Owner access is separate
The owner application uses Cloudflare Access. It fails closed until the required Access configuration is present. The developer API uses scoped domain keys. Agents use owner-approved OAuth/MCP clients or paired credentials and mailbox grants.
Give each integration what it needs
Domain keys can be restricted by permission, sender, recipient, expiry, rate, and sending budget. Mailbox grants, sending caps, a kill switch, and revocation limit agent access. Protect the management key and keep it out of application deployments.
Mail storage is in your account
R2 stores mail content and attachments; D1 stores metadata and events. Cloudflare and people with sufficient access to your account can access that data. Box Ox does not add end-to-end encryption or application-level mail encryption.
AI starts off
Local filters, reputation checks, and AI have separate controls. Enabling an external AI provider sends selected mail content to that provider through your AI Gateway. Provider and Cloudflare terms still apply. A zero-data-retention routing preference is not a guarantee of provider retention behavior.
Operational visibility
Cloudflare provides platform metrics and logs. Box Ox stores message outcomes, webhook attempts, and audit events. Open and click tracking is optional and off by default. Box Ox does not include an aggregate mail-performance dashboard.
What the operator owns
Configure Access and DNS carefully, protect account credentials, review updates, manage backups and retention, and test your installation. Removing the temporary setup token after onboarding reduces persistent administrative access.
Report a vulnerability
Email hello@boxox.dev with the affected version, an explanation, and safe reproduction steps. Do not include live API keys, passwords, or private mail. No response-time commitment or certification is implied.