Security
Careful with your mailboxes.
Oofly sets automatic replies on other people's mailboxes, so it has to be trustworthy. Here is what it can and cannot do, how customers are kept apart, and where data lives.
01Practices
Kept apart, by design.
No access to mail
Oofly asks Microsoft for mailbox settings, where automatic replies live, and never for messages. It cannot read, send or delete email.
Your organisation comes from your sign-in
Every request is checked against your Microsoft sign-in, and your organisation is taken from that sign-in, never from a link or a form. No address in Oofly names another customer.
One tenant, one organisation
Each Microsoft 365 tenant is exactly one Oofly organisation. Every record carries it, and every query is limited to it.
Tokens that stay at home
Oofly asks Microsoft for access to each customer separately, from that customer's own tenant, so a token for one organisation cannot open another's mailboxes, even through a mistake in our code.
Consent proved, not assumed
Nothing works until a Global Administrator approves Oofly and Oofly confirms with Microsoft that the approval is for your tenant.
Roles inside your organisation
Owner, Administrator, Delegate and Member are looked up inside your own organisation only. A role somewhere else never counts.
Secrets in Key Vault
Keys and connection details live in Azure Key Vault and are read by the application's managed identity, never stored in code.
Private by network
The application only accepts traffic through Azure Front Door with a web application firewall, and outbound traffic passes through a firewall.
Audit log
Every reply set or changed, and every change to templates, delegates and roles, is recorded with who made it and when.
02Permissions
Exactly what Oofly asks for.
These are the Microsoft Graph application permissions your administrator approves once for your organisation. They can be removed at any time under Enterprise applications in Microsoft Entra.
03Infrastructure
Where your data lives.
Personal data is stored and processed inside the European Union. Nothing is sold, and directory details are never shared with advertisers.
- Cloud
- Microsoft Azure
- Application
- West Europe (Netherlands), EU
- Database
- Azure SQL Database, Germany West Central (Frankfurt), EU, private network only, a database of its own
- Secrets
- Azure Key Vault
- Edge
- Azure Front Door with web application firewall
- Sign-in
- Microsoft Entra ID, work and school accounts only
- Payments
- Stripe
- Resend
04Certified infrastructure
Built on audited infrastructure.
Oofly runs entirely on Microsoft Azure, which is certified to ISO/IEC 27001 and independently examined for SOC 2 Type 2 every year. Those certifications are Microsoft's and cover the infrastructure; Swyft Software Limited is not itself certified to ISO/IEC 27001 or SOC 2.
05GDPR
Your rights, respected.
Your organisation remains the controller of its people's data, and Oofly acts as its processor. Access, correction, erasure and portability requests are handled through our privacy centre.
Questions from your security team?
We are happy to answer them before you start.