This page is our own answer. We’re writing it in September because engagement letters go out in December, and what a letter says is fixed for the season. Everything below points at a document you can read. Where our plain-language version and the document differ, the document binds.
- Point reads client mail. That’s what it’s for, and the rest of this page holds to that. What the page covers is what happens to that mail afterwards.
- Two documents sit underneath all of it, public, versioned and dated: privacy and subprocessors. Both are version 1.0, both effective July 7, 2026. The binding version of most of it is in the terms.
- We don’t sell your mail. We don’t use it to train generalized AI models unless you authorize that, and it stays out of the advertising pipeline. We do run advertising technology on our public marketing pages, and the policy keeps those two things apart by name.
- Tax-return information sits outside what our standard service covers. It’s a named exclusion in our own terms. For a tax practice, that’s a question to raise before you connect a mailbox, while the season is still ahead of you.
- We hold no security certification, and there’s no badge on this site. What we have is two dated documents, a log of what the software did, and four things you can test yourself in a first week.
What we hold, and what we made from it
Point runs on top of the mailbox your firm already keeps, on Google or on Microsoft. Your archive stays where it is. The copies described here are additions to it.
Three kinds of thing sit on our side. Most firms think of the first one.
The correspondence itself. Messages, threads, senders and recipients, headers, attachments, folders and labels, calendar events and availability, and the contacts around them. The grant you made at your provider covers all of it. That grant is also why no password of yours sits anywhere in our systems. Where the key is held, and where the off switch sits, is where your email credentials are kept.
What the software made from it. Summaries, and the tasks lifted out of a thread with the date the client named. Ranking signals, generated titles, and a search index built from numeric representations of your text, so search works by meaning instead of spelling. This part decides most of the answers below, because it’s what the product runs on. Our subprocessor list lists indexes, embeddings, summaries and outputs beside the content they came from. That’s what lets you ask a deletion question about them and get an answer.
Excerpts on somebody else’s infrastructure. Making any of that means sending pieces of your mail to a model provider. Amazon Web Services hosts the service. Anthropic and OpenAI do the language-model processing, and OpenAI also handles voice when you use voice mode. Google’s Generative AI API produces the embeddings behind semantic search. Firebase Cloud Messaging delivers push notifications, and a payload can carry a snippet of a message. Resend sends transactional mail. Stripe handles billing. Cloudflare serves the marketing site you’re reading. Every one of them is on the list with its role and the data it touches. The list carries a version and an effective date, so you can compare it against the copy you kept.
Google and Microsoft sit in a different column on that list. For Gmail, Outlook, Calendar and sign-in they’re your providers, acting on the authorization you gave, under the terms you already have with them.
One case sits outside all of this. Lock a message end to end and only its recipient can open it. That includes us. Nothing goes to a model provider, nothing is derived from it, and there’s no third-party copy for this note to describe. The cost is the plain one. A message we can’t read stays out of ranking, summaries and tasks. It suits the handful of messages a year that warrant it, and the rest of the practice runs the way it runs. What actually needs sealing is worked through in using an AI inbox without breaking confidentiality.
Who can read it
Four different sets of people, and the first question usually lands on the wrong one.
People here. Some of us can, in defined circumstances. Our privacy policy at section 6.8 limits human access to support you asked for, security and abuse investigation, legal compliance, troubleshooting, service operation, and cases where you’ve consented. A supplier who tells you no employee can ever see anything has either not thought about how support works, or has described a product nobody can fix when it breaks. You can test this one in your first week. Raise a ticket about a real thread and watch what the reply turns out to know.
The model providers. They receive excerpts, under business terms with no-training controls where those controls exist. They may also process prompts, outputs, logs and telemetry for safety, abuse prevention and reliability. That happens under their terms, and our data processing addendum says so at section 7.2. It’s the copy furthest from anything your firm controls, and a no-training answer usually passes over it.
Your own people. Your team joins with a seat each, and a seat sees the mailbox it’s connected to. Here is the one place a wrong idea costs something, so it’s worth stating flatly. Point doesn’t draw a wall between one of your clients and another inside a single mailbox. The isolation Point holds is between separate businesses you operate. Keeping one business isolated from another sets out exactly what it holds and the four places it stops.
Whoever administers your workspace. If you use Point through an organization, admins can access, manage, export, delete and restrict what’s in it. Your organization’s own policies apply on top of ours. Section 16 of the policy says so. In a five-person firm that’s usually the owner, and it stays quiet until the day somebody leaves.
A fifth party is worth naming, because here the answer is none. A message from a sender Point has never seen is set aside before anything reads it for meaning. That’s what stops an unknown correspondent from giving your inbox instructions simply by writing to you. Prompt-injection defenses and quarantine workflows are named in the security section of the policy. What Point did with a held message is a line in the activity log.
How long any of it stays
Retention decides more than any other clause on this page. A copy that was never kept can’t be misused, trained on or handed over later. The full table is section 10 of the policy. Here are the rows a practice cares about.
Correspondence in an active account is kept while the account is active. You or your settings can delete it sooner. Deleted content comes out of active systems within a reasonable period, and backups may hold it until they’re overwritten on their normal cycle.
Derived material generally lives as long as the content it came from. That’s the row firms skip, and it’s the one that decides whether a deletion reaches the summary and the index entry as well as the message. Ours is written down where you can read it.
The connection to your mailbox lasts until the account is disconnected or the authorization expires. That switch sits at Google or Microsoft as well as here. You can end our access on your own.
On termination, our addendum commits to deleting or returning your data within 60 days, at your choice, where the service supports that and your agreement specifies it. Read the condition as closely as the number. Backups may be held until they’re overwritten. Billing and tax records are kept as long as tax and accounting law requires, often seven years, and those are invoices rather than correspondence.
Security, fraud and system logs are kept as long as they’re needed to protect the service. That’s the ordinary answer in this category, and it’s genuinely open-ended. We’d rather say so than gloss it.
What we do not do with it
Three commitments. Each one is narrower than the slogan version, and each one points at a paragraph.
We don’t sell it. Section 6.2 of the policy says so. The state-privacy terms in the addendum repeat it as an obligation we carry as your processor, and that’s the version that binds.
We don’t use it to train generalized models unless you authorize it. The exact wording is section 6.5 of the policy and section 6.8 of the terms, and the contractual one is the terms. The word carrying the load is generalized. What sits outside it is us making this product better for your firm, and that’s where nearly all of your mail actually goes. Ranking that learns which senders you open. An index that fills with your own correspondence. Prompts rewritten after somebody watched a thread go wrong. Every commitment in this category has that shape. How to read one, ours included, is keeping client data out of AI model training, which quotes the sentence and takes it apart properly.
It stays out of the advertising pipeline, and we run advertising. Both halves are true, and the combination is the part worth stating. Our public marketing pages use Google advertising and measurement technology, so a visit to this page is measurable. Customer content, connected email and calendar content, attachments, prompts, outputs, search indexes, embeddings, summaries and access tokens are excluded from all of that by name. Sections 6.3, 6.4 and 6.6 of the policy do the excluding, and the Google API data is held to Google’s own Limited Use rules. A firm that found the analytics script on this site and wondered has asked a fair question, and the answer is a paragraph in a document.
One more, and this one is a fact about how the product is built. Our terms at section 6.7 reserve the ability to change models, embedding models, model providers and infrastructure providers. Every product in this category holds that right, and has to. A service frozen to one provider would be a worse service inside a year. It’s also why the subprocessor list carries a version and a date. The durable half of the answer is the conduct commitment. The half that names a company is a fact you should be able to watch change.
The mail our standard service does not cover
If you prepare returns, read this section before the others.
Section 5.1 of the terms says our standard service isn’t designed, priced or offered as a regulated-data service. It then names what takes a separate written supplement we’ve accepted before it goes through. Tax-return information is on that list. So are protected health information under HIPAA, payment-card data, biometric data, children’s data, and other categories under specialized statutory or professional-secrecy rules.
For most professional-services firms that exclusion never comes up. For a tax practice it’s the whole question. A firm mailbox in February carries return information by definition. The document that covers it is an IRC 7216 addendum, and our terms list it among the supplements that may be offered where we support the use case. Whether it’s available for your firm and your season is a question to put to us before you connect a mailbox. If the answer is not yet, the standard service is the wrong home for that mailbox this year. October is a better month to learn that than April.
Section 7216 asks the same of you as a preparer either way. That obligation is yours, and it stays with you when you hand work to a supplier. Where the profession’s existing rules already speak to handing work to an outside party is AI and the CPA Code of Professional Conduct.
What we have not earned yet
There’s no SOC 2 report, no ISO certificate and no trust badge on this site. One goes up when we hold a certification with a dated report behind it. An unearned badge is a false claim, and a firm that accepted one would be relying on something that doesn’t exist.
That’s less than a mature vendor offers, so here is exactly what does exist. Two public documents carrying versions and effective dates. A terms document with the data processing addendum inside it, holding the deletion window, the subprocessor-change clause and the training position in its contractual form. A list of the companies that touch your mail, dated so you can diff it. And a log of what the software did on your behalf, which is the one answer here you can check every working day.
Four things you can test yourself, and all four fit inside a first week. Ask for your data back and open what arrives. Remove a seat and confirm what that person can still reach. Raise a support ticket about a real thread and watch what the reply knows. Keep a copy of the subprocessor list and compare it in six months. How to grade any vendor’s answers, ours included, is questions to ask any AI tool about your data, and it applies to this page as much as to anybody else’s.
Two limits we’re going to state plainly. Our own security section says no method of transmission, storage or processing is completely secure, which is true of us and of everyone else in this category. Point is in private beta and priced per seat, so there’s no published price, tier or trial length to put in a procurement file. If your process needs a certificate and a number today, we don’t have either, and waiting is a fair call.
What a December letter can carry
Engagement letters are why this note carries a date. A letter is a contract for services. That makes it a sound place to record how the practice operates and where responsibility sits, and a weak place to seek anybody’s permission. For a 1040 client, a permission written into the letter is empty as consent. The reasons are set out in what to put in your engagement letter about AI, and it’s a November decision rather than a December one.
What we can hand whoever drafts it is three sentences you can check against the documents above. A model reads the correspondence, because that’s how the software works. Under the agreement it isn’t used to build the generalized models other people query, and the AI providers run with training turned off wherever that control exists. It’s used to run and improve the service for your firm, it’s kept for the periods in section 10, and here is the dated list of companies that touch it.
One sentence to keep well away from a client: their information is never seen by AI. It’s untrue of any product in this category, ours included. And it fails in the worst way available, because the client finds out instead of being told.
The parts that stay with you
Four decisions sit with you, and together they set more of your exposure than anything in our terms does.
Who connects a mailbox. Usually fewer people than the first answer, and it’s worth settling now, while it’s a small question.
How far Point goes. Each kind of work carries its own setting, from suggest-only, through preparing something and waiting on you, to handling it. Every kind starts on review. At the top of a setting, Point acts without pausing for you, and that’s the whole reason to move one up there. Where you leave those settings decides which of our answers still cover you. That decision is worked through in setting how much your inbox does on its own. Everything Point did is timestamped in the log, and most of it can be put back. A message already delivered is the exception. It sits on somebody else’s server, out of reach of any product’s undo.
Who may accept terms for the practice. Our training commitment has your own authorization written into it as the exception. The realistic route from a small firm into a training corpus is one person agreeing to something on a Tuesday. A consent screen in a research program. A helpful toggle in an unrelated tool. A K-1 pasted into a free summarizer at eleven at night in March. All of those sit outside every document on this page. The version of a policy a four-person firm will actually follow is a simple AI policy.
Whether to do any of this now. The conversation about software reading client mail takes the time it takes, and February is the worst month to find that out. That’s the seasonal case made in getting ready for the 2027 tax season. If your firm hasn’t had it yet, that’s the work, and it happens off this page.
Everything Point does, written out in full, is on the benefits page. The same ground in a practice’s language is Point for accountants. And Point is the shortest version there is.
Common questions
Does Point read our clients’ email?
Yes. Ranking a pile takes reading it. So does summarizing a thread, pulling an ask out of the fourth paragraph, and finding something by what you remember about it. Every version of this product reads the mail. The question worth asking next is what persists afterwards, and that’s the retention section above rather than the training one.
Is our mail used to train AI?
Not for generalized third-party or foundation models, unless you expressly authorize it, and the AI providers run with no-training controls where those controls exist. Your content is used to run and improve the service for your firm. That covers ranking that learns your senders, an index that fills with your own correspondence, and prompts rewritten after a failure. Those are two different sentences because they’re two different things. The full anatomy of that distinction is in keeping client data out of AI model training.
Can somebody at Point read one of our threads?
In defined circumstances, yes. Support you asked for, a security or abuse investigation, legal compliance, troubleshooting and service operation, or with your consent. That’s section 6.8 of the privacy policy. A supplier claiming no human can ever reach customer content is describing either a product without support or a sentence nobody checked. You can test ours cheaply. Raise a ticket about a real thread and read what comes back.
What happens to everything if we stop using Point?
Disconnecting ends our access, and the switch sits at Google or Microsoft as well as here. Your address, archive and contacts stayed where they were, so there’s nothing to migrate back. On termination our addendum commits to deleting or returning your data within 60 days at your choice, where that’s supported and specified in your agreement. Backups may hold copies until they’re overwritten on their normal cycle. Derived material such as summaries and index entries is kept while the content it came from is kept.
We prepare returns. Can we connect the firm mailbox?
Ask us before you do. Tax-return information is a named exclusion from our standard service in section 5.1 of the terms. Bringing it inside takes a separate written supplement rather than a setting or an assurance. For a tax practice that’s a real constraint rather than boilerplate, since a firm mailbox in season carries return information as a matter of course. It’s a better question for October than for the first week of April.
Do you have SOC 2?
No, and there’s no badge on this site claiming otherwise. A badge goes up when we hold the certification and have a dated report to hand over. What we can give you today is the documents, dated and versioned, and a short list of things you can verify yourself inside a trial. If your process requires a certification report before anything gets connected, waiting is the right answer.
Does Point keep one client’s mail separate from another’s?
Not client by client. The isolation Point holds is between separate businesses you operate, so what sits inside one stays inside it. Within a single practice mailbox, a seat sees the mailbox. Inside a firm, reading used to be limited by how long a thread was. What that changes about confidentiality is using an AI inbox without breaking confidentiality.
The short version
Point reads client mail, because that’s the product, and this note is about what happens next. We hold the correspondence, the things the software makes from it, and excerpts sitting with the model providers named on a dated subprocessor list. People here can reach content in defined support, security and operational circumstances. Retention is written down per category, deletion reaches derived material as well as messages, and backups turn over on their own cycle. We don’t sell your mail. We don’t use it to train generalized models unless you authorize it, and it’s excluded by name from the advertising technology running on our public pages. Tax-return information sits outside the standard service and takes a separate supplement, which is the sentence a tax practice should act on before connecting anything. We hold no certification and publish no price, so a firm that needs either today should wait. What we have instead is two dated documents, a contract that carries the commitments, a log you can read daily, and four answers you can test yourself in a first week. If the partner conversation behind all of this hasn’t happened, that’s the piece of work, and the fall is when it costs the least.