Banger is an email system that you and your AI agents operate through the web app, the API, and the MCP server. It runs mailboxes on your domain, product email from your software, and Broadcasts and Journeys to your contacts. This page describes what Banger stores, where it lives, who can read it, and what leaves Banger's systems.
Where your mail lives
Mail, contacts, and content live in Banger's cloud: message records and search in a PlanetScale Postgres database hosted on AWS in the United States, and raw messages, attachments, and files in Backblaze B2 storage in the United States. When you connect a Gmail account, Google stays the source of truth and Banger keeps a copy so it can show, search, and act on your mail.
Encryption and access
All traffic to and from Banger uses TLS 1.2 or higher, and stored data is encrypted at rest by the providers that hold it. The most sensitive secrets get an extra layer: Google refresh tokens, connected provider keys, and your own AI keys are envelope-encrypted with AES-256-GCM before they are stored, and DKIM signing keys are stored encrypted. Each workspace's data is separated with database-level access controls, and every agent and API key is limited to the permissions you grant.
Like a password manager, Banger manages these keys for you, so you do not have to hold or back up key material yourself. The trade-off of managed keys is that Banger, unlike a strictly end-to-end encrypted system, can technically read stored mail. Mail is processed in readable form on Banger's servers so it can be searched, filtered, triaged, displayed, and delivered. Access to production data is limited to the people who run the service, and sign-in, agent, and administrative actions are recorded in audit logs.
What Banger asks Google for
When you connect a Gmail account, Banger requests your basic account identity and two mail permissions: read your mail and send on your behalf. Banger does not request permission to modify or delete your mail. Labels and other changes you make in Banger stay in Banger.
Independent security assessment
Banger Mail has completed a CASA Tier 2 assessment. CASA, the Cloud Application
Security Assessment run under Google's App Defense Alliance, is the security review
Google requires for applications that access restricted Gmail data. Tier 2 is an
independent verification performed by an authorized third-party assessor against the
OWASP Application Security Verification Standard, covering how an application protects
credentials, user data, and access. Because Banger reads your mail under Google's
restricted scopes, it is assessed to this standard.
Search
Search runs on Banger's servers, against a full-text index of your mail in Banger's database. It is available only to your workspace and the agents you authorize.
AI features
Banger uses AI for specific jobs and sends each provider only what that job needs. OpenAI designs and revises emails you ask for, answers questions about your mail in the mail assistant, reads your public website to suggest your brand during setup, and translates templates. TypeSafe runs Labels & Triage on incoming mail in mailboxes where you have enabled rules, with some personal details removed first, and suggests column mappings when you import contacts. The mail assistant's run history is deleted after one hour.
You can also connect your own OpenAI or Anthropic key, and any AI agent you connect through MCP reads data under your own agreement with its provider. Banger does not sell your data and does not use your mail to train AI models.
Spam protection
Outgoing mail passes a spam filter before it is sent. Broadcasts and Journeys always carry one-click unsubscribe, and unsubscribes, hard bounces, and spam complaints are suppressed across your workspace automatically. See the Acceptable Use & Anti-Spam Policy.
Analytics
Banger's product analytics use pseudonymous identifiers and never receive your mail content or email address. Sensitive fields are removed before any event leaves Banger's servers.
Transport
Mail and app traffic move over TLS 1.2 or higher. Outbound mail from domains set up with Banger is DKIM-signed.
Deleting your data
Deleting your account starts a seven-day window during which you can cancel. After it, Banger deletes your workspace's database records and stored files, keeping only minimal records needed for security, billing, and legal reasons. To revoke Banger's access to a connected Google account, remove Banger at myaccount.google.com/permissions.
Subprocessors
Banger uses the following providers to operate the service:
- Cloudflare: application hosting, queues, logs, bot protection, and DNS lookups
- PlanetScale: primary database, hosted on AWS in the United States
- Backblaze B2: mail, attachment, and file storage in the United States
- Amazon Web Services: email sending (Amazon SES) and secrets storage, in the EU (Frankfurt)
- Hetzner: mail receiving and sending servers, spam and malware filtering, logs and monitoring
- Google: Gmail connection for mailboxes you link
- OpenAI: email design, mail assistant, brand discovery, and translation
- TypeSafe: Labels & Triage and contact import mapping
- Stripe: billing and payments
- PostHog: product analytics (US), pseudonymous identifiers, no mail content or email addresses
- Linear and Slack: support and feedback messages you send us
More detail
For the full terms, see our Privacy Policy and Acceptable Use & Anti-Spam Policy. To report a security issue, see our Vulnerability Disclosure Policy.