Your email is personal. Here's exactly how we handle it.

Quri's database, file storage and backend functions run in Convex's EU region. The search index runs in Qdrant's EU region. That's where your emails, the index built from them, your questions and your drafts live.

Sign-in is handled by Clerk in the US under the EU-US Data Privacy Framework. Every provider, with its location and transfer safeguard, is listed on our subprocessors page.

To make your mail searchable by meaning, text from your emails is sent to OpenAI to compute embeddings. To answer a question or draft a reply, your question and the relevant email excerpts go to OpenAI or, if selected, Anthropic.

OpenAI does not use data sent through its API for training. Where configured, OpenAI processes requests with EU data residency. Enterprise customers can bring their own keys (BYOK), so requests run on accounts they control.

Mailbox passwords, SMTP credentials and BYOK API keys are encrypted with AES-256-GCM before they are stored, using versioned keys so keys can be rotated.

Email content and the search index are encrypted at rest by our infrastructure providers. Quri does not add its own application-level encryption to email content, and we say so plainly.

On every plan, including Free, you can export your data yourself. Quri builds the archive and emails you a download link that expires after 7 days.

Deleting your account removes your mailbox credentials, emails, search index, AI conversations and drafts, revokes provider access and stops syncing. Security audit records are pseudonymized. Emails removed from your mailbox are purged from Quri after 30 days.

Answers and drafted replies are marked as AI-generated, in line with Art. 50 of the EU AI Act. Answers cite the emails they are based on, so you can check them against the source.

Drafts are never sent on their own: you review, edit and send them through your own mailbox. Details are on our AI transparency page.

Enterprise customers can bring their own OpenAI, Anthropic and Qdrant keys (BYOK), so AI and search requests run on accounts they control and can revoke.

SSO via SAML or OIDC is available on request, and Enterprise agreements include a data processing agreement under Art. 28 GDPR. Quri is developed and operated by KI-Quadrat Systemhaus GmbH, whose information security management system is certified to ISO/IEC 27001:2022 and whose AI management system is certified to ISO/IEC 42001:2023. The certificates cover the company's management systems, not the cloud providers on our subprocessors page. We don't hold a SOC 2 report.