Your deals are confidential.
So is how we handle them.
Sortroom reads a mailbox that holds your clients' business. This page says, in plain words, what we keep, what we never keep, who touches it, and what we have tested. It is written for whoever has to sign this off.
Every reply, chaser and introduction is a draft until you have read it, seen who it goes to, and pressed Send yourself. There is no automatic sending anywhere in the product. Sortroom never deletes, moves, archives or marks your mail either: it reads, and it sends only what you approve.
What we store
The index, not the correspondence.
Your mailbox stays the system of record. Sortroom keeps what it worked out, and fetches the original from your mailbox only when you open it.
Not kept.
Each email is read once, in memory. We store the result of that read: the summary, the extracted price, yield, size and tenure, the score against your requirements. The body itself is not written to our disk. When you open a thread, the text is fetched from your own mailbox in the moment and shown to you.
A copy of our data would give an attacker an index of deals, not a year of your correspondence.
Encrypted with a key unique to your workspace.
Brochures and meeting recordings are stored encrypted. Each workspace has its own key, itself wrapped by a master key that lives outside the data store. One customer's key cannot open another's files, and a stolen disk is noise without the master key.
We never see your password.
You connect with Microsoft or Google sign-in. Sortroom receives a token scoped to reading your mail and sending what you approve, encrypted at rest and revocable by you or your admin at any time. Your Sortroom password is hashed with scrypt; nobody, including us, can read it back.
Your data lives in its own file.
Every workspace is a separate database. A request signed in to your workspace can only ever reach your workspace: there is no shared table where a missing filter could expose another firm's deals. We tested this the way an attacker would, below.
TLS everywhere, enforced.
Every connection is HTTPS, with HTTP Strict Transport Security so a browser will never fall back. Security headers on every response stop the app being framed by another site or having its content sniffed.
Disconnect deletes.
Disconnecting a mailbox removes its tokens, cached content and every attachment we hold from it, immediately. Deleting your account removes the workspace. Encrypted backups are kept so a mistake can be undone; we have tested restoring from them, not just taking them.
Tested, not asserted
We attacked our own product first.
Before the first external firm connected a mailbox we probed the live service the way a hostile user would. What held, and what we fixed.
Found something? Tell us before you tell anyone else and we will fix it fast: matt@m22.group.
Who processes your data
Named, and bound by their terms.
Sortroom is built on services you already trust with this data, or that never see anything identifying.
| Service | What it does | What it sees, and the terms |
|---|---|---|
| Microsoft 365 / Google Workspace | Your mailbox, through the official Graph and Gmail APIs | Everything, because it is your mailbox. Access is a token you or your admin can revoke in one click. Scopes are the minimum: read mail, send mail. No calendar, no contacts, no files. |
| OpenAI | Reads each email and brochure to extract the deal | The text of that email, at read time. Under API terms it is not used to train models. We do not send your name, your mailbox address or your credentials. |
| Anthropic | Drafts replies, writes meeting summaries, answers questions in Ask | The thread or transcript it is working on, at that moment. Not used to train models under API terms. |
| Speechmatics | Transcribes meeting recordings | The recording, on their EU endpoint, for the duration of the job. |
| Google Maps | A photograph of a property's exterior | A street address. Nothing else. |
| Railway | Hosts the application and its storage | The application, its database files and encrypted attachments. The master key that unlocks workspace keys is held in the runtime environment, separate from the data store. |
We are putting data processing agreements in place with each of these. Ask and we will tell you exactly where each one stands.
Where we are on SOC 2 and ISO 27001
We are not yet certified, and we will not pretend otherwise. What we have done is build to the control sets those audits examine, from the first line of code rather than retro-fitting them when a customer asks. When we are audited, we expect to pass because the controls already exist, not because a consultant wrote a policy the week before.
- Least-privilege access: minimal mail scopes, per-workspace isolation, revocable tokens
- Encryption in transit (TLS, HSTS) and at rest (per-workspace keys, encrypted backups)
- Secure development: over 240 automated tests run before every deploy, including tests that pin each security property above
- Change control: every change reviewed, committed and traceable
- Vendor management: named sub-processors with data processing terms
- Retention and deletion: bodies not stored, disconnect deletes, restore tested
- Logging without content: system logs never contain email text
- Incident response: a named person, a direct address, and a fix-first policy
An independent penetration test and a SOC 2 Type I report are the next steps, timed for when our first customers need to show them to their own clients. If your firm needs a security questionnaire completed now, send it: we would rather answer it than have you guess.
Still have a question your IT team wants answered?
Ask it directly.
You'll get the founder, not a form.
Thirty minutes on Teams or Zoom if it is easier to talk it through.