OpsBots — e-mail assistant: data-protection impact assessment

Self-drafted by CHK GmbH; not reviewed by a lawyer.

This assessment describes CHK's standard e-mail feature in OpsBots as set up on 23 October 2026. It is not legal advice. The business that connects a mailbox is the controller and stays responsible: check this assessment against your own situation and adapt it, or make your own, where your law requires it (for example in the EU). CHK assists as described in the DPA.

1. Why this assessment

An impact assessment is needed where processing may lead to a high risk for the people concerned (Art. 22 of the Swiss Data Protection Act, FADP; Art. 35 GDPR). Here an AI system reads the incoming e-mail of a business mailbox, including e-mail from people who never get a reply, and providers in other countries process its content. The Swiss data-protection authority (FDPIC) names new technologies such as artificial intelligence as a risk factor; the German authorities' list names customer support by artificial intelligence. One assessment may cover similar processing (Art. 22(1) FADP; Art. 35(1) GDPR), so CHK provides this one for its standard feature. Likelihood and severity below are rated low, medium or high: how likely the harm is with the feature as described, and how much it would affect a person.

2. Parties and roles

• Controller: the business that connects its mailbox. It decides to answer its e-mail with OpsBots' help and remains responsible for its notices, its replies and everything it sends.
• Processor: CHK GmbH, Lucerne, Switzerland, the company behind OpsBots, under the DPA.
• CHK's sub-processors for this feature: Render (hosting and database in Frankfurt, Germany; a US company), Anthropic (the AI model; it stores the data in the United States and may run the model in other countries) and Scaleway (search, Paris, France). Scaleway's e-mail service also sends OpsBots' own notices, such as "a conversation needs a person"; these notices contain no message text. Details: provider list.
• Google: the business's own mailbox provider, under the business's Google agreement. Google is not CHK's sub-processor.

3. What OpsBots does with the e-mail

• Purpose: to write reply suggestions to incoming e-mail from the business's own knowledge, so that its team can check and send replies faster.
• Mailbox: a Gmail mailbox, connected by an owner or admin of the workspace, or by CHK's support acting in the workspace at the business's request; Google asks the mailbox's own user to sign in and approve. Outlook is not available yet.
• Permissions: two Gmail permissions: reading (gmail.readonly) and writing drafts (gmail.compose). The read permission technically covers the whole mailbox; OpsBots uses it only as described here. The write permission would let software send e-mail; OpsBots has no send function, and its requests to Gmail pass a fixed list of allowed actions: reading, and creating, changing or deleting drafts. OpsBots changes or deletes only its own drafts that nobody has edited, which it recognises by a fingerprint.
• When reading starts: connecting reads only the mailbox's address. While e-mail is switched on for the workspace, OpsBots checks once a minute for e-mail that arrived in the inbox after the connection (at most 7 days back). For each such e-mail it reads the whole thread, including the team's replies and drafts in it, to decide whether a draft is needed.
• Before the AI: fixed rules set aside automated and bulk mail (for example no-reply senders, mailing lists, automatic replies and bounces); it never reaches the AI. Limits per sender, per domain and per day apply.
• What the AI receives: for each draft, the newest incoming e-mail (up to 4,000 characters), up to 10 earlier messages of the same conversation, the assistant's instructions and company summary, and the knowledge excerpts found.
• The reply suggestion: for an e-mail thread, at most one draft at a time, written into the same thread of the mailbox. It ends with a line saying that the reply was written with the help of AI, and carries a technical marker in its header. A draft that a person has edited is never overwritten. When someone in the team has already replied in the thread, or writes in it, OpsBots writes nothing there.
• When OpsBots has no answer: if the business's knowledge does not cover the question, OpsBots writes no draft and marks the conversation for a person in the team.
• Knowledge used: the business's public and internal documents in OpsBots. Drafts can therefore contain internal facts (risk 3).
• Data concerned: names and addresses of senders and recipients, subject, e-mail text and thread identifiers, the draft and the sources it used, and anything people choose to write, which can incidentally include sensitive data.
• People concerned: anyone who writes to the mailbox (customers, prospects, suppliers, applicants), people mentioned in e-mails, and the business's staff who use the mailbox.
• Where the data goes: the AI's input goes to Anthropic, and the e-mail text goes to Scaleway to search the knowledge. OpsBots stores the conversation, the record of the draft and the encrypted mailbox access with Render in Frankfurt.
• How long: e-mail conversations and their draft records 12 months after the last activity; the audit log 24 months; the record of which e-mails were already handled 8 days; per-sender counters 2 days; database backups at most 30 days; Render's service logs 7 days. Anthropic deletes inputs and outputs within 30 days, except where the law requires longer or where its automated safety checks flag content, which it keeps for up to 2 years. Scaleway keeps a search request only if it was involved in an error or suspected misuse, for up to 2 weeks. Drafts in the mailbox stay there until someone deletes them. Disconnecting the mailbox deletes OpsBots' access token; to end Google's permission as well, remove OpsBots under third-party access in the Google account.

4. Necessity and proportionality

• Drafts only: a person decides what is sent. There is no decision based solely on automated processing (Art. 21 FADP; Art. 22 GDPR).
• Least use: two permissions, no send function, only threads with e-mail received after the connection, only while switched on; automated mail is set aside before the AI; limits per sender and per day.
• A check before switching on: e-mail can be switched on only after a quality check on at least 30 of the business's own test questions, each asked twice, reaches 90 % correct or honest answers and 95 % with sources, with no invented content and no safety failure. A change to the knowledge, the test questions or the assistant's settings makes the check out of date and stops new drafts until a new check passes and drafts are switched on again.
• Control: e-mail can be switched off at any time; new drafts then stop within about a minute. The mailbox can be disconnected at any time.
• Minimal logging: OpsBots' application logs record codes, not e-mail content or addresses.
• Alternatives considered: answering every e-mail by hand (no AI processing, but slower replies); an AI model operated in Europe (not used today; see risk 1).

5. Transfers abroad

• Germany and France: Switzerland recognises both as countries with adequate data protection.
• United States: Anthropic stores the data there; Render is a US company and states that its own primary operations take place in the United States. Safeguards: the providers' data processing agreements, with the Swiss-U.S. Data Privacy Framework where it applies, otherwise the EU standard contractual clauses adapted for Switzerland. Anthropic's commercial terms do not allow it to train models on this content.
• Other countries: Anthropic may run the model in any country where it provides it (its standard global routing, kept by CHK's decision). These countries are not named in advance; the safeguard is Anthropic's data processing agreement.
• What remains: authorities in the United States, or in a country where the model runs, may be able to demand data. The safeguards reduce this risk but do not remove it (risk 1).
• The business's notice must name the countries and the safeguards (Art. 19(4) FADP). The notice in section 11 names Germany, France and the United States and the safeguards; it cannot name the other countries where the AI model may run (see above).

6. Risks and measures

Each item names the risk for the people concerned, the likelihood and severity before the measures, the measures, and the remaining risk.

• Risk 1: content goes to providers in the United States and possibly other countries. Before: medium likelihood, medium severity. Measures: data processing agreements with transfer safeguards; no model training; deletion at Anthropic within 30 days; only the conversation, the instructions and the knowledge excerpts found are sent; long e-mails are shortened; no e-mail text in logs. Remaining: low to medium.
• Risk 2: a wrong or invented reply. Before: medium, medium. Measures: drafts only, checked by a person before sending (statement S3); answers only from the business's knowledge, with sources; no draft when nothing covers the question; the quality check before switching on and after changes; the AI line in every draft. Remaining: low.
• Risk 3: internal facts in a draft to any sender. Drafts may use internal documents, and anyone can write to the mailbox. Before: medium, medium. Measures: the person who checks the draft sees everything it says before sending; the business adds to OpsBots only internal documents whose content it would share with a sender after a check, and keeps confidential matters out (both statement S3). Remaining: low, if both are done as agreed. Using internal documents is a design choice of the standard feature; the business decides whether to accept it and which internal documents it adds.
• Risk 4: an e-mail tries to steer the AI (prompt injection). Before: medium, medium. Measures: the AI's only tools are a search of the business's own knowledge (at most 2 searches per reply) and a hand-over to the team; it cannot send, browse the web, or open other e-mails or threads; its output is a plain-text draft that a person checks; automated mail is set aside. A crafted e-mail can still steer the search towards internal documents, which is why the check in risk 3 matters. Remaining: low.
• Risk 5: people do not know that an AI reads their e-mail. Before: high likelihood, low severity. Measures: the notice in section 11 (statement S2); the AI line in every draft; the public provider list. Remaining: low.
• Risk 6: someone obtains access to the mailbox or the stored data. Before: low, high. Measures: the mailbox access token is encrypted; database rules keep each workspace's data apart; two-step login for every account; only owners and admins, or CHK's support acting at the business's request, can connect a mailbox; an audit log that the application cannot change; tokens never appear in logs; disconnecting deletes the token. Remaining: low.
• Risk 7: CHK's support sees the business's e-mail conversations. Before: low, medium. Measures: support can open a workspace only for a limited time, with a recorded reason and a fresh two-step code, and every entry is recorded in the audit log; access at CHK is limited to its managing director (DPA section 3); CHK can never confirm the statements in section 10 for a business. Remaining: low.
• Risk 8: data kept longer than needed. Before: medium, low. Measures: the fixed periods in section 3. Remaining: low.
• Risk 9: sensitive or confidential data in e-mail. Before: low, high, for a mailbox not used mainly for such data. Measures: such content is not sought, and it follows the same periods; a mailbox used mainly for sensitive data or for matters under professional secrecy follows section 7 (statement S4). Remaining: low; adapt this item if your sector differs.
• Risk 10: monitoring of staff. Before: low, medium. Measures: OpsBots does not assess staff; a personal mailbox is connected only with its owner's agreement (statement S1); shared business addresses are preferred. Remaining: low.
• Risk 11: a forged sender asks for information. Before: medium, medium. Measures: the sender's authentication results are checked and mail that fails them is handled more strictly; the person who checks the draft sees the sender before sending. Remaining: low.
• Risk 12: automated decisions. None: a person decides what is sent. Not applicable.

7. Mailboxes with sensitive data or professional secrecy

The conclusion in section 8 does not cover a mailbox used mainly for sensitive personal data (for example health, religion or criminal proceedings) or for matters under professional secrecy (for example those of doctors, therapists, lawyers or fiduciaries). Processing sensitive data on a large scale is a sign of high risk (Art. 22(2)(a) FADP). OpsBots can still be used for such a mailbox, on these conditions, which the business accepts in OpsBots with the second form of statement S4. That confirmation records that the business has made its own assessment, and it is the express agreement on safeguards that the terms (section 5) and the DPA (section 2) require.

• Own assessment: the business makes its own impact assessment for that mailbox, using this one as a starting point, and consults the FDPIC first if a high risk remains (Art. 23 FADP).
• Information: the people concerned learn that providers in the United States and, for the AI model, possibly other countries not named in advance process their e-mails (the notice in section 11 says so).
• Professional secrecy: the business checks that its professional rules allow providers, including in the United States and other countries where the AI model may run, to process these matters, and obtains any consent of its clients or patients that those rules require. CHK GmbH and its staff act as the business's auxiliary persons and keep these matters confidential (Art. 62 FADP; Art. 321 Swiss Criminal Code); access at CHK is limited to its managing director.
• CHK's providers (Render, Anthropic, Scaleway) are bound by their data processing agreements, not as the business's auxiliary persons under Swiss criminal law. Anthropic may keep content flagged by its safety checks for up to 2 years, and authorities in the United States or in a country where the model runs may be able to demand data. The business's consent and its check of its professional rules must cover this.
• Safeguards in use: drafts only, checked by a person; no model training; the periods in section 3; the business keeps its most confidential documents out of OpsBots' knowledge, and may use a separate mailbox for routine questions only. OpsBots applies no extra technical measures to these mailboxes; whether the measures are suitable is for the business's own assessment.
• In the EU: also check Art. 9 GDPR and your national secrecy law (in Germany, for example, § 203 of the Criminal Code and, for lawyers, § 43e of the Federal Lawyers' Act).
• Whether the rules of a particular profession allow a provider in the United States is a question for those rules and, where in doubt, for a lawyer.

8. Remaining risk and conclusion

With these measures, CHK assesses the remaining risk of its standard e-mail feature as not high. In CHK's view, a prior consultation of the FDPIC (Art. 23 FADP) is therefore not needed for the feature as described; that decision stays with the business as the controller. This conclusion holds only while the measures above are in place and the feature is used as described: drafts are checked, the notice is given, only internal documents that may be shared after a check are added, and no mailbox used mainly for sensitive data or professional secrecy is connected outside section 7. It does not replace a business's own assessment where its situation differs.

Signed for CHK GmbH: Carl Klintenberg, managing director, Lucerne, 24 October 2026.

9. What you must adapt

• Your business: its name and contact, the mailboxes you connect, and who in your team checks the drafts.
• Your privacy notice: add the notice in section 11, or your own text with the same content, next to your business's identity and contact.
• Your sector: for sensitive data or professional secrecy, section 7 applies.
• Requests from people who wrote to you: answer them as for any of your records; OpsBots' conversation list and its export help you find their e-mails.
• EU law: if the GDPR applies to you, check your legal basis (often Art. 6(1)(b) or (f) GDPR), your supervisory authority's list of processing that needs an assessment, and whether you need a representative in the EU.
• Your records of processing (Art. 12 FADP; Art. 30 GDPR): add this processing.
• Your own retention needs, how you inform your staff, and, if you have one, your data-protection adviser's view.
• Keep this assessment and your adaptation for at least two years after the processing ends (Art. 14 of the Swiss Data Protection Ordinance).

10. Your confirmations in OpsBots

Before a mailbox can be connected, an owner or admin of the workspace confirms these five statements for the business. CHK's staff cannot confirm them on your behalf. OpsBots records who confirmed (with the role and a hashed form of the e-mail address), when, the versions of the statements and of this assessment, the form of S4 chosen, and a hashed network identifier, and keeps that record for 24 months. A confirmation counts for 700 days; from 30 days before, Settings → E-mail asks an owner or admin to confirm again, and after that no new drafts are written until someone does.

• S1 We are entitled to connect every mailbox we add here and to let OpsBots read its incoming e-mails and write reply drafts in it. Each one is a shared business address, or the person it belongs to agrees.
• S2 We tell the people who write to us that an AI assistant helps write our replies, using the notice below or our own text with the same content.
• S3 A person in our team checks every draft before it is sent. OpsBots never sends e-mails itself. Drafts can contain facts from our internal documents, so we add only internal documents whose content we would share with a sender after checking.
• S4 No mailbox we connect here is used mainly for sensitive data (such as health, religion or criminal proceedings) or for matters under professional secrecy (such as those of doctors, lawyers or fiduciaries).
• S5 We have read the data-protection impact assessment for the e-mail assistant, and we adapt it, or make our own, where our law requires it (for example in the EU).

For a mailbox with sensitive data or professional secrecy, S4 reads instead:

• S4 A mailbox we connect here is used for sensitive data or for matters under professional secrecy. For it, we have made our own data-protection impact assessment; we tell the people concerned that providers in the United States and, for the AI model, possibly other countries also process their e-mails; and where professional secrecy applies, we have checked that our professional rules allow this and have any consent they require. We agree to the conditions and safeguards in section 7 of the assessment, and CHK GmbH and its staff keep these matters confidential as our auxiliary persons.

11. A notice for the people who write to you

Add this text to your privacy notice or show it near your e-mail address, or use your own text with the same content:

We answer e-mails with the help of an AI assistant: OpsBots (CHK GmbH, Lucerne, Switzerland) reads incoming e-mails and writes reply drafts, which a person in our team checks before anything is sent. For this, providers process the content on our behalf in Germany, France and the United States; the AI model is Anthropic's Claude, and Anthropic stores the data in the United States and may run the model in other countries. For the United States and any other country where the model runs, the providers' data processing agreements apply (the Swiss-U.S. Data Privacy Framework where it applies, otherwise standard contractual clauses). Your e-mail is not used to train AI models. List of providers: https://app.opsbots.ch/legal/subprocessors?lang=en

12. Version and review

This is version 1 of 23 October 2026. CHK reviews this assessment and publishes a new version when a provider changes, a new kind of mailbox is added (such as Outlook), the permissions or the use of internal documents change, and at least once a year. If the statements in section 10 change in substance, OpsBots asks you to confirm them again; your earlier confirmation stays valid until a date OpsBots shows you.