Outlook security overview

This page is for your IT, security and legal teams. It explains how the ept AI Outlook email and calendar integration accesses, processes, stores and protects your data. You can send the link to anyone who reviews the integration.

Back to Integrations Overview · Admins: Set up Outlook · Users: Connect your Outlook

Summary

• Nothing is connected by default. Your Microsoft admin consents to the ept AI Outlook app once. After that, each user connects their own mailbox. ept AI cannot read a mailbox that its owner has not connected.
• Read-only. All Microsoft permissions are delegated and read-only. ept AI cannot send, edit, move or delete email or calendar events.
• Nothing is shared by default. Each email and meeting stays visible only to its owner until the owner shares it to a room, by hand or through a rule.
• Not used for training. AI processing runs under a zero data retention agreement. Your data is used only to provide the service to you.

Data flow

1. Admin consent. Your Microsoft Entra admin approves the ept AI Outlook app. The admin can require user assignment, so only named users can connect.
2. User connects. The user signs in to Microsoft as themselves (OAuth 2.0 authorization code flow with PKCE). The token is stored in AWS Secrets Manager, one secret per user connection.
3. Ingest. On connect, ept AI reads the last 60 days of mail and calendar, and calendar events for the next 180 days. After that, Microsoft Graph change notifications deliver new and changed messages, sent and received, within minutes. A daily sweep catches anything missed.
4. Filter. Before anything is stored, ept AI drops newsletters and bulk mail (List-Unsubscribe or Precedence: bulk headers), auto-replies, no-reply senders, Focused Inbox "Other" mail and BCC-only copies. Executable attachments (.exe, .bat, .cmd, .scr) are skipped, and attachments are capped at 25 MB per message.
5. Store. For everything else, ept AI stores an encrypted copy of the body and attachments, and a metadata record. Only the mailbox owner can see them.
6. Classify. An AI model rates each item's sensitivity and matches it to your customers, deals, applications and competitors in ept AI (see AI processing).
7. Owner decides. Each item waits in the owner's Sharing Review queue until the owner shares or rejects it, or one of the sharing rules does it.

Calendar events use the same connection. Events that Outlook marks private, personal or confidential are always rated high sensitivity.

Microsoft permissions

All scopes are delegated. The Outlook app has no application (app-only) permissions.

Scope	Type	Purpose
openid	Delegated	Sign-in
profile	Delegated	Basic profile
email	Delegated	Email claim
offline_access	Delegated	Refresh token
User.Read	Delegated	The signed-in user
Mail.Read	Delegated	Read the user's mail
Calendars.Read	Delegated	Read the user's calendar

Not requested: Mail.Send, Mail.ReadWrite, Calendars.ReadWrite, or any app-only mail permission.

Revocation. Revoke the app's consent, remove a user's assignment, or disable the user in Entra, and ept AI can no longer get new tokens. Access ends when the current access token expires, usually within about an hour.

What ept AI stores, and where

Every record carries your account ID and the owning user's ID. Database tables are in Aurora PostgreSQL. Content is in Amazon S3, partitioned by account, integration and user connection.

Data	Store	Who can see it	Removed
OAuth token	AWS Secrets Manager, one secret per user connection	No person. Read only by the connector and data services	Immediately, when the user disconnects
Email and calendar metadata: subject, sender, recipients, dates, thread ID, attachment names and sizes	Database	Mailbox owner	When the user disconnects, or at contract end
500-character preview	Database	Mailbox owner	When the user disconnects
Email body, attachments, calendar description	Encrypted Amazon S3	Mailbox owner, until shared	At contract end, or on request
AI classifications: sensitivity scores and reasons, suggested rooms, importance, a short matching excerpt	Database	Mailbox owner	When the user disconnects
Duplicate grouping (one email received by several connected users)	Database	Recipients of that email	When the integration is removed
Sharing rules	Database	The user who made them	When the user is deleted
Shared items: a link from the email to the room; attachments become room documents; email text feeds that room's reports	Database and S3	Members of that room	When the owner reverses the share, or at contract end
Sender statistics (sender address and counts)	DynamoDB cache	No person. Used to detect bulk senders	After 90 days

Not stored: mail the pre-filter drops, skipped attachment types, and mail of users who have not connected.

AI processing

What the model sees. For each stored item, the classification models receive the subject, participants, body text, text extracted from attachments, and short previews of up to 10 earlier messages in the same thread. The models match the item against your own rooms (customers, deals, applications, competitors, people and products) and nothing outside your account.

Provider. Classification runs on OpenAI models, called through the OpenAI API from ept AI's AWS environment. ept AI's OpenAI agreement is zero data retention: OpenAI does not store inputs or outputs and does not train on them. OAuth tokens and credentials are never sent to a model provider.

Check	What it does
Sensitivity	The model scores each item from 0 to 100 for the user, the customer and the company, plus an overall score, and gives a low, medium or high band. These raise the score to high: criticism of a named person; credentials or keys; HR actions, compensation, visa or immigration; legal, audit or litigation; M&A, reorganizations or board matters; personal health or family; anything meant to stay between two people. HR, legal and immigration content and private calendar events are always high. If the model fails, the item is set to medium. The owner sees the band and a short reason.
Relevance	The model suggests up to 8 rooms for each item. Each suggestion has a confidence, an importance band (low to critical), a reason and a short excerpt that shows the match.

Who can see what

ept AI is multi-tenant. Every record and every user is keyed to the customer account. On every request, ept AI limits the query to the requesting user's account and permissions before any data reaches the AI. A user in one account cannot get to another account's data.

Data	Who sees it in ept AI
Email or meeting, not shared	The mailbox owner only
Email or meeting, shared to a room	Members of that room

What sharing shares. When an item is shared to a room, room members and the room's reports get the whole email: the body and attachment text, not only the matching excerpt. When several connected users received the same email, it is reviewed once, and a share by any recipient shares that message.

Reversible. The owner can reverse a share at any time. This removes the item from the room, deletes the room documents made from its attachments, and removes the item's text from that room's reports.

Disconnect. When a user disconnects, their token is deleted, their review queue and AI classifications are deleted, and new Microsoft notifications for that user are ignored. Items in flight finish within minutes. Items the user already shared stay in their rooms until the share is reversed. ept AI deletes the stored email copies at contract end or on request.

Security controls

Control	Detail
Hosting	AWS, us-east-1. Aurora PostgreSQL, Amazon S3, DynamoDB
In transit	TLS 1.2 or higher
At rest	Aurora: encrypted with ept AI-managed AWS KMS keys. Amazon S3 (email content): bucket encryption, versioning and lifecycle rules. DynamoDB and Secrets Manager: encrypted with AWS KMS
OAuth	Authorization code flow with PKCE (S256). Tokens in AWS Secrets Manager, one secret per user connection, readable only by the connector and data services. Never on processing queues, in content records or in logs. Deleted on disconnect
App credentials	Entra app client secrets in AWS Secrets Manager
Change notifications	Each Microsoft Graph subscription carries a random secret, checked on every notification
Logging	Application logs record IDs and status, not email subjects or bodies
Sub-processors	AWS: hosting, storage, tokens. OpenAI: AI processing of email content, under zero data retention
ept AI staff access	ept AI engineers have no access to stored customer email, including through production support roles. ept AI staff who use the platform follow the same rules as any user and cannot see a user's unshared email

Retention and deletion

You own your data. ept AI keeps Outlook content while the integration is in use, so owners can review and share items.

• Backups. Customer databases are backed up daily. Each backup is kept 30 days and is encrypted with an ept AI-managed KMS key.
• Email content. Stored email and attachments are in an encrypted Amazon S3 bucket with versioning and lifecycle rules.
• Deletion. At termination, at expiry or on request, ept AI deletes your live data within 30 days. This includes email and calendar copies, attachments, metadata, classifications, shared items and tokens. Backup copies age out within 30 days. Deletion is confirmed in writing.

Assurance

Item	Available
SOC 2 Type II report	On request, under NDA
Penetration test summary	On request, under NDA
Secure development policy	On request

Contact security@ept.ai.

Common questions

Question	Answer
Can ept AI send, change or delete email?	No. It has Mail.Read and Calendars.Read only.
Can ept AI read a mailbox nobody connected?	No. All Outlook access is delegated by the mailbox owner.
Does ept AI keep a copy of email that was not shared?	Yes. It is encrypted and visible only to its owner. Review data is deleted on disconnect. Content copies are deleted at contract end or on request.
Who in our company can see an unshared email?	Only the mailbox owner.
Who at ept AI can see our email?	No ept AI engineer.
Are highly sensitive emails shared automatically?	Only if a sharing rule approves them. Users can add reject rules that override approve rules.
What does the AI provider receive?	The content of stored email, for classification, under zero data retention. Never tokens. Not used for training.
Can we limit who connects?	Yes. Require user assignment on the ept AI Outlook app in Entra, and add Conditional Access if you use it.
What happens when someone leaves?	Disable them in Entra and Microsoft access ends. Ask ept AI to delete the user, and their review queue and rules are removed.
How is our data kept apart from other customers?	Every record and user is keyed to your account, and every query is limited to it.
Where is our data?	AWS us-east-1.
If we stop using ept AI, is our data deleted?	Yes. Live data within 30 days. Backups age out within 30 days.

Related

• Outlook for admins
• Outlook for users
• SharePoint & OneDrive — separate Microsoft 365 document integration