Security information
Security is an ongoing engineering and operations responsibility. This page describes intended controls and does not claim a completed certification or independent audit.
Status note: this page describes design intent; it is not a certification or independent audit.
Access and isolation
The design requires tenant-scoped access checks for application data, including background work. Microsoft mailbox permissions should be verified through Microsoft rather than accepted as a client assertion.
Data and providers
Email content and provider payloads require careful minimization and handling. Provider terms, retention, and residency approvals are prerequisites that must be confirmed for the relevant deployment.
Operational status
Monitoring, backup and restore exercises, incident procedures, and third-party reviews must be completed and documented before any security readiness claim is made.