Security, for IT teams

Last updated October 22, 2026

If someone at your company asked to use Lowtide, this page is for you: what it asks for, where data lives, who processes it, and what isn’t in place yet. The privacy policy has the full detail of what’s read and why.

How it works

• A Mac app, one person at a time. Lowtide runs on the person’s Mac (macOS 26 or later) and reads their own accounts with their own sign-ins. There’s no shared inbox, no team workspace and no admin console yet.
• Mail, calendar and messages stay on the Mac. What Lowtide keeps is in ~/Library/Application Support/Lowtide/, encrypted with AES-GCM under a key in the macOS Keychain. Sign-ins and keys are in the Keychain.
• To sort a message or write a draft, its text goes to OpenAI (or, for drafts, Anthropic with the person’s own key): directly from the Mac with their own key, or through Lowtide’s server, which passes it on and doesn’t keep or log the text. Lowtide asks OpenAI not to store drafts.
• With a Lowtide account, the list Lowtide makes (without anyone’s words), what it learned and the person’s settings are kept, encrypted, on Lowtide’s server, so they follow the person to another Mac. Connection sign-ins are kept there too only if the person leaves “Keep connections in your account” on, encrypted with a key kept apart from the database.
• Nothing is sent without the person. Replies go out only when they press Send, with an 8-second Undo. Lowtide never deletes, archives or relabels mail.

What it asks permission for

• Google: gmail.readonly (read mail), gmail.send (send the replies the person sends) and calendar.events (read events, answer invitations, and add a private hold when they ask). Lowtide’s Google app hasn’t completed Google’s verification yet, so sign-in shows Google’s “unverified app” screen. Workspace admins can see and control it under Security → Access and data control → API controls.
• Slack: each person creates a Slack app in your workspace from Lowtide’s manifest, so your admins see a request per person. It uses a user token with im:history, im:read, mpim:history, channels:history, groups:history, channels:read, groups:read, users:read, users:read.email and chat:write, and connects over Socket Mode, so there’s no public URL. It acts on direct messages and on messages that mention the person.
• GitHub: Lowtide’s GitHub App, with read-only access to pull requests in the repositories the person chooses (your organization may need to approve it), or a fine-grained read-only token.
• Linear: a personal API key, to read the person’s notifications; it writes only when they choose Add to Linear.
• Claude Code and Codex: hooks in the person’s own settings files that talk to Lowtide on 127.0.0.1 only, with a per-install token. The previous file is saved alongside before any change.

Who processes data

• Cloudflare: hosts trylowtide.app and Lowtide’s server, and counts site visits without cookies.
• Supabase (United States): Lowtide’s database and account sign-in.
• OpenAI: sorting and drafts, through Lowtide’s server or with the person’s own key.
• Anthropic: drafts, only with the person’s own key, sent directly from the Mac.

Google, Slack, GitHub, Linear and Granola are the person’s own accounts, read with their own sign-ins.

The app itself

• Signed with an Apple Developer ID and notarized by Apple.
• Updates are signed and checked before they install, from trylowtide.app/appcast.xml.
• Settings → Accounts → Your data exports everything Lowtide keeps about the person, or deletes all of it: their Lowtide account, its access at Google and Granola, the agent hooks, and everything on the Mac.

Settings you can set with MDM

A configuration profile for the preferences domain dev.lowtide.app can set these, and the person can’t change them in Lowtide’s Settings, which says they’re set by your organization:

• HostedAI (false): no AI through Lowtide’s server; only a key of the person’s own, or none.
• KeepConnectionsInAccount (false): connection sign-ins stay on the Mac, not in the Lowtide account.
• SlackWhenAway (false): coding agents’ approvals and questions are never asked in Slack.
• AgentsReadList (false): coding agents can’t read the person’s list or day.
• Updates follow the updater’s own keys in the same domain: SUEnableAutomaticChecks and SUAutomaticallyUpdate.

Not in place yet

Lowtide is in early access, built by a small team. It doesn’t have a SOC 2 report, Google’s verification and security assessment, single sign-on, an admin console, a .pkg installer, or data hosted outside the United States. If any of these decides it for you, tell us which; it shapes what comes first.

Contact

For a security question or a report, reply to any email from us, or send the early-access form with your question in the note.