Your clients' data, walled off.
An agency inbox holds policies, certificates and personal details. Shlix AI is built so that only agency work is kept, only the right people see it, and every action leaves a record.
Where an email goes.
From the mailbox to an approved reply: read in memory, personal mail dropped on the spot, agency work kept inside your own walled-off workspace.
- Agency mailboxMicrosoft 365, read access you grant
- Read in memoryAgency work or personal? Nothing written yet
- Personal mail — droppedNo subject, sender or body kept
- Your agency's workspaceTask, documents and chat, walled off by row-level security
- Approved by a second personAnd every step written to the audit trail
Only agency work is kept.
- Private mail is never stored
Every email is classified in memory. Clearly personal email is dropped there and then: no subject, no sender, no body is kept or shown. Topics you mark as private are dropped unless the email clearly looks like work, and then only the owner decides.
- Least access to your mailbox
We connect through Microsoft's official Graph API with the permissions you grant, and you can revoke them at any time from your Microsoft admin center.
Walled off and encrypted.
- Each agency is walled off in the database
Every table carries the agency it belongs to and is protected by row-level security in the database itself, so one agency's records cannot be read by another — even through a bug in the app.
- Encrypted in transit and at rest
All traffic is HTTPS with HSTS; framing, MIME sniffing and referrer leaks are blocked by default. Data at rest is encrypted by our database provider, hosted in the United States.
The right person, on the record.
- People see only their own work
Employees see the tasks assigned to them; approvers see work waiting for approval; owners see the agency. The same rule decides the screens, the notifications and the reports.
- A second person approves
Work that needs approval cannot be approved by the person who did it. Owners can switch all customer email off with one switch while testing.
- An audit trail that is only ever added to
Every assignment, approval, send-back, send and setting change is recorded with who and when, and the log is append-only.
- Accounts issued by the agency
There is no public sign-up. Owners invite their team and can switch anyone off instantly, which ends their sessions everywhere. The sign-in page can require a bot check.
Built in, not bolted on.
Every control listed here is live in the product now. If your agency or carriers need a security questionnaire answered, we will complete it with you before you sign.
Ask us a security question- Row-level security on every table
- Encryption in transit (HTTPS, HSTS) and at rest
- An append-only audit trail
- Four-eyes approval, enforced
- Agency-issued accounts, no public sign-up
Found a vulnerability?
Do not test against a real agency's workspace; ask us for a test account instead. We do not run a paid bug bounty today.
- Tell us first, privately
At business@shlixai.io or through the contact form with the topic “Privacy or security”. Include what you found, the steps to reproduce it and the address affected. Our contact details are also in security.txt.
- We confirm within 3 business days
And keep you told while we fix it.
- Act in good faith, and we will not pursue you
Avoid other people's data, do not disrupt the service and give us reasonable time to fix the problem before telling anyone else, and we will not pursue legal action against you.