Optional Microsoft 365 connection
Osynk accesses a Microsoft 365 mailbox only after an authorised user chooses Email Intelligence, reads the in-product disclosure, and continues to Microsoft's permission screen. Mailbox access is never enabled by default.
Exact access
Email Intelligence requests only the Microsoft Graph permissions needed to ingest eligible customer email and send visible replies through the connected mailbox. All four are delegated permissions, which means Osynk acts only as the signed-in user and only on that user's mailbox.
Mail.Read
Used by Email Intelligence to ingest eligible customer email into the selected Business Unit.
Mail.Send
Used by Email Intelligence to send user-visible replies through the connected mailbox.
User.Read
Used to show and verify which Microsoft account completed the connection.
offline_access
Used to refresh access without asking the user to sign in again for every sync.
For Microsoft 365 administrators
Mailbox permissions are not in Microsoft's default low impact set. In many Microsoft 365 organisations an administrator, rather than the individual user, has to approve the connection. That is a decision made by your tenant's consent policy, not by Osynk.
Where tenant policy permits it, the mailbox owner approves the connection for their own mailbox on Microsoft's permission screen.
Where tenant policy requires it, Osynk directs the user to request approval. An administrator reviews the same permission list before any mailbox data is read.
An administrator can remove the Osynk enterprise application from the tenant at any time, which ends access for every mailbox connected under it.
Before access begins
Visiting Osynk or opening a mailbox setup page does not connect a mailbox. The user must take the affirmative consent step.
An authorised workspace user starts the Microsoft 365 mailbox setup.
Osynk explains the purpose, access, retention, regions, and deletion behavior.
Microsoft lists the requested permissions and asks the account holder, or a tenant administrator, for approval.
Only the approved connection can read or send mailbox data for the disclosed purpose.
Two independent controls
Customers select these separately. The authenticated disclosure shown before consent presents the workspace's actual choices.
The workspace's storage choice controls the configured regional stores for durable customer files and backups.
This selector is not a blanket claim about primary databases, identity and session data, security logs, or data that remains within Microsoft's systems.
Where an Email Intelligence workflow uses AI, the relevant content is processed through Amazon Bedrock in the chosen AI geography.
AI Processing Region can differ from Data Storage Region. If a required Bedrock capability is unavailable in the selected geography, Osynk does not silently reroute it elsewhere.
Retention and control
These are separate actions, and Osynk states plainly what it can and cannot do. Disconnecting a mailbox permanently deletes Osynk's stored Microsoft credentials for that mailbox and stops all further synchronisation and sending. Osynk cannot itself withdraw the permission you granted: removing a delegated grant requires tenant administrator permissions that Osynk deliberately never requests. The grant is withdrawn at the Microsoft end, by the mailbox owner or an administrator. Disconnect also does not erase messages, attachments, or business records already imported into the workspace.
Use Email Intelligence mailbox settings. Osynk deletes the stored access and refresh tokens for that mailbox and stops reading and sending immediately.
Review and remove Osynk under your own account at myapplications.microsoft.com. A Microsoft 365 administrator can instead remove the Osynk enterprise application from the tenant, which ends access for every mailbox connected under it.
Delete the relevant record or account content using Osynk's controls, or follow the Data Deletion instructions. Email Intelligence evidence can remain after disconnect until the customer deletes the corresponding data or account.
Deleted copies can remain inside encrypted rolling backups for up to 30 days, after which the rotated copy is no longer retained, subject to documented legal-retention exceptions.
How the data is used
Osynk uses Microsoft Graph data only to provide or improve the visible feature the customer enabled, secure it, comply with law, or respond to the customer's support request. Where an Email Intelligence workflow uses AI, the relevant content is processed through Amazon Bedrock in the workspace's chosen AI geography, and customer content is not used to train generalized or foundation models.
One honest detail about revocation timing: if you withdraw the permission at Microsoft without also disconnecting in Osynk, an access token Osynk already holds can remain technically valid until it expires. No new token is issued after revocation, and disconnecting in Osynk deletes the stored tokens outright.
Full documents
These documents govern Osynk's handling of personal data, service use, and deletion requests.
Questions or deletion requests: contact@osynk.ai