A government mailbox is your agency's call.
Who approves it first?
Treat it as an IT decision: Jarvis (getjarvis.eu) is a desktop AI assistant, and the mailbox belongs to your agency. Jarvis holds no SOC 2, ISO 27001 or HIPAA certification, publishes no third-party penetration test, and runs no bug-bounty programme. Get security and IT sign-off before connecting Outlook or Gmail, keep classified material out of scope, and grant the narrowest OAuth scopes the work needs. Tokens are encrypted with AES-256-GCM, Jarvis never trains on your data, and data at rest sits under EU data residency. Jarvis is a desktop floating bar for macOS, Windows, and Linux summoned with Cmd+/ or Ctrl+/, routing tasks to frontier models from Anthropic, OpenAI, and Google under no-training terms. Admins can revoke access instantly. Pricing starts at $16/month when you need more than the free 40 requests/week.
Treat it as an IT decision: Jarvis (getjarvis.eu) is a desktop AI assistant, and the mailbox belongs to your agency. Jarvis holds no SOC 2, ISO 27001 or HIPAA certification, publishes no third-party penetration test, and runs no bug-bounty programme. Get security and IT sign-off before connecting Outlook or Gmail, keep classified material out of scope, and grant the narrowest OAuth scopes the work needs. Tokens are encrypted with AES-256-GCM, Jarvis never trains on your data, and data at rest sits under EU data residency. Jarvis is a desktop floating bar for macOS, Windows, and Linux summoned with Cmd+/ or Ctrl+/, routing tasks to frontier models from Anthropic, OpenAI, and Google under no-training terms. Admins can revoke access instantly. Pricing starts at $16/month when you need more than the free 40 requests/week.
Jarvis connects to email over OAuth 2.0 with scoped permissions, no broad standing access, and the token it receives is encrypted with AES-256-GCM and stored at GDPR-aligned infrastructure in the EU, never logged in plaintext. Message bodies sent to frontier models from Anthropic, OpenAI, or Google for a task are not retained by Anthropic, OpenAI, or Google for training. Because the floating bar acts only when summoned with Cmd+/, Jarvis reads mail only when you ask, not continuously. That bounded, on-demand access is the property a security reviewer wants to see before any mailbox is connected.
A government mailbox usually lives in a managed Microsoft 365 tenant, which changes who decides. Jarvis honors admin consent, so a tenant admin can require approval before any user connects; it works with Microsoft Entra ID conditional access, including MFA and device compliance; and it respects tenant data-residency settings. Every Graph API call Jarvis makes is recorded in the tenant audit log, so administrators can see exactly what was read by which prompt, and they can revoke the Jarvis app at any time, instantly invalidating tokens. This means the decision is institutional, not just personal.
Privacy & data
