Security at SignatureSync
What we keep about your organization, what we never touch, and why we ask Microsoft for each permission.
What we store
- Your organization
- Microsoft 365 tenant ID, organization name, verified domains, who approved access and when, the permissions granted, and your settings.
- Directory profile of each user
- Sign-in name (UPN) and email, display, first and last name, job title, department, office, office and mobile phone, company, employee type, the extra attributes your field mapping uses, account type (user, shared, room), whether the account is enabled, and the profile photo (as PNG or JPEG). Refreshed on every sync; removed users are marked, not listed.
- Groups
- Names of Microsoft 365 groups and their members’ directory IDs, plus the groups and rules your admins create.
- What people choose in the portal
- Fields your admins let users edit, such as mobile number, pronouns or a booking link, and whether to show their photo.
- Signature templates and images
- Template designs and their published versions, and the logos and banners admins upload.
- Send events
- One row each time the add-in asks for a signature: organization, sender’s UPN, time, outcome, template version and signature size in bytes. Nothing about the message itself.
- Admin sign-ins and the audit log
- Who signed in, their role and where it came from; and every admin, user-portal and sync change with before and after values, the actor and their IP address. Audit entries are kept for 365 days.
What we never store
- Email bodies, subjects or attachments
- Recipients (To, Cc, Bcc) of any message
- Anything in anyone’s mailbox, calendar or files
- Passwords. Sign-in happens on Microsoft’s own page
The Outlook add-in only asks our server for the sender’s signature and writes it into the message being composed. It never sends us the message.
Microsoft permissions and why
| Permission | Type | Why |
|---|---|---|
| openid, profile, email, offline_access, User.Read | Delegated | Sign you in with Microsoft and keep you signed in. |
| User.Read.All | Delegated + Application | Read names, job titles, departments, phones and photos for signatures. |
| GroupMember.Read.All | Delegated + Application | Read Microsoft 365 group membership used to pick each person’s template. |
| Organization.Read.All | Delegated + Application | Read your organization name and verified domains. |
| Mail.Send | Delegated | Send a test email of a signature from the signed-in person’s own mailbox to themselves, only when they click Send test. It cannot read mail. |
Application permissions let the scheduled directory sync run without anyone signed in. We don’t ask for Mail.Read, mailbox settings or Exchange management rights. The add-in’s own permission (ReadWriteItem) lets it write the signature into the message you are composing, and nothing else.
Where it lives and how it is protected
- Everything above is kept in one PostgreSQL database hosted in [HOSTING PROVIDER, REGION], including photos and uploaded images.
- All traffic is HTTPS. Every database query is scoped to one organization.
- Microsoft sign-in tokens are kept in an encrypted session cookie, not in our database. The add-in uses a per-organization key that only returns signatures for your own domains.
- Admin access follows your Entra ID roles and is re-checked at least every hour.
- Disconnecting in Settings stops sync and signatures at once. To delete your data, contact [SECURITY CONTACT EMAIL].
Report a problem
Found a vulnerability? Email [SECURITY CONTACT EMAIL]. See also our privacy notice and service status.