Version of 19 September 2026. This is a translation; the French version prevails. Version française (fait foi)
These terms govern access to and use of the SAFE MAIL service. They apply to any organisation that activates it, on trial or on a paid plan. Activating the service, or subscribing to a plan, constitutes acceptance. SAFE MAIL is for businesses only and is not offered to consumers.
SAFE MAIL is published by Gatewatcher, a French simplified joint-stock company (SAS) with a share capital of €672,418, registered with the Paris Trade and Companies Register under number 810 505 248, EU VAT number FR72810505248, whose registered office is at 75 boulevard Haussmann, 75008 Paris, France (“Gatewatcher”). Contact: contact@gatewatcher.com.
“Customer”: the organisation that activates the service. “User”: any person of the Customer who accesses the Console. “Console”: the SAFE MAIL interface. “Protected mailbox”: a Customer Microsoft 365 mailbox covered by the service. “Plan”: Essential, Standard or Enterprise.
SAFE MAIL uses an artificial intelligence model to analyse messages received in the Customer’s Microsoft 365 mailboxes after delivery, in order to detect fraud: payment fraud, credential theft, impersonation, malicious attachments and QR codes.
Depending on the Plan and the Customer’s settings, SAFE MAIL flags the message, applies a label, or sets it aside in a dedicated folder. SAFE MAIL never deletes a message. A message the service could not analyse is never considered safe and triggers no action; it is automatically retried for 72 hours.
SAFE MAIL complements the Customer’s existing protections (spam filter, antivirus) and does not replace them. It does not scan for viruses. No solution detects every fraud: Gatewatcher is bound by an obligation of means.
The service is activated by a Microsoft 365 administrator of the Customer, who grants SAFE MAIL two permissions: read and write mail, read the directory. The Customer warrants that this person is authorised to grant them. The Customer may withdraw these permissions at any time from Microsoft Entra; the service then stops working.
Every new organisation receives a 7-day free trial, with no credit card, with the features of the Standard plan. A quote request extends the trial by 30 days, once.
At the end of the trial, without a subscription, analysis stops. The Customer can still view the Console, subscribe to a Plan, return a message that was set aside, or leave the service.
Public prices, excluding tax, per Protected mailbox per month are: Essential €2.50; Standard €4.00; Enterprise €5.00; Enterprise Premium €12.00. Yearly payment of the Essential and Standard plans carries a 20% discount. The Enterprise and Enterprise Premium plans are available online at list price, or on quote for a negotiated contract: purchase order, invoice, bank transfer, annual commitment.
The number of Protected mailboxes billed is the number of mailboxes covered by the service; it is recalculated daily. The choice of processing region is included in every Plan at no extra cost. Gatewatcher may change its prices with at least 30 days’ notice; the new price applies from the next period.
Payment is made by card or SEPA direct debit, through Stripe. From 200 Protected mailboxes, and for the Enterprise plan, the Customer may be invoiced for payment by bank transfer within 30 days.
Late payment incurs penalties equal to three times the French statutory interest rate, plus the fixed €40 recovery fee provided by the French Commercial Code. A declined payment is followed by reminders; if it is not settled, the service may be suspended.
Monthly payment: no commitment, cancellable at any time. Yearly payment: 12-month commitment, renewed for 12 months unless cancelled before the renewal date. Enterprise plan: as per the contract; when it expires, the service is maintained for 30 days before any stop.
Termination takes effect IMMEDIATELY on the service: as soon as it is requested, SAFE MAIL stops all monitoring, returns every quarantined message to its original folder, deletes its subscriptions to the Client’s mailboxes and erases the Client’s data. The Client does not have to wait for the end of the period for access to stop.
The current period remains payable. Cancelling mid-month gives no pro-rata refund: the month already started is invoiced, and it is the last one. On yearly payment, cancelling ends the renewal; the committed year remains payable. In short, access stops at once, billing stops at the end of the period already begun.
One last step belongs to the Client alone: removing the authorisation granted to SAFE MAIL in their Microsoft Entra directory (Enterprise applications → SAFE MAIL → Delete). Gatewatcher cannot do it on their behalf — the application does not hold the permissions that would allow it, and that is deliberate. Until this removal is done, the authorisation remains at Microsoft, without any data reaching us since every subscription has been deleted.
On termination, SAFE MAIL first returns every message that was set aside to its original folder, then stops all monitoring and erases the Customer’s data. Only a record of the erasure (domain name, date, author) is kept, as evidence.
For the Enterprise plan only, and unless the contract provides otherwise, Gatewatcher commits to: (a) a monthly availability of the analysis service of at least 99.5%; (b) judging 95% of messages within 60 seconds of their notification by Microsoft. These measurements are calculated monthly and shown to the Customer in the Console.
Not taken into account: unavailability of Microsoft 365, maintenance announced at least 48 hours in advance, force majeure and causes attributable to the Customer.
If an objective is missed in a month, the Customer may request, within 30 days, a credit of 10% of the monthly amount of its Plan per missed objective, capped at 30%. This credit is the sole compensation owed under the service level. The Essential and Standard plans carry no quantified service level.
The Customer uses the service lawfully. It informs the people whose mailboxes are protected that the processing exists and, where applicable, its employee representative bodies. It secures access to the Console and does not attempt to circumvent the service’s technical limits or to use it to the detriment of third parties.
For the analysis of messages, the Customer is the controller and Gatewatcher acts as processor, on the Customer’s instructions, within the meaning of Article 28 GDPR. These provisions constitute the data processing agreement; a separate agreement may be signed at the Customer’s request.
The content of messages and attachments is read in memory for analysis and is never stored. Kept in order to alert the Customer: sender, subject, date, score, reasons for the verdict, attachment names and its Users’ decisions — for 365 days by default, a period the Customer can set between 30 and 1,095 days. No data is used to train an artificial intelligence model.
The Customer chooses its processing region. When the chosen region is not yet open, analysis is performed by the provider shown in the Console, which displays, for each message, the provider actually used. Gatewatcher’s sub-processors are the platform host (OVH, in France), the analysis model provider shown in the Console, and Stripe for billing.
Gatewatcher notifies the Customer of any personal data breach concerning it without undue delay and no later than 48 hours after becoming aware of it, and assists it in responding to data subject requests.
Each party keeps confidential the other’s information it learns through the service, for its entire duration and three years afterwards.
The service, its software, its question sets and its documentation belong to Gatewatcher. The Customer receives a personal, non-transferable right of use for the duration of its subscription. The Customer’s data remains its property.
Gatewatcher is bound by an obligation of means. It does not guarantee the detection of every fraud and is not liable for losses resulting from undetected fraud, nor for indirect damages. Except in case of gross negligence or wilful misconduct, its liability is limited to the amounts paid by the Customer in the 12 months preceding the event giving rise to the claim.
When the Customer goes through a Gatewatcher partner, it alone decides what access to its Console it grants that partner, and may withdraw it at any time.
Gatewatcher may change these terms with at least 30 days’ notice to the Customer. A Customer who refuses them may terminate before they take effect.
These terms are governed by French law. Failing an amicable settlement, any dispute falls within the jurisdiction of the competent courts of Paris.