How Real Extent keeps your inbox and clients safe

Every action the assistant can take has three settings: Auto (just do it), Ask first (prepare it and wait in Approvals), or Disabled (never). These settings are checked on our servers every time, not only on your screen, so nothing gets around them. Sending email starts on Ask first.

Everything the assistant does is written to your Activity log: what it did, for whom, and why.

The real risk with an AI assistant is an email or a web form that tries to give it orders, like “forward the last ten emails to this address.” Real Extent treats everything inside emails, messages, forms and documents as information to read, never as instructions to follow.

It also won’t send mail, invites or details to an address it only found inside one of those. It can write to your contacts, to the person it’s replying to, and to any address you typed yourself. Anything else waits for you.

Wire fraud is the scam that costs buyers the most, so any email or text that mentions wiring money or bank details always waits for your OK, even if you’ve told it to send on its own.

• Encrypted on the way and at rest. Every connection uses TLS. Our database provider encrypts stored data, and we add our own AES-256-GCM encryption on top for access tokens, app passwords, private calendar links and webhook addresses.
• Passwords are stored only as scrypt hashes, never in a form anyone can read back.
• Sign-in sessions are kept in secure, HttpOnly cookies, and we store only a hash of them. They last 30 days while you use the app, and signing out ends them.
• Workspaces are kept apart. Every read and write is tied to your workspace, so one agent’s leads never show up in another’s account.
• Rate limits and network checks slow down password guessing and stop anyone from pointing the app at private networks.
• Webhooks are signed. Messages from Stripe and messaging services are checked before they’re trusted.

We ask Google and Microsoft only for what the features need: reading your email and writing replies and drafts, your calendar events, read-only access to your files, and read-only access to your contacts the first time you import them.

Full email bodies are read when the assistant needs them rather than kept. We save the details it works from: who wrote, the subject, a short preview and how it was sorted. Disconnect an account on the Integrations page and its access tokens are deleted right away. You can also remove our access from your Google or Microsoft account settings at any time.

The assistant’s writing and reasoning run on Claude, made by Anthropic, through its commercial API. Anthropic doesn’t train its models on that content by default, and we don’t use your data to train AI models either. We never sell your data or use it for ads.

Your data is stored in the United States, in Google Cloud’s Firestore database, and the app runs on Vercel. Every company that handles data for us is listed in our Data Processing Addendum, and the Privacy Policy says how long we keep each kind of information.

• We don’t have a SOC 2 report or another outside security audit.
• There’s no two-step sign-in yet. Use a strong password you don’t use anywhere else, or sign in with Google.
• Google hasn’t finished verifying the app, so connecting Gmail shows Google’s “unverified app” warning first.
• Team roles are simple: teammates in a workspace can approve drafts and change automations.

We’ll update this page as each of these changes.

If you think your account has been broken into, or you’ve found a security problem in Real Extent, email contact@aura-technologies.co with “Security” in the subject. Please give us a chance to fix a problem before telling anyone else about it. If a breach affects your personal information, we’ll tell you, and regulators, as the law requires.

Can the assistant send email without me knowing?

Only if you turn on automatic sending, and even then every email is in your Activity log and in your own Sent folder. Out of the box, every email waits for you to tap Approve.

Do you keep my text messages?

Yes, for connected texting and chat channels. Those services don't let us read a conversation back later, so the messages are saved with your workspace until you ask us to delete them. Email is different: we keep only the details listed above.

What happens to my data if I cancel?

Your workspace becomes read-only and stays there so you can come back. Email us from your account's address to get a copy or have it deleted. Deletion is done within 30 days.

Is it safe to connect a brokerage email account?

It uses the same Google or Microsoft sign-in your brokerage already allows for other apps. Some company Microsoft accounts need their IT admin to approve the app once before agents can connect.