Security and approval model
Tavra handles your real inbox, messages and calendar. That makes the approval boundary the most important design decision in the product: the AI is untrusted decision support, and a human authorises every consequential outcome.
Human approval on consequential actions
Sending a message, creating or cancelling a meeting, and creating a task are all consequential actions. Tavra treats every one of them as a proposal. Nothing is executed until you approve it, and AI output is never treated as authorisation on its own.
Every executed action is audited
Suggestions, approvals and executed actions are recorded with the acting user and a timestamp, so there is a traceable record of what the AI proposed and what a human authorised.
Tenant isolation
Every organisation-scoped operation is verified against the authenticated user's membership and the resource's owning organisation on the server. Possessing a resource identifier is never sufficient to read or act on it.
Encrypted credential storage
OAuth access and refresh tokens are stored encrypted at rest. They are never returned through API responses, never logged, and are decrypted only for the lifetime of the request that needs them.
Treating inbound content as untrusted
Messages arriving from external providers are treated as data, never as instructions. An inbound message cannot alter system policy, invoke tools on its own, or escalate into an unauthorised action — which is the standard defence against prompt injection through email content.
Scoped, time-limited access
OAuth integrations request only the scopes Tavra needs, and each requested action is bounded rather than granted as unrestricted access.
Reporting an issue
If you believe you have found a security vulnerability, please report it through the contact path in our Privacy Policy and we will acknowledge it.