is available on request via the privacy request form.
Enterprise and business customers can request the following under NDA — email the sales contact form or the privacy request form and mention which you need:
If your policy rules out SaaS handling of mail — regulated industry, internal-only, or just preference — Skub is available as a self-hosted Enterprise install. In that mode, Provenance Tags ApS is not a data processor; your team operates the deployment in your own infrastructure with your own LLM keys and your own mail-provider credentials.
Everything Skub holds about you — OAuth tokens, subscription status, connection metadata — runs on EU-hosted infrastructure in Amsterdam. No customer data is transferred outside the EEA. We don't maintain a database of your email content or learned preferences; those stay under your control.
Yes. OAuth tokens for your connected mailboxes are held in a dedicated key-management vault with per-decrypt audit logging. Operational data (subscription status, connection metadata, encrypted OAuth tokens) is stored in an EU-hosted key-management vault; user content (email, preferences, rules, history) is not stored on our servers — see our landing page for the full data flow.
No. Our AI provider is contractually prohibited from retaining your content beyond the individual request and from training any model on your data. Skub itself does not run any model training. We do not aggregate your mail data with other users'.
Yes — pre-signed by Provenance Tags ApS and activated on your counter-signature. Request via the privacy request form (pick “Other”, write “DPA” in the details) or through the Enterprise form.
Not at our current stage. Our underlying infrastructure and payment processors carry SOC 2, ISO 27001, and PCI DSS certifications in their own right; our processing of personal data is governed by the DPA above and the mitigations described in our DPIA. We are happy to complete vendor security questionnaires on request. Self-hosted Enterprise installs bring the regulatory boundary entirely inside your own environment.
Mail operations fail closed — we would rather return an error than serve a stale cached credential. Active Skub delivery would pause until the vault is reachable again. Your data is unaffected.
Everything Skub holds is removed within minutes: your OAuth tokens are wiped from the vault, the connection metadata and subscription reference are deleted, and your passkey identity is removed so the username frees up. Derived data you've kept under your own control (preferences, rules, history) stays where you chose to keep it — or is removed with the mailbox if you revoke Skub's access at Google. See our privacy policy for the full list.
If we identify a personal-data breach that affects you, we notify the Danish Data Protection Authority (Datatilsynet) within 72 hours and you without undue delay, as required by GDPR Art. 33 & 34.
Categories are listed above. The full, named list with each DPA is available under NDA on request via the privacy form.
Yes. Every action — tap, rule hit, auto-acted message — is recorded in your action log, visible to you in the app. A daily digest of silent automation (rule hits, auto-archives) is on the roadmap.
See below.
We maintain a Data Protection Impact Assessment under GDPR Art. 35 covering scope, lawful basis, risks, and mitigations. Full document available under NDA on request via the privacy form — mention “DPIA” in the details.
Submit security reports via the request form on our privacy page — pick “Other” and write “Security report” in the details. We acknowledge within 48 hours and aim to remediate critical issues within 30 days. We won't pursue researchers who act in good faith.
Provenance Tags ApS · Denmark