How does Nysa protect your team's data?

Nysa protects your team's data by keeping raw email private to its owner, limiting each agent to its teammate's access, and giving you controls over what gets shared. It has also passed a CASA Tier 2 security assessment, and your content is not used to train AI models.

If you connect an AI tool to company information, you should understand what it can read and who else might see the result. You should not need a security background to get those answers.

Here is how Nysa handles those questions, without getting into the technical details of its systems.

Your inbox does not become a shared inbox

Your email contains useful company knowledge alongside information that belongs in a smaller conversation. Connecting it to a team tool should not mean handing every colleague access to the original messages.

In Nysa, raw email stays private to the person who connected it. Nysa draws facts from messages so the team can use relevant knowledge, but those facts follow the workspace's access rules. Sharing a fact is different from opening the email thread to everyone.

Gmail access is read-only. Nysa does not send, delete or modify your email. Calendar permissions are separate: changes you make to events through Nysa can be written to your Google Calendar.

The article on how Nysa keeps private email private explains this distinction in more detail.

Each agent works within its person's access

An AI agent should not become a shortcut around your team's permissions. In Nysa, each agent signs in as a specific teammate and sees only what that person can see.

You can create scopes, which are named areas of knowledge such as HR or Legal. You describe what belongs in each one, and Nysa sorts facts into the appropriate scope. Projects offer another boundary: they start private to their members, with the option to open them to the workspace.

Agent keys can be read-only or allow both reading and writing. They can also be limited to selected scopes or projects. For an agent that only needs to look things up, a read-only key is a useful starting point.

These choices let a team share useful knowledge without treating every person and every connected agent as the same audience. The broader principle is covered in shared memory is not shared access.

What that looks like in an ordinary team

Imagine a small company preparing a customer rollout. The project team needs the agreed launch date and the customer's requirements. A separate conversation about an employee's compensation should remain with the people responsible for it.

In this hypothetical example, a private project gives its members a place for rollout knowledge, while an HR scope provides a separate boundary for compensation facts. A teammate's agent works within that teammate's access rather than searching everything simply because it exists in the company brain.

The workspace owner still needs to choose the right members and permissions. Before connecting agents, decide what they need to read, whether they need to write, and which work belongs in a private project.

You choose the meetings Nysa records

Nysa's notetaker joins meetings you or your team direct it to record. It appears as a visible participant, and the recording and transcript are available to teammates who attended and people the meeting is shared with.

Recording consent remains important. Your team is responsible for following the requirements that apply to a meeting and its participants. A visible notetaker does not replace that responsibility.

Public meeting links are off by default. If your workspace enables them, anyone holding a public link can view that meeting without signing in. Treat that as a sharing decision, not an ordinary private link.

You can read how Nysa turns meetings into facts for the rest of the workflow.

Your content is used to provide the service

Nysa uses AI to turn information into useful facts and help answer questions. Processing content for a feature is different from using that content to train a general-purpose AI model.

Nysa does not sell your data or use your content to train AI models. It uses service providers to deliver features such as transcription and AI processing. The Privacy Policy explains what those providers receive and why.

There is also a boundary to understand when you connect an outside agent. If you ask that agent to retrieve information from Nysa, it receives the permitted information needed for the request. The agent's provider then handles that information under your agreement with them. Choose connected agents with the same care you use when choosing other tools that handle company data.

What CASA Tier 2 means in plain English

Nysa has passed a CASA Tier 2 security assessment. CASA stands for Cloud Application Security Assessment, a framework for checking the security of applications that handle sensitive data.^[1]

For Nysa, an authorized lab assessed its security against the requirements. Google also reviewed and approved Nysa's Gmail and Calendar access.

That gives you an independent check alongside the product's everyday access controls. It does not mean that every sharing choice is safe or that any application can promise zero risk. Your team's project membership, agent permissions and recording decisions still matter.

FAQ