---
title: "Security Manifesto"
description: "How Clam treats email access as borrowed power: narrow permissions, deterministic enforcement, minimal data and honest accountability."
route: /security
---

# Email access is borrowed power.

At Clam, we believe access to your email is borrowed power. It is never ours to exploit, expand, or quietly keep.

Your inbox holds the private machinery of your life: conversations, receipts, plans, relationships, work, and identity. Connecting an autonomous agent to it should not require surrendering control over all of it. Clam exists because useful autonomy and personal safety should not be opposing choices.

This is what we believe and what we commit to.

## Your agent should be autonomous. Clam should not be.

You choose an autonomous agent because you want it to act without waiting for you at every step. Clam does not replace that agent with another autonomous agent of our own.

Clam's agents cannot access your email. AI can help interpret and classify, but it does not hold the keys to your mailbox and it does not make the final access decision. Every request from your agent must pass through a deterministic policy boundary. That boundary is [Cedar](https://www.cedarpolicy.com/), the authorization language that powers [AWS Verified Permissions](https://aws.amazon.com/verified-permissions/). Clam evaluates it in-process on every [MCP](https://modelcontextprotocol.io/) call. If your rules do not allow an action, Clam denies it.

That separation matters. Intelligence can help understand intent. It must not be the final authority over access.

## The minimum access is the right access

Most email integrations begin by asking for everything. We begin by asking what this particular agent actually needs.

Each agent connects through its own [Shell](https://useclam.ai/#how-it-works), with its own purpose and its own rules. Permission for one agent does not become permission for every agent. Access does not silently grow because broader access would be convenient. You can pause or revoke a [Shell](https://useclam.ai/#how-it-works) without disconnecting the rest of your setup.

Least privilege is not an advanced setting in Clam. It is the product.

## Your inbox remains your inbox

Gmail remains the source of truth. Clam reads message content momentarily when needed to classify and govern a request, but stores no email content. We do not build a second archive of your mailbox.

We minimize what we handle, how long we handle it, and what an agent can receive. The safest sensitive data is the data a service never keeps.

We will not turn the private contents of your inbox into an advertising asset. We will not sell them. We will not use them to train general-purpose AI models.

## The platform is secured at every layer

Clam runs on [Railway](https://railway.com/). Inbound traffic is TLS 1.2 and TLS 1.3, with [Let's Encrypt](https://letsencrypt.org/) ECDSA certificates. Older SSL and TLS 1.0/1.1 are off. Data is encrypted in transit and at rest with AES-256. Services talk to each other on [Railway](https://railway.com/)'s private network, encrypted with [WireGuard](https://www.wireguard.com/), not over the public internet.

[Railway](https://railway.com/) is SOC 2 Type II and SOC 3 certified. Their audit reports are on the [Railway Trust Center](https://trust.railway.com/).

## Security is a release requirement

Security review is not a final checkbox after a feature is finished. Every feature must earn its release through exhaustive security testing. That includes attempts to misuse it, cross boundaries, escalate access, and fail in unexpected ways.

Traditional application security remains essential. Before public launch, Clam will undergo an independent penetration test. We commit to repeating independent penetration testing every three months, as well as reassessing controls when a material architectural change alters the risk.

Agent systems also create newer threats that traditional testing alone was not designed to catch: [prompt injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/), jailbreaks, and unauthorized tool use over [MCP](https://modelcontextprotocol.io/). At launch, Clam will operate active, real-time shielding against those attacks, including [llm-guard](https://github.com/protectai/llm-guard) scanners on untrusted input. We treat these layers as complementary: established security practice for the platform, agent-specific defense for the new attack surface, and deterministic [Cedar](https://www.cedarpolicy.com/) enforcement at the boundary to your email.

No single control is enough. We design for defense in depth.

## You should be able to see and stop what happens

Standing access without accountability is not control.

Clam records what your agent tried to do, what Clam allowed or denied, and which policy governed the decision. The [audit trail](https://useclam.ai/#security) is for you, not only for us. It should make an agent's behavior understandable rather than asking you to trust an invisible process.

You remain the authority. You can change the rules, pause access, or take it away. A security layer that cannot be overruled by the person it protects has misunderstood its role.

## We will speak plainly when something goes wrong

No honest security company can promise that failure is impossible. We can promise how we will behave if it happens.

We will move quickly to contain an incident. We will notify affected users promptly and in plain language, sharing what happened, what it means, what we have done, and what users should do next. When it is safe to do so, we will publish a postmortem and the changes that follow.

We will not bury material facts in vague legal language. Trust cannot survive concealment.

## Our standard is earned trust

We do not ask you to trust Clam because security appears in our name, because we display a badge, or because we say we take it seriously.

We ask to be judged by narrower access, less retained data, deterministic enforcement, visible decisions, adversarial testing, independent scrutiny, and honest accountability.

Your email is yours. Your agent works for you. Clam's job is to keep that relationship inside the boundaries you chose while continuing to earn the privilege of standing between them.

Ioannis, Stratos & Sokratis