KoltrixPersonal data in email: plain rules for a small team
Email is a poor place for passwords, IDs and card numbers, yet teams send them daily. Plain rules for what never to send, what to send with care, and cleanup.
On this page(8 sections)
A customer replies to your onboarding email with a photo of their passport. A teammate pastes an API key into a message to unblock a colleague. Someone forwards a spreadsheet of customer details to a personal address "to work on it tonight". None of these people is careless in a way they would recognize. They are trying to get something done.
Email is the most convenient tool in the company, and that is exactly why personal and sensitive data ends up in it. Once it is there, it is copied to servers, phones, backups and search indexes, and it stays for years. A small team does not need a legal department to deal with this. It needs a short set of plain rules that everyone can remember.
This guide offers those rules. It is practical advice, not legal advice: what counts as personal data and what you must do about it depends on where you and your customers are.
Why email is a weak place for sensitive data
Four properties make email risky for anything sensitive:
- It spreads. One message becomes a copy on the sender's device, the recipient's device, two mail servers, backups and often a few forwards. You cannot take back a copy you do not control.
- It stays. Mailboxes keep messages for years unless someone deletes them, and shared mailboxes outlive the people who used them.
- It is easy to misdirect. A wrong autocomplete, a reply-all or a look-alike address sends the data to the wrong person. See display name spoofing and lookalike domains for how attackers use this.
- It is searchable and readable by tools. Anyone with access to a mailbox, and any assistant or integration given access, can search for words such as "passport" or "password". That is useful for work and dangerous for secrets.
Transport encryption between servers protects the journey, not the copy that sits in the mailbox afterward.
Three groups of data
Sort what you handle into three groups, and write the groups on a page that everyone can see.
Never send by email
These should be kept out of ordinary email, including your own team's, whatever the reason:
- Passwords, recovery codes, API keys and private keys. Anyone who finds the message can use them. Share secrets through a password manager or a secrets tool, and rotate any secret that has been emailed. See API key security.
- Full payment card numbers and security codes. Use your payment provider's hosted forms. If a customer sends one by email, do not reply with it quoted, and delete it as described below.
- Government ID scans and national ID numbers, unless your process truly requires them and uses a secure upload instead.
- Bank login details.
Send only with care
These sometimes have to move, but they need a deliberate choice:
- Health information. See email privacy habits in health tech.
- Home addresses, dates of birth and phone numbers of customers or staff.
- Contracts, invoices and payroll details.
- Lists of customers or exports from your database.
For these, prefer a secure link that needs a login and expires, over an attachment. Send the minimum fields. Check the recipient's address twice. Say in the message what the data is for.
Fine to send
Business contact details that people have shared for business, order numbers, public information and ordinary work conversations are what email is for. Keep them in normal email without ceremony. A rule that is too broad is ignored, so be strict about the first group and honest about the third.
Six rules a small team can follow
- Secrets go in the vault. Put a password manager in place for everyone, including shared accounts, and ban pasting secrets into email and chat. Rolling out 2FA across the team belongs in the same project.
- Ask for less. Review your forms and your support scripts. If a customer does not need to send a photo of an ID for you to help them, do not ask for one. Data you never collect cannot leak.
- Use links, not attachments, for sensitive files. A link can expire, require sign-in and be revoked. An attachment is a permanent copy.
- Do not forward to personal accounts. Working from a private mailbox moves company and customer data outside your control. Why forwarding to personal inboxes breaks explains the problems.
- Limit who can see what. A shared mailbox that everyone can read is a place where sensitive messages are visible to all. Use per-mailbox permissions, as described in per-mailbox permissions design, so a payroll question reaches only the people who need it.
- Keep less, for less time. Decide how long different kinds of mail are kept and delete on schedule. Archive and retention habits is a good place to start.
What to do when someone sends you the wrong thing
It will happen. A customer sends a card number or a photo of a passport. Do this:
- Do not quote it in your reply. Quoted text copies the data into a second message.
- Reply with a short, kind note. "Thanks. For your security, please don't send card details by email. We have removed it, and here is a secure way to continue." Give them the safe route.
- Delete the sensitive part. If your system cannot remove an attachment from a message, delete the whole message from the mailbox and from any shared folder, and remember the trash and archive too.
- Check where it went. If the message was forwarded, copied to a ticket tool or read by an assistant, remove it there as well.
- Note what happened in a simple log: date, what was sent, what you did. If the data was serious, tell whoever is responsible for privacy in your company.
When you send something wrong, such as an attachment to the wrong recipient, say so quickly. Ask the recipient to delete it, tell the affected person, and change any secret that was exposed. A fast, honest message does more good than a late, perfect one.
Watch the tools around the mailbox
Email data does not stay in the email app. Search tools, assistants, integrations and exports can all touch it.
- Assistants and AI features. Decide which mailboxes an assistant may read. For mail that should never reach an AI service, see keeping confidential email out of AI, and for a policy template see an AI email policy for small teams.
- Integrations. List the apps that have mailbox access and remove the ones nobody uses.
- Exports and backups. An export of a mailbox contains everything in it. Store exports in an access-controlled place and delete them when the job is done.
- Shared devices and phones. Use screen locks and remote wipe on phones that read company mail.
Make the rules easy to follow
Rules that depend on memory fail. Help people do the right thing:
- Put the three groups on a single page and pin it where the team works.
- Add a short note to the footer of the onboarding email: "Please don't send passwords or card numbers by email."
- Write reply templates for the common mistakes, so the safe answer takes ten seconds. Reusable reply snippets shows how.
- Cover this in a new hire's first week. A short walkthrough beats a long policy.
- Review once a quarter: what did we receive that we should not have, and why did the customer think it was fine?
A one-page version
Never in email: passwords, API keys, card numbers, security codes, ID scans. Only with care, by secure link: health data, contracts, customer lists, dates of birth, home addresses. Fine: ordinary work. If you get something you should not have: do not quote it, delete it, tell the sender kindly, tell the team. If you send something wrong: say so right away.
Key takeaways
- Email copies and keeps data, and a mailbox cannot take it back, so keep secrets and identity documents out of it.
- Sort what you handle into three groups: never send, send with care, fine. Make the first group short and strict.
- Prefer expiring links to attachments, restrict who can read sensitive mailboxes and delete on a schedule.
- Have a calm routine for the wrong thing arriving or being sent, with a safe alternative to offer.
- Remember assistants, integrations and exports: they can read what the mailbox holds.
Start with Koltrix
Your domain, one inbox, and an API that sends.
A team inbox where AI sorts and drafts (nothing is sent without your click), plus the transactional API and SMTP relay your product sends with. 7 days free, no card.
