Your clients’ data, in plain English
The emails you forward to us can contain your clients’ names, matters and money. This page sets out exactly what happens to them. If anything is unclear, email ben@scam-less.com and you’ll get a straight answer from the founder.
Our promises
- 1
We delete your email once it’s checked
The email you forward, and our reply, are permanently deleted from check@scam-less.com within minutes. Microsoft keeps a locked recovery copy for up to 14 days, as it does for every Microsoft 365 mailbox, and then it’s gone.
- 2
We never store what the email says
Our database holds the result only: the verdict, the score and which warning signs fired. Never the text, the attachments, or your clients’ names.
- 3
Never used to train AI. Never sold.
Your emails aren’t used to train any AI model, ours or anyone else’s, and we never sell or rent data to anyone.
- 4
Only the scammer’s details are shared
If an email contains a fake website, a scam phone number or a fraudster’s bank account, we add that to our scam database to protect other customers. Nothing about you or your clients is shared.
- 5
You can see and delete everything
Ask and we’ll send you what we hold about your firm, or delete it, within 30 days. When you leave, we delete your account data.
- 6
No surprises
We’ll give you 30 days’ notice before adding a company that processes your data, and we’ll tell you without delay, and within 48 hours of finding out, if a security incident affects your data.
What happens to a forwarded email
- It arrives in our Microsoft 365 mailbox, check@scam-less.com, which is used for nothing else.
- Our service reads it in memory and runs the checks: who really sent it, how old the website is, whether the bank account changed country, whether the PDF was edited.
- Common personal details are removed (card numbers, PPS and National Insurance numbers, dates of birth, Eircodes and postcodes, and names after “Dear” or “Hi”), then the text is sent to our AI provider for a second opinion. Removal is automatic and won’t catch every detail, such as a name in an email signature, which is why the AI provider is also bound to delete it within 30 days and never train on it.
- We save the result, not the email: verdict, score, warning signs and the time it took.
- We reply to you, then permanently delete your email and our reply from the mailbox, within minutes.
Where it’s processed: our database is in Ireland. The checking service currently runs on servers in the United States, and the AI provider is in the United States, both under the EU’s standard contractual safeguards for international transfers. We’re moving the checking service to Ireland.
What we keep and what we never keep
| Never kept | Kept |
|---|---|
| The text of the email or message | The result: verdict, score, type of scam, which warning signs fired |
| Attachments and invoice PDFs | Scammers’ details: fake websites, scam phone numbers, fraudsters’ bank accounts |
| Your clients’ and staff’s names, addresses and ID numbers | Supplier memory: your suppliers’ web domains, and a scrambled code for each bank account they use. The code lets us spot a change of account, but can’t be turned back into the account number |
| Your suppliers’ bank account numbers | Your answers to “Was this right?” |
Results are kept for your firm’s audit history until you ask us to delete them or close your account.
Companies that process data for us
| Company | What for | Where |
|---|---|---|
| Microsoft 365 | Receives forwarded emails at check@scam-less.com and sends our reply. Deleted within minutes | Microsoft data centres |
| Netlify | Runs the check itself, in memory, nothing saved | United States (moving to Ireland) |
| Anthropic | AI review of the email text, after common personal details are removed. Deleted within 30 days, never used for training | United States |
| Supabase | Our database: check results, your account, scam database | Ireland |
| Resend | Sign-in links and account emails (not your forwarded emails) | United States |
| Stripe | Billing. We never see card numbers | Ireland / United States |
What Scam-Less is and isn’t
Scam-Less is a second pair of expert eyes, not a guarantee. It catches the large majority of invoice and payment scams in our testing, but no check catches everything. For any change of bank details, still phone the supplier on a number you already have before paying. The decision to pay always stays with you.
Security
- Everything is encrypted in transit, including to our database.
- We only reply to senders whose email passes Microsoft’s anti-spoofing checks, so nobody can pose as your firm.
- Sign-in uses a one-time email link plus a 6-digit code from an authenticator app. Two-step sign-in is required for every Scam-Less staff account, and any firm can require it for all its staff.
- Sign-in tokens, API keys and recovery codes are stored only in scrambled form; authenticator secrets are encrypted.
- Every database table is locked down so only our own servers can read it.
- Our logs record event names and numbers only, never email content.
For your compliance team
On request we’ll send our data processing agreement (GDPR Article 28) and answer your security questionnaire before you start a trial. Email ben@scam-less.com.
Your rights and contact
Scam-Less, Drogheda, Co. Louth, Ireland. ben@scam-less.com. You can ask for a copy of your data, a correction, or deletion at any time, and you can complain to the Data Protection Commission (dataprotection.ie).