Technical detail for IT and security teams evaluating SwitchBoard121 — including administrators reviewing our Microsoft application consent request.
Microsoft 365 and Outlook mailboxes connect through the OAuth 2.0 delegated authorization flow via Microsoft Graph. Beyond signing in, SwitchBoard121 requests one mailbox permission, Mail.Send — we send introduction emails through your mailbox, and nothing more. We cannot read, search, forward, or delete anything already in your inbox; that access is never requested, and is not something the Mail.Send scope makes possible in the first place. SMTP mailboxes authenticate directly against the mail provider over TLS using credentials the user supplies.
| Scope | Purpose |
|---|---|
| openid, profile, email | Sign the user in and identify the account (name and email address) |
| User.Read | Read the signed-in user’s own basic profile, including the mailbox’s email addresses (used to recognize aliases) |
| offline_access | Keep the user signed in without asking again each time |
| Mail.Send | Send introduction emails on your behalf, from your own mailbox |
We collect what's required to operate the product, and nothing more.
Referral partner contact details, introduction records and send history, account and billing information.
Your broader mailbox contents, client financial data, or any email beyond what you compose through SwitchBoard121.
Data is retained for the life of the account. Closing an account removes the associated records from production systems.
Microsoft-connected mailboxes never require us to store a password — authentication is handled entirely by Microsoft's identity platform via OAuth. For SMTP mailboxes, credentials are sealed with envelope encryption before they are written to the database. They are never logged, and never returned in any API response.
| Hosting | Vercel |
| Database | Managed Postgres (Neon) |
| Encryption in transit | TLS 1.2+ on all connections |
| Secrets management | Encrypted environment configuration, no plaintext secrets in source |
| International data transfers | Covered by Vercel's Data Processing Addendum (EU Standard Contractual Clauses + UK International Data Transfer Addendum), in effect automatically as a Vercel Pro plan customer |
SwitchBoard121 is registered as a multi-tenant application in Microsoft Entra ID under the name “SwitchBoard121.” Formal publisher verification is in progress; until it completes, an administrator's explicit consent is required before anyone in an organization can connect a mailbox — self-consent by individual end users is not available. We consider this a feature, not a limitation: it keeps the decision in the hands of the people responsible for it.
Report a security concern to support@switchboard121.com. Reports are monitored and acknowledged within 24 hours.