Corstrate Email Tool — Security Overview

Document version: 0.3 — 2026-06-02 Owner: Imen Jelassi, Corstrate Founder Contact: ijelassi@corstrate.com Status: Operational reference. The Privacy Policy and Terms of Service are published at https://oauth.corstrate.com/privacy and https://oauth.corstrate.com/terms. For the processing described here, Corstrate is the data controller and is responsible for GDPR compliance, as set out in its client contracts.

1. Purpose of this document

This document gives IT administrators, security teams and Data Protection Officers (DPOs) the technical and organisational details needed to review the Corstrate Email Tool Microsoft 365 integration before granting OAuth admin consent.

If you have received an admin consent request in your Microsoft Entra portal for the application "Corstrate Email Tool" (App ID 905c5adb-20b1-4e7f-9d9b-3608e7639721), this document explains:

• What the application does
• What data it accesses
• Where data is processed and stored
• How you stay in control

For any question not covered here, please contact ijelassi@corstrate.com.

2. Application identity

You can independently verify the application identity by visiting:

• Your Azure Portal → Microsoft Entra ID → Enterprise Applications → search "Corstrate Email Tool"

3. Microsoft Graph permissions

The application requests the following delegated permissions (Microsoft Graph). All permissions are scoped to the consenting user's mailbox only — there is no tenant-wide or cross-mailbox access.

What this application does NOT do:

• ❌ It does not access any mailbox other than the user who consented
• ❌ It does not access calendar, contacts, OneDrive, SharePoint, Teams or any other Microsoft 365 service
• ❌ It does not delete emails
• ❌ It does not forward emails to external addresses
• ❌ It does not impersonate other users
• ❌ It does not require any tenant-level administrative permission

3.1 Sending practices — no bulk mail, rate-limited

The Corstrate Email Tool is a targeted B2B outreach tool, not a mass-mailing or newsletter platform. The Mail.Send permission is used in a deliberately constrained way:

• One recipient per message — each email is individually addressed and personalised to a single identified business prospect; never a bulk send to a recipient list or distribution group.
• Rate-limited and paced — sending is throttled by design (a configurable delay between messages and pauses between small batches). Typical volume is in the low hundreds per day per mailbox, well within Exchange Online service limits (10,000 recipients/day, 30 messages/minute, 500 recipients/message).
• Operator-controlled — campaigns are launched and supervised by a human operator from the Corstrate cockpit; there is no autonomous, unsupervised mass sending.
• Suppression respected — the tool automatically stops contacting any address that opts out or hard-bounces, and excludes leads whose company has already responded.
• One mailbox per engagement — no cross-mailbox or tenant-wide sending.

This keeps sending volume and pattern modest and well within your tenant's service limits.

4. Data flow

4.1 What data leaves the mailbox

The application reads and processes the following data:

The application never accesses, processes or stores:

• Attachments of inbound replies
• Emails unrelated to ongoing outreach campaigns (the application matches replies via the In-Reply-To header against tracked outbound message IDs)
• Personal emails of the mailbox user

4.2 What stays in the mailbox

• Email content remains in your tenant's Microsoft 365 storage at all times for sent items, drafts and inbound replies
• The Corstrate platform stores derived data (sender address, message ID, classification, reply excerpt) — not a full copy of the mailbox

5. Sub-processors and data residency

All Corstrate data processing happens within the European Union.

No Corstrate data is processed in or transferred to non-EU jurisdictions outside of the Cloudflare edge network (TLS termination only, no persistent storage) and the Microsoft Graph API path (under Microsoft's own data residency commitments).

6. Security controls

6.1 Authentication

• OAuth 2.0 Authorization Code with PKCE — no client secret, no service account
• Permissions are granted via user delegated consent (or admin consent at your discretion)
• Refresh tokens are stored exclusively on the operator's local macOS Keychain — never on a server, never in environment variables, never in logs
• The application implements prompt=select_account to ensure the consenting account is explicitly chosen by the operator, preventing accidental cross-tenant token issuance

6.2 Encryption

6.3 Audit logging

All authentication and API events are visible to your tenant through Microsoft's standard audit infrastructure:

• Microsoft Entra ID → Sign-in logs : every silent token refresh and interactive sign-in by the application
• Microsoft Entra ID → Audit logs : Consent to application event when admin or user grants consent
• Microsoft 365 Defender (if licensed): "OAuth apps" dashboard shows the application's risk score and activity

You can revoke access at any time from Azure Portal — the application will lose access immediately on the next token refresh attempt.

6.4 Application security practices

• Source code reviewed for OWASP Top 10 vulnerabilities
• No third-party JavaScript in mailbox-facing components
• HTTP Content Security Policy enforced on web interfaces
• Dependencies tracked and updated on a regular cadence

6.5 Application development and use of AI

The Corstrate Email Tool is developed and maintained by Corstrate. Like most modern software teams, our development workflow uses AI-assisted coding tools to help write source code. This is a development aid only and does not change the security posture of the running application:

• No AI/LLM in the runtime. The running application contains no AI component. Its behaviour is deterministic Node.js code that communicates only with the Microsoft Graph API and a self-hosted database (EU). There is no AI in the request path.
• No customer or mailbox data is ever sent to any AI/LLM service (OpenAI, Anthropic, or any other). AI tooling operates on source code at design time — never on your data at run time.
• Human-reviewed and tested. All code is reviewed by a Corstrate engineer, version-controlled (git), and covered by an automated test suite (1,000+ tests) executed on every change.
• Security is enforced by controls, not by authorship. The guarantees in this document — minimal delegated permissions, mailbox-only scope, EU data residency, encryption, instant revocation, full Microsoft Entra audit visibility — hold regardless of which tools were used to write the code.

Source code review under NDA is available to your security team on request.

7. Data retention

Retention policies can be tightened on a per-engagement basis — contact ijelassi@corstrate.com to discuss specific contractual requirements (e.g. 30-day backup retention, immediate deletion clauses).

8. How to revoke access

Access can be revoked instantly at any time:

8.1 By the mailbox user (Imen Jelassi or the user who consented)

1. Visit https://myapps.microsoft.com
2. Click Manage your apps
3. Find Corstrate Email Tool in the list
4. Click Remove

8.2 By a tenant administrator

1. Open Azure Portal → Microsoft Entra ID → Enterprise Applications
2. Search for Corstrate Email Tool
3. Open the application → Properties → click Delete

After revocation, all existing access and refresh tokens become invalid on the next refresh attempt (typically within one hour). Any new sign-in attempt would require a fresh admin or user consent.

9. Incident response and communication

In the event of a security incident affecting your data:

• Corstrate will notify the designated contact at your organisation within 72 hours of becoming aware
• A written incident report will follow within 7 days, including timeline, scope, root cause and remediation
• Contact for security incidents: ijelassi@corstrate.com

10. Additional documentation available on request

The following documents are available to your security team on request:

• Sub-processor data-processing agreements (GDPR Article 28) — summary available on request
• Privacy Policy — available on request (public web page in preparation)
• Terms of Service — available on request (public web page in preparation)
• Security questionnaire responses (SIG, CAIQ, custom)
• Architecture diagrams (high-level data flow)

Please email ijelassi@corstrate.com with your specific requirements.

11. Document changelog

This document is provided for informational purposes to facilitate your security review. It does not constitute a contractual commitment. Contractual terms are set out separately in the agreement signed between Corstrate and the client; for the processing described here, Corstrate acts as the data controller.