The trust and permission layer
For AI & devs: Garden gives every agent a separate room for every job. You choose the agent, its scope, and the one service allowed through the door. Your agent needs an address. Not your life.
For privacy-first: Every Garden inbox is tied to the one service you made it for. Mail from anyone else is refused at the door. Your address can leak — your inbox still can't be reached. One inbox. One sender. Nobody else.
Default deny architecture
Traditional email uses a Default Allow Architecture: accept the message first, then ask filters to sort people from threats. Garden's Default Deny Architecture reverses the rule. Every sender is rejected until one explicit link opens one private route.
Default Allow asks: "Does this look dangerous?" Default Deny asks: "Is this sender Single-Linked?" One linked message arrives. Everything else is rejected by architecture — no classification required.
Single-Linked Inboxes
Every Garden inbox is linked to one other email address. Only that linked address can send to it and receive from it. The permission runs both ways — and nowhere else. 1 linked sender; up to 3 as an exception.
Give the agent a room. Not the house.
When an AI agent acts on your behalf, you delegate part of your identity and the rights needed for a specific job. Mailbox access hands over far more than the job requires; Garden gives the agent only the identity, messages, and permissions for that room. One task → one inbox → one agent.
Mailbox OAuth: one grant opens the whole house — the task is small, the permission boundary is not, and one breach anywhere in the access chain can expose the full reachable history. Garden grant: one grant opens one room. Every service gets one inbox. The agent works in that room only. Mailbox OAuth: choose a task, hand over an identity. Garden: choose a task, share its room.
Your Garden, your agents — working side by side
Garden is the infrastructure underneath, not a walled garden. Any agent can connect to it, whichever model it runs on — and you decide, inbox by inbox, which ones get in.
Humans and AI agents using Garden, together
Garden is built for both to work in the same inbox: make an inbox, refuse everything unlinked, get asked once, receipt every agent action, set the grant level, stop all of it with one switch, and give the people you work with their own address. One service → one inbox → one sender → one grant.
Creating a single-linked inbox is easy
Name an inbox for one service. Garden writes the address, you link the real sender, and that becomes the whole guest list. Or skip the UI entirely: the Garden MCP lets the AI agents you already use create an inbox for you. Make as many as you like — inbox counts are set by your plan, and every one is single-linked from the moment it exists.
No phishing, no spam, no scams, no prompt injection
Only the linked sender reaches the inbox. Phishing lookalikes, brokered-list spam, and scam domains are blocked by the default-deny architecture — and with nothing unlinked arriving, an agent reading this inbox has no untrusted text to be injected by. Garden's inbox stays ordinary because refused mail never becomes something you need to manage.
Quarantine: human in the loop, asked once
A first message from an unknown sender waits in plain text. Confirm it once and that inbox is single-linked to that sender. For already known services the senders are already known and inboxes single-linked by default. Links and images stay disabled while the sender is unverified. The approval itself is recorded.
Every message proves who sent it
SPF, DKIM and DMARC are checked before delivery, not after. Mail that cannot prove its sender is refused rather than filed away, and what does arrive is encrypted in transit and at rest, in the region you chose. Trackers stay dead: messages open as plain text, so nobody learns when you read or from where.
Every AI agent action leaves a receipt
Reads, refusals, approval requests, and created inboxes share one activity ledger. Close the Garden gate and new work queues without disappearing.
Four grant levels. You pick one.
L1 proposes and drafts. L2 acts inside your rules, but you tap Send. L3 creates inboxes within budget, approves registry-verified senders, and sends with a recall window. L4 does all of it under a hard cap, opted in per inbox. Every level is granted per inbox, fully receipted, and revocable without touching the mail.
One switch stops every agent
Close the Garden gate and all agent activity pauses at once — one agent, one inbox, the whole org, or the platform. Work queues instead of failing, and nothing already receipted disappears. Open the gate again and the queue runs, in order, with a receipt each.
No model reads your mail
Your messages are never used to train AI, and no classifier or language model runs over them. There is no ad profile, no content scanning, and no third party in the middle — the only reader is you. If you choose to give an AI agent access, it happens per inbox, on your grant, and every action is receipted.
People get inboxes too
Give your accountant or your mother her own address, linked to her. Nobody else can ever use it — not even by guessing, and no agent reads it unless you say so. Family, friends, clients, contractors: one address each, and each one opens only for the person it was made for.
Your mail shouldn't need a passport
Most email lives wherever storage is cheapest, under laws you never voted on, reachable by requests you are never shown. Garden asks one question at signup — and then holds the line. Chosen at signup, moved only on your request: European Union (Frankfurt, eu-central-1, GDPR) or India (Mumbai, ap-south-1, DPDP Act). United States — not offered: broad cross-border demands and bulk collection are exactly what people come to Garden to leave behind.
Others hide your address. Garden locks the door.
Comparison based on publicly documented features, August 2026. Names belong to their owners.
| What you get | Garden | Gmail | Outlook | Proton Mail | Hide My Email | AgentMail |
|---|
| Inbox accepts mail from linked senders only | Yes | — | — | — | — | — |
| Lookalike and spoofed senders rejected, not filed | Yes | Spam folder | Spam folder | Spam folder | Forwards on | — |
| A separate address per service | Yes | — | — | Paid add-on | Yes | Yes |
| You choose the country your data lives in | EU or India | — | — | Switzerland only | — | — |
| A real mailbox, not just forwarding | Yes | Yes | Yes | Yes | — | Agents only |
| Humans and AI agents share the same locked inboxes | Yes | — | — | — | — | Agents only |
| Every agent action logged as a receipt | Yes | — | — | — | — | API logs |
| Your mail is not scanned for advertising | Yes | Ads in inbox | Ads in inbox | Yes | Yes | Yes |
Start free. Stay free, if you like.
Free — $0 forever
Enough to lock down the accounts that matter most: 10 single-linked inboxes, 500 emails a month in and out, your choice of region — India or EU, quarantine for first contact.
Privacy — $4.99 a month, or $49.90 a year (2 months free)
For your whole online life, on your own domain: 1,000 inboxes, 5,000 emails a month in and out, custom domains, access-request auto-reply, 1-year ledger retention.
AI — $29.99 a month, or $299.90 a year (2 months free)
For developers, freelancers and startups building with agents: everything in Privacy, unlimited inboxes, 20,000 emails a month then metered, unlimited agents (L0–L4 per grant), MCP and inbox-per-task, unlimited ledger with export.
Questions people ask
What if the service writes from a new address?
It lands in quarantine, exactly like the first message did. You confirm once, it joins the linked list — up to three addresses per inbox — and it is never questioned again.
Do I have to change my email address?
No. Keep the old one for the people who already have it. Use Garden for everything new — every shop, service and signup from today on.
So what actually happens to a spam message?
The sender isn't on that inbox's linked list, so Garden refuses it at the door — it is never accepted into your inbox at all. No spam folder to check, no false positives to rescue, no daily triage.
Can I use one inbox for a person instead of a service?
Yes. Give a friend or a family member their own Garden address, linked to them. If it ever leaks, no stranger can use it.
Can I change my region later?
Yes. You select the new region and the Garden team initiates the data transfer — nothing moves quietly in the background. This feature is currently in development.
What can an AI agent actually see?
Only the inboxes you grant, and those inboxes only ever contain mail from their linked senders. Reading is not sending. Every action is a receipt, and the garden gate stops all of it at once.
Plant your first inbox
Two minutes. One question about where your data lives. Then an inbox that only your bank can write to, for the rest of your life. No card · free tier forever · eu-central-1 or ap-south-1.