# Security and privacy

Confidential communication belongs in Europe. This is how Xenaxio protects your data – including when you use AI.

## Stored in Germany

Mailboxes, files, calendars, contacts and the database live on servers in a data centre in Germany.

## AI from Europe

AI processing runs through the EU endpoint of Mistral AI (Paris). Your content is not used to train models. Or connect your own model – then the AI stays entirely with you. If it stops answering, Xenaxio switches to Mistral only if you have turned that on.

## Prompt-injection protection

Emails are handed to the AI as data, never as commands. Instructions someone writes into an email are not executed.

## You stay in control

The AI deletes only drafts it created itself – after you confirm; never your emails or your own drafts. It writes drafts; events are created only after you confirm. It sends email only when you explicitly allow it for a scheduled task – and only to the addresses you name.

## Complete audit log

Every AI action – in the web client and from your AI chat – is logged. Admins filter it and export CSV.

## Cleanly separated access

Sign-in uses a secure session; mailbox credentials are stored encrypted (AES-256-GCM). Every connection to an AI chat has its own key, which you can revoke at any time.

## Rooms: team chat under your control

Every company has its own chat server in Germany. Your administrator decides whether and with which companies your team chats; messages from outside can be reported and senders blocked.

## Sender addresses can’t be faked

Nobody sending through Xenaxio can put someone else’s address as the sender – not even from Outlook or Thunderbird. Mail goes out only from your own addresses and the shared mailboxes you may send from.

## On your own servers

Xenaxio is built from the start to run in your own data centre – with the same software as our cloud. With your own AI model, your data and the AI processing stay in your building.

## Isolation between companies

Each company sees only its own mailboxes, files and contacts – even on shared infrastructure. Sharing works only with colleagues in your own company.

## Encrypted backups

Database, mailboxes and files are backed up regularly and encrypted; restoring is tested.

## Open web client

The web client is based on Bulwark Mail and open source (AGPL-3.0).

## Questions

**Where is our data stored?**

Mailboxes, files, calendars, contacts and the database live on servers in Germany. AI processing runs through the EU endpoint of Mistral AI, a French provider – or, if your company connects its own model, only on your own server.

**Is the AI trained on our emails?**

No. Your content is not used to train AI models. The AI only reads what your request needs, and every action is recorded in the audit log.

**Can the AI send or delete emails on its own?**

It can delete only drafts it created itself – and only after you confirm; never your own drafts or any other email. The AI writes drafts and proposes meetings; they are created only after you confirm. It may send only for a scheduled task you explicitly allow it to – and only to the addresses you name.

**Can instructions hidden in an email control the AI?**

No. Emails are handed to the AI as data, never as commands. Instructions someone writes into an email are not executed.

**Which AI does Xenaxio use?**

By default, language models by Mistral AI through its EU endpoint. Your administrator can connect your own model instead – for example Ollama or vLLM on your own hardware, wherever you run it. Content then goes only there. Your administrator decides which model your team uses and who may use the AI.

**Is there a data processing agreement?**

Yes. A data processing agreement under Art. 28 GDPR is available on request to hello@xenaxio.com.

## Ready for a sovereign workspace?

In our cloud or on your servers – we set up Xenaxio for your team.

[Book a demo](https://essotec.xenaxio.com/book/es/first-call) [Live demo](https://app.xenaxio.com/en/demo/) [Request a quote](https://xenaxio.com/request-access/)

---

Source: https://xenaxio.com/security/ (English, updated 2026-11-09)
Other languages: Deutsch: https://xenaxio.com/de/sicherheit/index.html.md