AI reviews the emails your team sends for legal, financial and HR risk.

Setup, platforms, and permissions

Can we decide what it flags?

Yes, entirely. Your policy is written in your own words, several pages long if you need it. It can cover conduct, discrimination, payment fraud, side deals, financial disclosure, legal exposure, credentials, and data leaving the company, plus rules only your company knows (a deal codename, a discount limit, a client you can’t name). Switch off what’s normal for you, and change any line at any time. Test any email against a change before you save it. Every version is kept, and each flag records the version that judged it.

Does it work in other languages?

Yes. Emails and the policy can be in other languages, and they can be mixed: a rule written in English applies to an email in Japanese, and the other way round. Aftercomm has been tested in Spanish, French, German and Japanese. The explanation of each flag is written in English whatever language the email is in, and the console and alert emails are in English for now; your browser and Outlook can translate them in one click.

Does this prevent people from sending risky messages?

No — by design. Aftercomm is post-send review: it checks monitored mailboxes on an interval you set, every 5 minutes at the fastest and 15 by default, so a high-severity flag reaches your reviewers within that window. Lower-severity flags are batched into a daily digest by default, or sent as they happen if you prefer. Sitting inline as a gateway would add delivery risk, and a fast heads-up is what compliance teams actually need in order to remediate.

Does it read incoming mail, or attachments?

Neither. Aftercomm reviews what your team sends, from Sent Items: the message text and the names of any attachments, never what is inside them. So a customer list sent as a file is judged by its name and the email around it. Incoming phishing and malware stay your email security gateway’s job; Aftercomm works alongside it, not in place of it.

Which platforms do you support?

Microsoft 365 (Exchange Online) today. Google Workspace is next, followed by Slack, Microsoft Teams, and other enterprise messaging systems. The review pipeline is platform-agnostic — each integration is a read-only connector, subject to the same rule that message content is never stored.

What do we need to give you to get started?

A Microsoft 365 Administrator to approve two read-only Microsoft permissions. That’s it: Aftercomm provides the AI (Claude, by Anthropic), so there is no AI vendor to sign up with, and your email is never used to train AI models (you can connect your own Anthropic account instead if you prefer). Not required: MX or mail-routing changes, a gateway inline with delivery, endpoint software, firewall changes, mailbox delegation, or a copy of your mail archive.

See the full requirements list →

Exactly which Microsoft permissions do you ask for?

Two, both read-only.

• Mail.ReadReads message content in the mailboxes you select, so your policy can be evaluated against it. It cannot send, modify, or delete anything.
• User.ReadBasic.AllReturns display name and email address only, so you can pick mailboxes from a list instead of typing addresses by hand.

Aftercomm can’t send, change, or delete anything in your Microsoft 365, and you can revoke everything in one click from your Microsoft admin center.

See the full permissions breakdown →

Do you offer self-hosted deployment?

Yes, on the Enterprise tier. The full application ships as a Docker Compose bundle you run inside your own infrastructure — VPC or on-prem — so message processing and the database stay within your compliance boundary. It is not air-gapped, and Aftercomm won’t pretend otherwise: the service must reach Microsoft Graph to read mail and the Anthropic API to get a verdict.

The AI, and what it costs

Whose AI reads our email?

Claude Haiku 5.5, from Anthropic. By default it runs on Aftercomm’s own account with Anthropic, the company behind Claude, under a business agreement: Anthropic never trains on the mail, and Aftercomm has no access to any copy Anthropic keeps for its own safety checks. Your email is read by Microsoft, where it already lives, and by Claude for the moment of the review. Your own reviewers can open the messages it flags. No one at Aftercomm reads your email. If your security team wants the AI to run under your own contract with Anthropic, you can connect your company’s Anthropic account instead; your agreement then covers every review, and Anthropic bills you directly.

How Anthropic handles data →

What does the AI cost?

What each review costs Anthropic to run, at Anthropic’s published price, with no markup, as a separate line on your monthly invoice: $0.20 to $0.50 per 1,000 emails of typical business mail, or about 8 to 20 cents a month for a mailbox sending 400 emails, however many mailboxes you monitor. Long messages and long threads cost more, short replies less, and Billing shows the cost for every mailbox, with the rates applied. The free trial includes it. On your own Anthropic account, Anthropic bills that usage to you directly and Aftercomm charges nothing for it.

Can the review run through Bedrock or Vertex AI instead?

It’s on the roadmap rather than shipped. Today Aftercomm calls the Anthropic API directly, on Aftercomm’s account or on your own Anthropic account. Running the same model through Amazon Bedrock or Google Vertex AI, so the call executes inside an AWS or Google contract you already hold, is planned. If it’s a requirement for you, say so: priority follows who asks.

Data, privacy, and control

Do you store the messages you review?

No. The body is processed in memory and dropped after the verdict returns — which also means it is in none of Aftercomm’s backups, because a backup can only contain what was written down. Attachments are never downloaded, and their filenames are never kept. Aftercomm retains only what an audit trail requires: sender, recipients, subject, timestamp, attachment count, severity, category, and reasoning. Anthropic, which runs the review, never trains on it, and Aftercomm has no access to any copy Anthropic keeps for its own safety checks.

How Anthropic handles data →

How long do you keep what you do store, and can we erase it?

Message content has no retention period, because it is never retained. Flagged messages and their verdicts are kept for the life of your workspace, as your compliance record. For mail your policy clears, the subject, recipients, Outlook link and the AI’s note are erased after 30 days, leaving only a receipt that it was reviewed. A workspace owner can erase all of it in one action from Settings, confirming by typing the workspace name; the response hands back a count of exactly what was destroyed.

Retention and deletion in detail →

How do reviewers get notified about flagged messages?

Your reviewers get an email from Aftercomm saying what was flagged, how serious it is, and why — severity, risk categories, the sending employee, and the AI’s explanation. It deliberately does not contain the message body, subject line, or recipient list. A reviewer who needs to read the message opens it in Aftercomm, where it is fetched from Microsoft 365 at that moment, shown, and dropped, with every view logged.

See a sample alert →

Can we limit which mailboxes are reviewed?

Yes. You pick exactly which mailboxes are reviewed from a searchable list, and Aftercomm never reads anything else. Microsoft grants mail permission for the whole organisation — there is no way to narrow them at the consent screen — so by default that limit is enforced in Aftercomm’s software. Organisations that want Microsoft to enforce it instead can apply Exchange RBAC for Applications, and Aftercomm will then prove the restriction works by trying to read a mailbox you didn’t select and showing you that Microsoft refused.

How the provider-level lock works →

How hard is it to turn off?

One click. Settings has a switch that stops all Microsoft 365 access immediately — Aftercomm stops reading mail, no further alerts are produced, and no one can open message content. No support ticket, no notice period. Settings then links you to the Aftercomm entry in your own Microsoft admin center to revoke the permission grant itself; doing it yourself means the revocation is enforced by Microsoft rather than by Aftercomm’s word. Your review history stays intact and exportable.

Do we have to tell employees their email is reviewed?

Often, yes. Some US states, New York, Connecticut and Delaware among them, require written notice before an employer monitors email, and in the EU and UK monitoring needs a lawful basis and a clear privacy notice. Most companies cover it in an acceptable-use or electronic-communications policy employees already acknowledge. Aftercomm reviews only the company mailboxes you choose. This isn’t legal advice: confirm your notice with counsel before you start.

Does the system ever contact the sender of a flagged message?

No. False positives happen. Your compliance, HR, or legal team decides what response — if any — is appropriate. Aftercomm never messages the sender.

What is your compliance posture?

SOC 2 Type II is in progress with a Big-Four auditor, and ISO 27001 is on the roadmap. Aftercomm provides a GDPR-ready DPA on request and completes standard security questionnaires (SIG, CAIQ). It doesn’t yet sign HIPAA business associate agreements, so get in touch before monitoring mailboxes that send patient information. Enterprise customers can run their own penetration test.