What we collect, where it goes, and how long it stays. This page covers the hosted e2a service operated by Mnexa, Inc. — the dashboard at e2a.dev, the API at api.e2a.dev, the MCP server at api.e2a.dev/mcp, and the mail path (agents.e2a.dev, mx.e2a.dev, send.e2a.dev).
Last updated 2026-08-11.
Everything below lives in one managed PostgreSQL database. e2a does not use a separate object store — attachment bytes are stored inline with the message row.
Message-ID, In-Reply-To,
References) that hold a conversation together.
We run a self-hosted Umami instance at
umami.tokencanopy.com to understand aggregate traffic to known
public marketing pages on e2a.dev, including the pricing page.
It is cookieless, does not run advertising or session replay, and does not
track visitors across websites. The signed-in dashboard, OAuth consent
page, privacy page, and unknown routes are excluded.
For a public page view, Umami receives the page path and title without URL query strings or fragments, a reduced referrer, browser language and screen size, browser/operating-system/device categories, and approximate location (country or region derived from the request IP). Umami uses the IP address and user agent to create an anonymous session identifier; it does not store the raw IP address or set a browser cookie. We use these records only to measure page traffic and improve public content. They live in a separate Google Cloud PostgreSQL database in the United States and are not joined to e2a accounts, agents, or messages.
The application and its database run on Google Cloud infrastructure in the
United States (us-central1): a Compute Engine VM and a managed
Cloud SQL for PostgreSQL 16 instance. The application connects to the
database over TLS. Traffic to our domains passes through Cloudflare, which
terminates TLS at the edge and sees standard connection metadata.
Email is a federated protocol, so some of your content necessarily leaves our systems — that is what sending mail means.
us-east-2), which processes the full
message in order to deliver it, and then on to the recipient's mail
provider. Mail is DKIM-signed — on your own domain once you have verified
it, otherwise on our shared relay domain.
Mail arriving for your agents is screened before it is delivered, so that a hostile message cannot quietly become instructions your agent follows. Flagged or blocked mail is quarantined — stored, but not served to your agents. We record the disposition of each flagged message and the reason for it.
Today that screening is entirely deterministic — pattern and heuristic checks that run inside our own systems. No message content leaves for model inference, because the model-based detector that exists in the open-source code is not enabled on the hosted service.
When we enable model-based screening, it will use Google Gemini. At that point the content of inbound messages will be sent to Google's Gemini API for the screening check itself — not for any other purpose, and never for outbound mail. We will use the paid Gemini API tier, under which Google's API terms state that Google does not use prompts or responses to improve its products and does not subject them to human review for that purpose; Google's handling is otherwise governed by the Google Privacy Policy. We will add Gemini to the sub-processor list and revise the date on this page before the change takes effect.
e2a exists to be driven by agents, so it is worth being precise about which direction content flows.
e2a does not send your mail to an AI model. You do. When you connect an AI client — Claude through our MCP server, or your own agent through the API or an SDK — that client reads the messages it asks for. What happens to the content after that is governed by the terms and privacy policy of the client you connected, not by this page.
These are the third parties that process data on our behalf:
| Provider | Location | What it processes |
|---|---|---|
| Google Cloud | US | Application hosting, database, and log storage — all stored data. |
| Amazon Web Services (SES / SNS) | US | Outbound mail relay and delivery-feedback events. |
| Cloudflare | US | DNS, CDN, and edge TLS — connection metadata. |
| Stripe | US | Payments for paid plans. Checkout is hosted by Stripe; we never receive or store card numbers. We store only your Stripe customer and subscription identifiers. |
| WorkOS | US | Sign-in, if you use a Token Canopy account. See tokencanopy.com/privacy. |
| GitHub | US | Only if you submit in-product feedback — see below. |
| Google Gemini (not currently enabled) | US | Inbound message content, for model-based screening only, if and when we enable it — see Inbound screening. |
Business customers who need a signed Data Processing Agreement can request one at the contact below.
If you use the in-product feedback form, your submission is filed as an issue in our public GitHub repository and emailed to our support inbox. Do not put anything confidential in it.
permanent=true.
Both are self-serve, and both are complete:
GET /v1/account/export returns a
single machine-readable JSON document containing your user record,
domains, agents, API key metadata, messages (including attachments),
suppressions, screening events, usage records, and OAuth connections.
API key plaintexts are never stored and cannot appear in it; session and
OAuth tokens are excluded as credential material.
DELETE /v1/account?confirm=DELETE permanently deletes your
account and cascades to everything it owns, returning a receipt with
per-table row counts. This is irreversible and does not wait out the
trash window.
Deleting your e2a account does not by itself delete a Token Canopy account you used to sign in with; that layer is covered by tokencanopy.com/privacy. If you would rather we ran a deletion for you, email us.
Mnexa, Inc. is the data controller for your e2a account. Where your agents exchange mail with other people, you are the controller of that correspondence and we process it on your behalf. If you are in the European Economic Area, the United Kingdom, or Switzerland, the GDPR / UK GDPR gives you the rights below; we honour them for all users regardless of location.
You may exercise the rights of access, rectification, erasure, restriction, portability, and objection, and you may lodge a complaint with your local supervisory authority. Access and erasure are available immediately through the two endpoints above; for anything else, email us. We respond within 30 days. We do not use personal data for automated decision-making with legal effects.
Our infrastructure and sub-processors are in the United States, so your data is transferred to and stored in the US. Where that involves EEA/UK personal data, the transfer relies on the EU-U.S. / UK Data Privacy Framework certifications of our sub-processors and/or the European Commission's Standard Contractual Clauses.
e2a is a developer tool and is not directed at children. You must be 13 or older to hold an account.
We will update this page when the data flow changes, and revise the date at the top. For a change that materially expands what we collect or who receives it, we will give notice before it takes effect.
Questions, data-export or deletion requests, DPA requests, or anything else privacy-related: [email protected]. Security reports: [email protected] — please give us a chance to fix an issue before disclosing it.