Security · Privacy

Is OwlAgent safe? What Owl can access, and what it never does

Yes, and here is exactly why. You connect Gmail, Google Calendar and your other tools on each provider’s own sign-in screen, so OwlAgent never sees your password. Owl reads, searches and drafts on its own, but it shows you an email or message and waits for your OK before it goes to anyone else, and email sends are also checked in code. It only sees the chat you have with it, never your other WhatsApp conversations. You can disconnect any tool in one click and ask us to delete your account. To be straight with you: we are a small team without SOC 2 or ISO 27001 yet, and your requests are processed by third-party AI models.

What Owl can access

Owl only works with what you give it. In practice that is four things:

• The messages you send to Owl on WhatsApp or Telegram, so it can understand and carry out your requests.
• The accounts you connect, such as Gmail, Google Calendar, Google Drive, Notion or your CRM. Owl reads emails, events, files or records only as needed for what you ask, including routines you set up yourself, like a morning brief. We do not bulk-copy your mailbox or your drive.
• A password or API key, only for the few tools that offer nothing else, such as an IMAP mailbox. These are encrypted at rest with AES-256-GCM, using a key kept outside the database.
• What Owl remembers about you: your time zone, your preferences, the people you work with. All of it is on the Memory page of your account, where you can edit or delete any item, or clear everything at once.

What Owl does before it acts

The line is simple: anything that stays with you, Owl just does. Anything that reaches another person, or can’t be undone, waits for your yes.

How this is enforced, honestly: “never do the irreversible without a yes” is part of Owl’s core instructions in every conversation. Because an AI model can still get things wrong, email sends also go through checks in code before they run:

• If your message asks for a draft (“draft it”, “don’t send yet”), the send is blocked and Owl makes a draft instead.
• If Owl’s last message asked “send it?”, the email only goes out once your reply is a go-ahead.
• You can tell Owl “every email stays a draft until I say send”. That rule is saved on your account and checked before every email send.

And Owl only says “sent” once the send has actually gone through, as in the example above.

Where your data lives

• On servers we run, not on your phone or laptop. Nothing to install, nothing left open on your network.
• Encrypted in transit with TLS (HTTPS). Access tokens are stored encrypted, and passwords or API keys are encrypted at rest.
• Kept apart per account. Each connection is stored and looked up under your own account, and the integration layer keeps your connected accounts under your own user.
• Production access is limited to the founding team, on a least-privilege basis. Databases are backed up every night, encrypted, to separate storage.
• AI models: the text of your requests is processed by large-language-model providers to write Owl’s answers, under agreements that prohibit using your data for training.
• Payments go through Stripe. Your card is entered on Stripe’s pages and never touches our servers.

The full list of providers and the legal detail are on our privacy policy, security page and data processing agreement.

How to disconnect or delete everything

1. Disconnect one tool: open Connectors in the app and press Disconnect. Owl stops using it straight away. To be fully sure, you can also revoke OwlAgent in your Google (or other) account settings.
2. Revoke from the provider: you can also remove OwlAgent from your Google or Microsoft account’s security settings. It takes effect immediately.
3. Clear Owl’s memory: on the Memory page, delete any single fact, or press “Forget everything”.
4. Delete your account: email lorenzo@owlagent.me. We cancel your subscription with Stripe first, so nothing keeps charging, then delete your conversations, connections, memory, notes, to-dos, routines and files. Your data is deleted within 30 days, except invoices we must keep by law.

What we don’t claim

• No formal certifications yet. We don’t hold SOC 2 or ISO 27001. If your company has a security questionnaire, email us and we will answer it directly.
• Owl is not end-to-end encrypted. To act on your request, Owl and the AI model have to read it.
• AI can make mistakes. That is why sends wait for your OK and why you see every draft first.

If OwlAgent fits how you work, plans and the 7-day free trial (no card needed) are on the pricing page.

Try Owl on WhatsApp →

This page summarizes our Security page, Privacy Policy and DPA. If anything here differs from them, those pages prevail. Questions: lorenzo@owlagent.me.