CASA Tier 2 Certified

GDPR compliant · EU-hosted

Security you can verify, not just trust.

Attena connects to your email and chat accounts, so we built security in from day one, not bolted on after. Here's exactly how we protect your data, and what you control.

See how we protect your data

Three things we promise, full stop.

These commitments carry no exceptions and no expiry date. They are the standards we hold ourselves to.

We never train on your data

We don't train our own models on your content, and we only use AI providers whose published terms commit to the same. See our sub-processors page for the current list.

We never sell your data

Your messages, contacts, and usage data are never sold, rented, or traded to anyone, for any reason. We earn our living from the product, never from what you write or who you write to.

You can delete everything

Schedule deletion from Settings whenever you want. After 30-days, your messages and personal data are permanently removed.

Where your data lives.

Attena is operated from Germany, within the EU. Data transfers and processing comply with the General Data Protection Regulation (GDPR).

Hosted and operated from Germany, within the EU.
Every connection to Attena is encrypted in transit with TLS 1.2 or 1.3.
The full list of sub-processors that may touch your data, including what each one sees, where it's located, and its no-train commitment, is public on our sub-processors page.

We don't read your inbox.

Attena's use of data from your connected Google account adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We don't allow humans to read your email content, unless: you've given us affirmative agreement to look at something on your behalf (for example, a support request); it's necessary to investigate security abuse; it's required to comply with the law; or the data is aggregated and anonymized for internal operations.
We don't use your data to serve ads, and we don't transfer it to third parties except as needed to run the features described in our Privacy Policy.

Read the full Privacy Policy for details.

How we protect your data.

Encryption in transit: TLS 1.2 or 1.3 on every connection.
Encryption at rest: OAuth refresh tokens, TOTP secrets, and any stored email passwords are protected with authenticated encryption (AES-128-CBC with HMAC-SHA256, via Fernet).
Secure mobile storage: auth tokens live in the iOS Keychain or Android EncryptedSharedPreferences (AES-256-GCM), never in plain text.
OAuth-only authentication: we connect to Google via OAuth 2.0 and never see or store your Google password.
Continuous security testing: regular static (SAST) and dynamic (DAST) scanning against the OWASP CWE families.

Privacy-first by design.

Built to give you focus without compromising your data.

Complete permission control

You decide exactly which channels Attena can access and what it skips. Permissions are yours to grant, fine-tune, or revoke at any moment with total visibility into why every item surfaced.

European data residency

Hosted on secure EU infrastructure with strict GDPR compliance. Your communication flows remain governed entirely by European privacy and data protection standards.

Zero model training

Your communications stay strictly yours. We never use your emails, messages, or workflow data to train public or third-party AI models.

CASA Tier 2 Certified

Independently audited under Google's Cloud Application Security Assessment (CASA Tier 2). Your integrations meet rigorous security standards for data handling and system integrity.

Independently assessed.

CASA Tier 2 Certified

GDPR compliant

Attena has achieved CASA Tier 2 certification, Google's assessment framework for applications requesting sensitive and restricted API scopes. Our use of data from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You're in control.

Export your data

Download a structured copy of your account, messages, and activity anytime from Settings → Account → "Download my data".

Delete your account

Schedule deletion from Settings → Account → "Delete account…". A 30-day grace window applies before permanent removal.

Revoke access

Disconnect Attena from your Google account anytime from your Google Account permissions page.

Opt out of AI features

The daily briefing email is opt-in and off by default. Turn it on or off anytime in Settings.

Questions, answered.

Do you train AI models on my emails?

No. We never train our own models on your content, and we only use AI providers whose published terms commit to the same. See our sub-processors page.

Can Attena employees read my messages?

Only in narrow cases: with your explicit agreement, to investigate abuse or a security issue, to comply with the law, or when the data is aggregated and anonymized. Otherwise, no.

Is my data encrypted?

Yes. Every connection uses TLS 1.2 or 1.3 in transit, and sensitive credentials are encrypted at rest with authenticated encryption (Fernet).

What happens when I delete my account?

Your account enters a 30-day grace window, during which you can recover it. After that, your messages and personal data are permanently removed, except where the law requires us to retain certain records.

Which AI providers do you use?

The current list, along with what each one sees, where it's hosted, and its no-train commitment, is published on our sub-processors page.

What certifications does Attena have?

CASA Tier 2, Google's assessment framework for apps requesting sensitive and restricted API scopes.

Found a security issue?

We want to hear about it. Email security@attena.app with the details and if possible a screenshot.

Secure by design. Ready when you are.

Join the waitlist for early access, with the same security commitments from day one.

No spam. Unsubscribe at any time. Your inbox and privacy are fully protected.