Security

timetoreply is SOC 2 Type II compliant and ISO 27001 certified.

timetoreply uses email header data – including TO, FROM, CC, subject lines, message IDs and timestamps – to provide email response-time and performance analytics. When Smart is active for a mailbox, we also retrieve and store plain-text email bodies to generate Smart insights. Smart is enabled by default for new signups and can be disabled.

We store email metadata and, for mailboxes with Smart active, encrypted plain-text email bodies and Smart insights. Our main application servers are hosted in AWS in London. Dedicated private instances in other AWS regions are available on request. Smart inference remains within AWS, but may run in a different AWS region from your application instance.

Data is encrypted at rest and in transit. timetoreply holds ISO/IEC 27001:2022 certification and a SOC 2 Type II report covering the Security trust services category. We also undergo independent security testing, including assessment for Google’s OAuth app verification programme. Current assurance evidence is available through our Trust Center.

Yes, for Microsoft and Google customers, you can use your Microsoft and Google credentials to create an account and login to timetoreply.

Yes, data is encrypted at rest and in transit using AES-256 encryption (rest) and TLS (transit).

You can read up on the permissions we require for Microsoft and Google accounts to be linked by viewing our trust center.

Microsoft M365 mailboxes and Gmail Google Workspace mailboxes. We also cater for EWS (Exchange Web Services) for exchange mailboxes, but we recommend using M365 or Gmail.

Yes. Setup fee and minimum contract applies.

No, we use OAuth 2.0 to connect to M365 and Gmail mailboxes. If you choose to use our EWS connector, then we require username and password. We recommend using M365 or Gmail instead.

Yes, we have 4 levels of access users and you can control what permissions and data these users have in order to control what they can see and do within the dashboard.

You can revoke timetoreply’s mailbox access through Microsoft or Google’s permission controls. Revoking access stops future retrieval once the provider applies the change; it does not erase data already stored by timetoreply. Stopping collection, disabling Smart and requesting deletion are separate controls.

We do not analyse attachment content, send attachments to AI models, or retain attachments as application data.

No. Your email data is not used to train AI models. Smart inference remains within AWS. AWS may retain requests flagged by its automated abuse-detection systems, together with their responses, for up to 30 days. This AWS-held copy is separate from data stored by timetoreply and is not removed by the Smart delete control.

Yes. You can disable Smart in your account settings to stop Smart processing while retaining existing Smart data. The Smart delete control pauses Smart and immediately schedules background cleanup of stored Smart data. Deletion completes asynchronously.

Privacy Mode hides email bodies and Smart summaries in the interface. Other Smart metrics and features remain available. It does not stop Smart processing, redact stored content or delete data.