Klytic

Home›Guides›Email security

Email security · Understand

AI in email filtering, and what leaves the company

Yes, an AI model helps decide ambiguous messages, the ones no rule classifies clearly. Privacy, however, is not judged by the word “private”: it is judged by what the model receives, who operates it, what is retained and what is shared between customers.

Updated October 20266 minOfficial sources cited

Where AI helps, and where it does not

Most messages are classified without hesitation. Mass spam from a poorly rated server, a known virus, a domain that fails DMARC with a reject policy: rules and signatures are enough, and they are faster and more predictable than a model.

That leaves a gray area: the message that is neither clearly safe nor clearly fraudulent. A real supplier whose tone changes, a payment request phrased without the usual words, a text that imitates an internal procedure. The signals contradict each other. That is where a language model adds something: it reads the message as a whole and judges its consistency with the signals already computed.

AI does not, however, replace the other layers:

  • it does not replace DMARC, which checks a fact (did the displayed domain authorize the sending?) rather than estimating a probability;
  • it does not replace a transfer procedure: a model can be wrong, and a callback to a known number is not wrong in the same way;
  • it must not decide alone: if it is wrong or does not respond, the rest of the filter must always be able to decide.

The questions to ask any provider

“Private AI,” “sovereign AI,” “your data is not used for training”: these phrases say little if you do not know what really happens. Five questions make comparison possible.

  1. Who operates the model? The filter provider on its own servers, a consumer AI service called remotely, or a server installed on your premises? It is the same question as for any online service: who operates it, and under which law. The guide What is a sovereign cloud? explores it.
  2. What does it receive? The whole message with its attachments, or a bounded excerpt? All messages, or only ambiguous cases?
  3. What does it keep? Are requests logged, for how long, and are they used to retrain a model?
  4. What happens if it does not respond? Is mail blocked, delayed, or does the filter decide without it?
  5. What is shared between customers? Copies of messages, fingerprints, reputation scores?

The answers must be in writing. A provider that cannot say what its model receives is not in control of its own processing.

How AI arbitration works in Klytic MTA

Klytic MTA includes AI arbitration, active in both plans, Essential and Advanced. Here is what it does, and what it does not do.

  • It only steps in on messages with an ambiguous score. Clearly safe or clearly dangerous messages are decided by the other layers, without it.
  • The model is operated by Klytic, or within the customer’s instance when that instance is installed on the customer’s premises. It is not a consumer AI service called remotely.
  • It receives a summary, the signals already computed and a limited excerpt of the message, not the whole message.
  • If it does not respond, the filter still decides with the signals it has. Mail does not wait for the AI.

An example, for illustration. A message arrives from a properly authenticated domain known to the company, with no attachment. It asks to “update the payment details before the next due date.” The rules hesitate: the sender is reliable, the scenario looks like fraud. The model receives the summary, the signals (regular sender, first request of this kind, unusual tone) and an excerpt of the text. It leans toward fraud: the message goes to quarantine, and the administrator reads the reason. Had the model not responded, the score from the other layers would have decided on its own.

Its decision is added to the score: it bypasses neither quarantine, nor the ability to release a legitimate message, nor the explanation of the decision in the headers, readable by the administrator (see Reading and exporting a filter decision).

Learning and sharing

A filter learns mainly from reports. When a user marks a message as unwanted or, on the contrary, releases a legitimate message, the sender’s reputation adjusts. That is what reduces false positives over time.

In Klytic MTA:

  • learned texts are stored as aggregates and fingerprints, not copies of messages;
  • in the cloud, signals flow between instances so that they share the same level of protection: a campaign spotted at one customer is recognized at the others;
  • in an on-premises deployment, processing takes place on site; signals are only sent upstream if the chosen deployment mode enables it.

It would therefore be inaccurate to state, for a cloud deployment, that “nothing ever leaves the instance”: signals are shared, and that is the whole point of pooled learning. What is shared is signals, not mail.

The framework: processing of personal data

Analyzing emails means processing personal data: addresses, names, content. With or without AI, the processing must be listed in the company’s record of processing activities, with its purpose (email security), its recipients and its retention periods. AI does not change this framework; it adds two questions: where does the model run, and what does it see. The retention period for analysis data is covered in Retaining and reviewing email security logs.

Frequently asked questions

Does the AI read all our emails?

In Klytic MTA, no: it only arbitrates messages with an ambiguous score, based on a summary, the computed signals and a limited excerpt.

Are our messages used to train a consumer AI model?

The model is not a consumer service: it is operated by Klytic or within your instance. The filter’s learning retains aggregates and fingerprints, not copies.

What happens if the AI gets it wrong?

A legitimate message set aside stays in quarantine and can be released: see Quarantine, false positives and reporting. Reporting then corrects the reputation.

Can all processing be kept in-house?

Yes, with a deployment of Klytic MTA on your servers: the analysis takes place on site.

And for documents?

The question is related but distinct: see AI and documents, without sending them outside.

Where Klytic stands

AI arbitration is part of Klytic MTA in both plans, Essential and Advanced, along with pooled learning and signal correlation. The facts are those described above: ambiguous messages only, model operated by Klytic or within your instance, limited excerpt, filter that decides without the AI if it does not respond.

Klytic is operated by a French company. The service is deployed in the Klytic cloud, hosted in any geographic area matching the applicable jurisdiction, subject to service availability, notably in Europe or Mauritius, on a dedicated instance, or on your servers. Klytic is not a SecNumCloud-qualified offering.

Klytic MTA does not promise “private AI” beyond these facts. If your requirement is that no signal leaves your infrastructure, it is the on-premises deployment, and its upstream reporting mode, that you need to choose and have written into the contract.

Sources

Consulted in October 2026.

  • Klytic, Klytic MTA page: AI arbitration of ambiguous messages, pooled learning across instances and signal correlation, included in Essential and Advanced; deployment modes. klytic.com
  • Klytic, “What is a sovereign cloud?”: who operates the service and which law applies to it; French operator; Klytic is not SecNumCloud-qualified. klytic.com

A filter that explains what it does

Ask an advisor what the model receives in your deployment mode.

Talk to an advisor →

Discover Klytic MTA

Further reading

Understand · Email securitySpam, phishing, malware and compromised accountsFour threats come through the same door and are not handled the same way. What gives each one away, what stops it, and why anti-spam alone is no longer enough.6 min readRead →Understand · Documents & document managementClassifying or searching documents with AI, without sending their content outsideThe question is not the model’s performance but data leaving the company: where the AI runs, who operates it, what it keeps of your documents.6 min readRead →Use · Email securityReading and exporting a filter decisionRead the score and reason behind a Klytic MTA decision in the headers, export logs to a SIEM, and know what the audit trail retains.5 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing