Security and your data

Last updated: October 23, 2026

Drumkit is SOC 2 compliant. Your email is processed in Drumkit's cloud through the Microsoft or Google connection your organization approves. What the Chrome extension reads on bidding portals and TMS pages is processed in your browser.

Compliance

Drumkit is SOC 2 compliant. If your security team needs our report or has a questionnaire for us, email support@drumkit.ai.

How Drumkit gets your email

  • Outlook and Microsoft 365: Drumkit connects through Microsoft Graph, Microsoft's official API, using the permissions your Microsoft admin approves. Microsoft lists them on the consent screen: sign in and read your profile, read and write your mail, send mail as you, and keep access to what you've approved. See For IT admins: Microsoft Entra consent and deployment.
  • Gmail and Google Workspace: Drumkit connects through Google's Gmail API, with the permissions Google shows you when you sign up.

Drumkit only connects to a mailbox after that person signs up. Approving Drumkit for your organization doesn't give it access to anyone's email on its own.

New email that arrives in a connected inbox is processed in Drumkit's cloud. That's how Kit can have a quote request or tender ready before you open it. Drumkit keeps the information it needs to run the product for you, such as your quote requests, quotes, loads and history.

Why Drumkit can send mail

The "send mail" permission lets you send quotes and replies from the sidebar, and lets Drumkit put drafts in your mailbox. In the sidebar, mail goes out when you click send. If your team has the Quick Quote Agent turned on, it can draft or send replies, depending on how your team asked Drumkit to set it up.

The Chrome extension

On bidding portals and TMS load pages, the Chrome extension reads the page you have open so it can fill in Quick Quote or open the load. That page reading happens in your browser. The extension only works on the specific sites it supports, and it only opens when you click it.

Your TMS and rate sources

Drumkit connects to your TMS and rate sources (such as DAT) with the access your company sets up. Builder reads your customer and location records to fill in the load form. It creates a load in your TMS only when you click Build Load.

Who can see what

  • You see what Kit finds in your own inbox.
  • Your Drumkit admins can manage users and settings and see team usage and quoting metrics in the Drumkit Portal.
  • Drumkit staff access customer data to support you, for example when you forward us an email that Kit misread.

Removing access

A user can cut off Drumkit's access to their mailbox at any time by removing the Drumkit app from their Microsoft or Google account.

FAQs

Does Drumkit read my personal email?

Drumkit only connects to the work mailbox you sign up with. It puts something in the sidebar only when an email is a request it can help with.

Can Drumkit send email without me?

Not from the sidebar. Quotes and replies go out when you click send. The exception is the Quick Quote Agent. If your team asks for it, Drumkit can set it up to draft or send replies automatically.

Where do I send a security questionnaire?

Related