Security & data
Your inbox is the most sensitive thing your agency owns
So here is exactly what Lanten can see, what it does with it, where it lives and how to take it back. No badges, no marketing — the actual arrangement.
Processed and stored in the UK. Never leaves the country.
Registered with the ICO. Data processing agreement available for your records.
In transit and at rest, to current standards.
Your emails, messages and records train no AI models. Ours or anyone else’s.
What Lanten can access
Three connections, each granted by you and revocable by you, without asking us.
Read and write mail, send mail as you, and read mailbox settings — granted per user through Microsoft’s own consent screen. Admins can grant it once for the whole organisation.
Messages sent to your WhatsApp Business number, via the official WhatsApp Business API. Lanten never reads personal WhatsApp accounts.
An organisation-level API key you create in Street or Acquaint, scoped to what Lanten needs. Revoke it in your CRM at any time and Lanten loses access immediately.
Calendars, files, contacts outside your mailbox, or anything on your devices.
What it does with it
Lanten reads, understands and drafts. People send.
Every reply and every CRM action Lanten suggests waits for a person to approve it. Nothing goes out to a tenant, landlord or contractor without a click from your team.
Emails, messages and CRM records are used to answer your questions and draft your replies. They are never used to train Lanten’s models or anyone else’s.
The writing style Lanten learns from your sent replies is stored per user, inside your organisation, and deleted with the rest of your data.
Logging emails to CRM records is off by default and switched on per mailbox, with per-record-type controls.
Where it lives, how long, how to delete it
Plain answers to the questions your IT person or your compliance lead will ask.
Application and database hosting is in the United Kingdom (Supabase and Vercel, UK regions). AI processing runs through OpenAI in the United States under zero-retention terms; monitoring and billing providers are listed below.
TLS in transit; AES-256 at rest.
Mail and message content is kept while your subscription is active, and deleted 30 days after cancellation unless you ask us to remove it sooner.
Cancel and ask, and your organisation’s data is deleted within 30 days. You can also revoke Lanten’s access in Microsoft 365 and your CRM yourself, instantly.
Owner and Member roles. Shared mailboxes are visible to the people you invite to them, and nobody else.
Subprocessors
The third parties that handle your data on Lanten’s behalf, and why.
We’ll notify customers before adding a subprocessor.
Partner programmes
The two platforms Lanten is built on, and the programmes we belong to.
Microsoft AI Cloud PartnerLanten connects to Microsoft 365 through Microsoft Graph under your own tenant, and the Outlook add-in is published on AppSource. Admins can deploy it organisation-wide and grant consent once.
Meta Business PartnerWhatsApp runs on the official WhatsApp Business Platform, connected directly with Meta — no third-party reseller between your agency and the number.
Got a security questionnaire?
Send it over. We answer them ourselves, usually within a couple of days, and we’re happy to get on a call with your IT provider.