Emails are sensitive by nature. As per our SOC II, Truly employs a Privacy By Design architecture where it doesn't store any information that it needs to, longer than it needs to. In Truly's case this can be very short since we sync data to Salesforce in real-time and expect it to be your system of record for Activity.

Truly's email access is limited only to users who explicitly connect their account via Oauth. This means that for the most conservative organizations, only your reps' emails will be exposed to the service.

By default, Truly disregards any email that is completely internal (eg: all participants are in the same email domain). This eliminates the possibility of logging sensitive emails to Salesforce even if a user creates a test contact/lead with their own email (or someone else's email).

A user's inbox is generally composed of several key structures/folders that contain email that a user wouldn't want to be synced. That's why Truly discards any emails that aren't in the Primary Inbox or Sent folders (all other messages are discarded, just like internal emails)

Assuming that Truly does consume your emails, we have two layers of encryption to protect your data.

First, we encrypt the subjects/messages themselves so that the data is completely unreadable to almost everyone at Truly with production database access. The encryption key is stored in Amazon Key Management Store (KMS) and only accessible by our DevOps engineers (and any access is monitored/logged). This means nobody in Truly can knowingly or unknowingly access, read or analyze your email contents.

Second, our database is encrypted by Amazon Relational Database Service (RDS). This means that if anyone were to physically infiltrate an AWS facility and steal the hard drive, they wouldn't be able to read the stored data without Amazon's unique encryption keys.