It is safe when the assistant connects through OAuth so it never sees your password, encrypts your data, trains no model on it, and logs every action it takes. Sabi meets all four, keeps your data in the United States on SOC 2 compliant providers, and lets you revoke email access any time.
By Bruce van Zyl, co-founder of Sabi · Updated October 29, 2026
No. Gmail, Outlook and Microsoft 365 connect through OAuth: you sign in with Google or Microsoft once, and Sabi never sees your password. You can revoke that connection from inside Sabi or from Google.
Custom IMAP accounts such as Yahoo and AOL use an app password, and that password is encrypted in a vault. Sabi connects to Gmail, Outlook and Microsoft 365 through OAuth, so your email password is never typed into Sabi.
In the United States, encrypted in transit and at rest. Sabi runs on Supabase for the database and DigitalOcean for hosting; both are SOC 2 compliant, and each customer's data is kept separate.
One honest line on certification: Inovo Studios, the company behind Sabi, has begun a SOC 2 Type 2 program, and no report has been issued yet. Sabi stores customer data in the United States on Supabase and DigitalOcean, both SOC 2 compliant, encrypted in transit and at rest.
No. The AI providers that run Sabi are Anthropic for most replies, xAI through the Vercel AI Gateway for some specialist tasks, and OpenAI for search, voice transcription and images. Their terms do not allow training on your content.
Gateway requests go only to zero-data-retention providers, so a specialist task does not leave a copy behind. Sabi's AI providers are bound by terms that forbid training on your email, and gateway traffic goes only to zero-data-retention providers.
Staff look only when you ask for help, to fix a problem, or for the weekly product report, and every support and engineering access to your data is recorded in an access log.
That log is the difference between a policy and a record. At Sabi, every support or engineering access to customer data is written to an access log, and staff look only when you ask for help, to fix a problem, or for the weekly product report.
Not when you set an approval rule. The rule is a gate written in code, not a prompt the model tries to remember, and it stops Sabi from emailing or texting anyone until you approve each message. Without a rule, she sends what you ask her to send or schedule.
The gate applies to email and texts; Slack and Discord posts sit outside it for now. Sabi's approval rule is a gate in code that blocks every email until you approve it, which makes email access safe to grant before trust is built.
Free starter credits, no card, OAuth only, and an approval rule you set with one text before she sends a thing.
Yes, any time. Disconnect Gmail, Outlook or Microsoft 365 from inside Sabi, or revoke the connection from Google. No support ticket is needed.
No. The providers behind Sabi, Anthropic, xAI through the Vercel AI Gateway, and OpenAI, work under terms that do not allow training on your content, and gateway requests go only to zero-data-retention providers.
Not yet. Sabi's providers, Supabase and DigitalOcean, are SOC 2 compliant. Inovo Studios has begun its own SOC 2 Type 2 program and no report has been issued yet. Payments run through Stripe, which is PCI DSS Level 1.
It is removed from production right away, and backups roll off on the provider's standard schedule. You can download all your data from your account page first. Full details are at /security and /privacy.
Related: How Sabi protects your data · Is Meta Muse safe for business? · Sabi vs Muse: the secure alternative · Can I make an AI assistant ask before it sends an email?