AI processing and privacy

Each workspace has an ai_processing setting. It decides whether any email content is sent to a model, and which one. It applies to every inbox in the workspace, from the next message on.

Value	What leaves the server	What you get
`off`	Nothing. Mail, attachments, contacts and knowledge stay on the Agentboxd server in Germany.	Login codes and magic links are still found, by pattern matching on our own server (confidence at most 0.7). No categories, no ai:* labels, no injection or phishing scores, no reply drafts.
`categorize` (default)	To JEV (TypeSafe AI, US), once per inbound message: the From address, subject, the first 3,000 characters of the text, our SPF/DKIM/DMARC results, and attachment file names and types. Not the attachment files.	Categories and ai:* labels, injection and phishing scores, urgency, needs-human and auto-reply flags. JEV confirms login codes, which raises their confidence.
`full`	To JEV: the same as Categorize. To DeepSeek (China), only when someone asks for a reply draft: the last 10 messages of that thread (extracted text), the contact’s name, notes and metadata, the top 5 matching knowledge documents for that inbox, and any instructions sent with the request.	POST /v1/messages/:id/draft-reply, the draft_reply MCP tool and the Draft reply button. Drafts are never sent on their own.

#Change it

Owners change it under Settings, or with PATCH /platform/org { "ai_processing": "off" } from a dashboard session. Members get 403 forbidden. The org object from GET /platform/me shows the current value.

#What changes with off

No JEV call, so no category, risk, urgency, needs_human or auto_reply on message.ai, no ai:* labels, and no message.enriched webhook.
Verification codes and magic links are still found by pattern matching on our server, with confidence up to 0.7.
SPF, DKIM and DMARC checks, extracted_text, threading, search, contacts and knowledge all keep working. None of them use a model.
Reply drafts answer 403 ai_disabled.