Lyntway for email

Put your address on copy. That is the setup.

Every person gets an address of their own — sathya-7f3k@acme.in.lyntway.com. Copy it on a thread and the assistant reads what arrives, summarises it, lists what needs a decision and drafts the reply, then sends that to you and to nobody else. Every step carries a receipt anyone can verify. No mailbox credential. No OAuth. Nothing stored.

Two ways in, and neither is a credential.

Every other tool in this market begins by asking for access to your mailbox. We never hold one. Take the address off the thread and we are out of it the same second — there is nothing to revoke.

A person decides

Your own address, on copy

Issue it in the console, copy it on whatever you want read. The answer comes back to you alone; the assistant never writes into the thread. Add +invoices or +closings before the @ for a specialised job, and rotate the address in one click when suppliers have it. Shared addresses such as invoices@ still exist for a team inbox.

Or your admin does

One mail-flow rule

A single transport rule in Microsoft 365 or Google Workspace copies matching mail to us automatically — by sender, domain, recipient or subject. Coverage stops depending on whether somebody remembered, which is the difference between a habit and a control.

Detection is the easy half. Not being tricked is the other one.

An agent reading email is a new kind of target: patient, literal, and unable to feel that something is off. Two things follow from that, and only one of them is a filter.

Instructions aimed at the model

Injection, refused before it is read

Text addressed to an AI, hidden or zero-width characters, unusual encodings, the familiar phrasings. Matched by deterministic rules first, because a defence that depends on a model's judgement fails against an attacker who is willing to iterate.

Instructions aimed at the process

Action Hold

“Our banking details have changed.” No injection, no trickery, nothing for a filter to catch — a legitimate-looking message asking for a harmful thing. So the constraint is not detection: anything that moves money waits for a person. A perfect attack still fails, because the agent was never able to comply.

Afterwards, you can prove what it did.

A log is a claim by whoever wrote it. What comes out of Lyntway is a signed record your auditor checks on their own laptop, with a public key, no account, and nothing required from us.

What the receipt carries

The whole chain, not the outcome

Which thread, which category. What the policy released and what it withheld. What was found and substituted before any model saw the text. Which model, and which version of it. What came back, what action followed, and who approved it if a person did.

What it will not do

Claim more than happened

If we were told rather than saw it, the receipt says attested and not observed. If a component was degraded, it says so. A finding from a model carries the model's name; a finding from a rule carries none. The format cannot flatter us.

What this does not do.

Worth knowing now rather than in month three.

Threads, not mailboxes

We see what is copied to us

A copy of a message is not a view of an inbox. We cannot report on mail we were never sent, on folders, or on a reply where a colleague dropped the address. And an address on copy is visible to everyone on the thread, so strangers will write to it: mail nobody from your company is on is signed as having arrived and read by nobody.

Governed, not hosted

We are not your mail provider

No mailboxes, no client to install. Your mail stays exactly where it is. We keep the findings, the receipt, and the assistant's own notes on a thread with stand-ins where the values were, so the next message is read in context — and we discard the message itself. That is how a thread can be followed without a mailbox.