API keys and provider selection, stored on the server — changes apply to the next review, no restart or `.env` edit needed.
Your own organization's profile — this becomes the "Primary" company on the Companies page if Multi-Tenant is ever turned on, so it's the same record either way, just edited here while there's only one.
Which model produces the verdict/reasoning/recommendation shown on every review.
Where link/attachment detonation actually runs.
EDR alert intake — the SentinelOne sub-tab under Review → EDR.
Quarantine release-request intake — the Trustifi sub-tab under Review → Email.
Listing release requests, building a review from Trustifi's own threat-analysis findings, real body/attachment content via the confirmed preview endpoint, and release/reject actions are all confirmed and working. See backend/app/services/trustifi_client.py for the full endpoint-by-endpoint confirmation log.
Automated release/reject
When on, a completed Trustifi review auto-releases or auto-rejects itself the moment its AI verdict
confidence clears the threshold below — no analyst click needed. A "suspicious" verdict, or one that
doesn't clear its threshold, is always left for an analyst regardless of these settings.
A safe verdict at or above this confidence auto-releases the email, marked "AI Agent Released".
A malicious (or critical) verdict at or above this confidence auto-rejects the email, marked "AI Agent Rejected". Below either threshold — or any suspicious verdict — is left as "Awaiting analyst review".
Two independent ways to let techs forward a suspicious email and have it appear automatically — pick one, both, or neither.
Cloudflare Email Routing recommended
No mail server here and no provider paid tier needed. Pairs with the Cloudflare Email Worker in
integrations/cloudflare-email-worker/ — deploy it, set the same secret as its
INBOUND_SECRET, and point a Cloudflare Email Routing rule at it. A request with a
missing or wrong secret is rejected with a plain 404. See DEPLOY.md for the full walkthrough.
Brevo requires Enterprise plan
Brevo receives the mail and POSTs it to this app. Requires a Brevo Enterprise plan for the inbound-parse
feature itself, and Brevo's own content terms are worth checking before forwarding malicious samples through
it. Generate a long random string, save it here, then register it as the webhook URL in Brevo:
https://<this-app>/api/inbound/brevo/<the-secret-above>. See DEPLOY.md
for full setup (DNS records, webhook registration).
Optional external threat-intel lookups — every check already has a keyless fallback, these add more/better signal.
Free tier at abuseipdb.com — without this, the IP tab still works (known-bad list, VirusTotal, geolocation) but skips abuse-report history.
Off by default. Turning this on adds a "Companies" tab and a company switcher (next to your avatar, on every page) so reviews, the Shift Log, Dashboard trends, and the threat map can be scoped to a specific client instead of blended together — the way an MSP would separate its own clients under one deployment. One illustrative example company is created automatically the first time this is turned on.
Turning this back off doesn't delete anything — every other company's data just stops showing anywhere (including the switcher itself) until it's turned on again.
Recent CVEs pulled from the National Vulnerability Database (NVD) — no key required — filtered to the vendors checked below, shown on the Feeds page. Read-only monitoring; nothing here takes automated action.
Vendors monitored
Only CVEs affecting at least one checked vendor show up on the Feeds page. Unchecking every vendor reverts to monitoring all of them (the default), rather than none.
Saves every setting on this page, not just the tab currently shown.