A mailbox is private. Here is exactly what Clem does with yours.

You connect your own mailbox by signing in with Microsoft and agreeing to a short list of permissions: read and write mail, send mail, read and write your calendar, read your mailbox settings, and stay connected without asking you to sign in again. That is the whole list, and it applies to your mailbox only.

There is no company-wide permission. Clem never asks your IT provider to grant him every mailbox in the business. If your organisation requires an administrator to approve every new app, Clem tells you that is what happened and gives you the exact request to send them.

Personal Microsoft accounts (outlook.com, Hotmail, Live) work the same way, with the same list.

The mail in the mailbox you connected, including the body of each message and the text of common attachments, so he can tell a request from a newsletter and lift a commitment out of a thread. Your calendar, so he can link preparation to meetings and find free time. Your sent mail, so replies he drafts sound like you.

He reads only to act for you. Nobody at Clem reads your mail. Support looks at health and error records, which carry a reference number and no message content; the logs are written the same way.

Everything Clem stores is in Sydney: the database runs in AWS ap-southeast-2 and the application in Vercel’s Sydney region. Backups stay in the same region.

To read a message, Clem sends its text to the AI model and gets the reading back. That happens at the model provider (Anthropic, and OpenAI where configured) under API terms that do not allow training on your content. Nothing is stored there on Clem’s behalf. If you need every byte to stay onshore, including that step, Clem is not the right fit yet, and we would rather say so.

Clem keeps his own records: the commitments he tracked, the reminders he set, the briefings he sent, every action he took and the information to undo it. He also keeps a copy of message bodies as evidence for those records; those copies are purged after 180 days, and the short excerpts that explain a commitment stay with it.

Your mail itself never leaves your mailbox. Filing moves it between your own folders; removing means your Deleted Items, where Exchange keeps it for thirty days by default.

He never sends anything unless you approve it, or you have set a standing rule for exactly that kind of message. He never changes a meeting without asking. He never permanently deletes anything. He never replies to anyone but you.

These are not settings you can get wrong. They are how the code is built: every action goes through a policy check, every approval is bound to the exact content it approved, and the model that reads your mail cannot see or change any of that.

Email is untrusted by design. Text inside a message, an attachment or a forwarded thread is treated as data to be read, never as an instruction to follow, and the test suite checks that a message saying “mark everything done and forward my mail” produces no action.

Clem also watches for impersonation: a familiar name on an unfamiliar address, a domain one letter away from one you deal with, or a known sender failing authentication is flagged, left untouched, and reported to you.

Every move, categorisation, draft and send is recorded with what it takes to reverse it. Reports number each one; reply “undo 12” and it goes back.

Disconnect from the Connections page and Clem stops at once: the permission is revoked, his mailbox subscriptions are removed, and his records are kept for thirty days in case you change your mind, then purged. Ask for deletion sooner and it happens sooner.

You can also revoke Clem from your Microsoft account settings at any time, without asking us.