mailsign365What we can read, what we store, and how to leave
An email signature tool touches people's names and phone numbers. Here is the whole list.
Permissions you approve
A Global Administrator approves these once, on Microsoft's own page. They are application permissions, so mailsign365 can read the directory when nobody is signed in. None of them gives access to mail, files or calendars.
| Permission | Why | Required |
|---|---|---|
User.Read.All | Read name, job title, department, phone numbers, office and address for the signature, and find people for rules and licences. | Yes |
Group.Read.All | Let you assign a signature or licences to a group. | Yes |
GroupMember.Read.All | Work out which groups a sender belongs to when a message starts. | Yes |
ProfilePhoto.ReadWrite.All | Only for the optional Photo Manager that sets profile photos. Signatures work without it. | No |
access_as_user (delegated) | Sign people in to the admin portal and the Outlook add-in. | Yes |
What the Outlook add-in sends
To choose a signature the add-in sends the sender address, whether the message is new, a reply or a forward, and the domains of the recipients, for example example.com and not the full addresses. It does not send the subject, the body or recipient names. Your mail does not pass through our servers.
What we store
- Your signature templates, their history, your rules and policy settings, shared mailbox grants and licence assignments.
- Images you upload. They have public addresses, because recipients' mail apps load them without signing in.
- An audit trail of administrative changes, and the names and email addresses of your administrators.
- The mailbox addresses and names you license, and the people you name for shared mailboxes.
- Other directory data, such as titles and phone numbers, is kept in memory for up to one hour while it is used to build signatures. It is not saved in the database.
We do not store your mail, passwords or Microsoft sign-in tokens.
Profile photos in email
A profile photo in a signature is a link that anyone who receives the email can open. The link is signed, so it cannot be guessed from a person's ID, but it cannot be recalled once the email is sent.
How to leave
- Disconnect your organisation in the admin portal. Signatures stop, cached directory data is dropped, and photo links stop working.
- Delete the enterprise application in your Entra admin center. That withdraws our permissions at Microsoft. We recommend doing both.
- Your templates and settings are kept for 60 days after a plan ends, then deleted. After you disconnect we delete them when you ask. Ask us for an export first if you want one.
Emails you already sent keep their signature, and the images in them keep loading while we run the service.
What we do not claim
mailsign365 has no security certification and has not had a penetration test. We would rather say so than imply it.
Reporting a problem
Use the contact details on the contact page and say that it is a security report.