Private Inbox Zero — Privacy-First Email Automation¶

Updated: February 21, 2026

The Problem¶

Commercial email tools (SaneBox, CleanEmail, Gmail Priority) offer automation but require unacceptable privacy tradeoffs:

The thesis: Privacy and automation are not mutually exclusive.

Architecture¶

Split-Service Design¶

I separated the system into two isolated services to reduce blast radius and simplify compliance:

flowchart LR
    subgraph PROVIDERS["Email Providers"]
        GM["Gmail"]
        OL["Outlook"]
        IM["Generic IMAP"]
    end

    subgraph CONNECTOR["Mail Connector (LXC 240)"]
        direction TB
        OA["OAuth2/IMAP"]
        TM["Token Manager"]
        WH["Webhook Emitter"]
        note1["❌ No AI<br/>❌ No decisions<br/>❌ No content analysis"]
    end

    subgraph INTEL["Mail Intelligence (LXC 242)"]
        direction TB
        RU["Rules Engine"]
        RE["PII Redaction"]
        AI["AI Assist (optional)"]
        AU["Audit + Rollback"]
        note2["❌ No credentials<br/>❌ No OAuth tokens<br/>✅ All decisions logged"]
    end

    subgraph CLIENT["Client"]
        AP["Apple Mail / Outlook"]
    end

    GM --> CONNECTOR
    OL --> CONNECTOR
    IM --> CONNECTOR
    CONNECTOR -->|"webhook<br/>:8080"| INTEL
    INTEL -->|"IMAP commands"| CONNECTOR
    CONNECTOR --> CLIENT

    style CONNECTOR fill:#e8f4ea,stroke:#2e7d32
    style INTEL fill:#e0f2fe,stroke:#0284c7

Figure: Split-service architecture for privacy isolation. Email providers (Gmail, Outlook, IMAP) connect to Mail Connector LXC 240 (green) which handles OAuth and webhooks but has no AI or content analysis. Mail Intelligence LXC 242 (blue) handles rules, PII redaction, AI assist, and audit logging but has no credentials or OAuth tokens. Client email apps receive processed results.

Why this matters: If either service is compromised, the damage is contained:

• Connector compromise: Attacker gets OAuth tokens but no AI logic, no classification rules
• Intelligence compromise: Attacker gets decision logic but no credentials, no direct mailbox access

Privacy Boundary (Non-Negotiable)¶

All AI interaction occurs only after mandatory PII redaction:

Before (original email):
"Hi John, your order #12345 has shipped to 123 Main St, Springfield, IL 62701.
Call us at 555-123-4567. Thanks, Jane Smith jane.smith@company.com"

After (what AI sees):
"Hi [NAME], your order #[ACCOUNT] has shipped to [ADDRESS].
Call us at [PHONE]. Thanks, [NAME] [EMAIL]"

This isn't a policy — it's enforced in code. There's no admin override, no "trust this provider" flag. The architecture physically prevents unredacted content from reaching external AI services.

Redacted Data Types¶

Explainable Decisions¶

Every automated action generates an immutable audit record:

{
  "log_id": "uuid",
  "timestamp": "2026-01-14T10:30:00Z",
  "message": { "id": "msg_abc123", "provider": "gmail" },
  "action": {
    "type": "route_to_folder",
    "target": "Business/Alerts",
    "reversible": true
  },
  "decision": {
    "rule_matched": "business.yaml:routing.alerts",
    "confidence": 0.92,
    "explanation": "Matched keyword 'security alert' in subject"
  },
  "rollback": {
    "before_state": { "folder": "INBOX" },
    "after_state": { "folder": "Business/Alerts" },
    "executed": false
  }
}

When a user asks "why did this email go here?", the system provides a complete answer. This supports GDPR's right to explanation and internal governance requirements.

GRC Alignment¶

I explicitly mapped threats to controls using NIST CSF and ISO 27001:

Framework Coverage¶

Automation Policies¶

Allowed Actions (Automated)¶

• Auto-label/tag
• Auto-move to folders
• Apply flags/stars
• Generate suggestions (human approval required)

Forbidden Actions (Without Explicit Override)¶

• Auto-delete
• Auto-unsubscribe
• Auto-block/spam marking
• Auto-send

Default Behavior¶

Uncertain classifications → "Read Later" or "Quarantine" folder (never deleted)

Classification Decision Tree¶

The system uses a safety-biased decision tree: deterministic rules first, AI assist last.

flowchart TD
  S[New Email] --> H{Deterministic Rules<br/>Strong Match?}

  H -->|Yes| C1[Assign Category + Priority]
  H -->|No| L{Mailing List Signals?<br/>List-Unsubscribe/List-Id}

  L -->|Yes| NL[Newsletter/Marketing<br/>→ Read Later or Suggestions]
  L -->|No| T{Known Thread?<br/>Reply Relationship?}

  T -->|Yes| HUM[Human/Threaded<br/>→ Priority Now or Category]
  T -->|No| A{Ambiguous enough<br/>for AI assist?}

  A -->|No| SAFE[Default Safe Routing<br/>→ Read Later or Quarantine]
  A -->|Yes| RED[Redact PII Locally]
  RED --> AI[AI Assist on Redacted Text]
  AI --> DEC[Decision + Confidence]
  DEC -->|High confidence| APPLY[Apply server-side label/move]
  DEC -->|Low confidence| REVIEW[Route to Suggestions<br/>for human review]

Figure: Safety-biased email classification decision tree. New emails first check deterministic rules (strong match routes directly). If no match, checks mailing list signals (routes to Read Later). Then checks thread relationships (routes to Priority). Only ambiguous emails go through PII redaction before AI assist. High-confidence AI results auto-apply; low-confidence routes to human review. Unknown cases default to safe routing (Quarantine).

Decision Logic¶

Confidence Thresholds¶

Key principle: The tree fails safe. Unknown senders go to Quarantine, not trash. Low confidence triggers human review, not auto-action.

Technology Stack¶

Implementation Status¶

What's Operational Now¶

Skills Demonstrated¶

Privacy Engineering¶

• Privacy by design (architectural enforcement)
• Data minimization (redaction boundaries)
• Right to explanation (audit trails)
• Consent management (user control)

Security Architecture¶

• Threat modeling (6 identified threats)
• Defense in depth (split services, trust boundaries)
• Least privilege (minimal OAuth scopes)
• Trust boundary definition

GRC Engineering¶

• Framework mapping (NIST, ISO 27001, GDPR)
• Control implementation (audit logs, rollback)
• Policy documentation with technical enforcement
• Risk management (documented residual risk)

Infrastructure & DevOps¶

• Proxmox VM management
• Docker containerization
• Tailscale networking
• Self-hosted service deployment

Results¶

What This Demonstrates¶

Most candidates implement features. I architect systems that balance competing requirements: automation vs. safety, AI vs. privacy, convenience vs. control.

This project demonstrates:

1. Systems thinking — Not just code, but governance and risk
2. Security principles applied to practical problems
3. Documentation discipline for auditors and future maintainers
4. Compliance-first design — GRC from the start, not an afterthought

Deep Dive Available¶

• 60 seconds: This page (TL;DR)
• 15 minutes: Technical screen (architecture + tradeoffs)
• 45 minutes: Full deep dive (threat model, control mapping, implementation)

Supporting Materials¶

• 9 architecture diagrams (Mermaid)
• Threat model documentation
• NIST CSF / ISO 27001 control mapping
• Build instructions
• Interview talking points

Contact LinkedIn