Microsoft work accounts
Application sign-in and mailbox authorization are separate. Unknown organizations and uninvited users are denied.
Security overview
Handle business email with a narrow, visible boundary.
Microsoft work-account sign-in, explicit mailbox permission and access controls keep your company in charge of its email.
Read access by default
A personal connection requests Microsoft User.Read, Mail.Read, and offline access. It does not request application-wide mailbox access.
A separate narrow permission
A shared connection requests delegated Mail.Read.Shared and offline access, then verifies access to the configured mailbox before saving the connection. This path still needs real shared-mailbox and delegate acceptance checks.
Your access, your choice
Read-only is the default. A person who chooses read and reply, or full access, grants a separate delegated Mail.ReadWrite and Mail.Send permission for that mailbox (Mail.ReadWrite.Shared and Mail.Send.Shared for a shared mailbox). Sending and mailbox actions require an explicit choice. A user may separately opt in to marking mail read in Outlook when they open it in Smart Inbox.
Mailbox membership still applies
Microsoft permission is necessary but not sufficient. The application separately controls which members may view or work with a mailbox.
Nothing happens on its own
People can correct priority, category, and workflow decisions. Drafts never send themselves, and no worker, schedule or AI feature can send, move, delete or mark mail.
Data handling
Mirror what the workspace needs.
The product design mirrors message text and metadata into the application database. Attachment metadata is recorded, while eligible attachment files are requested from Microsoft 365 when an authorized member opens them or asks AI to read one. Attachment files are never stored.
AI review boundary
- AI output may be incomplete or wrong
- AI features can use selected message text, metadata and business context
- Attachment filenames help classification; contents are read only when a person asks, and only the AI result is kept
- Human corrections take priority over later AI suggestions
- No AI feature may send or change Outlook mail in Smart Inbox
Assisted setup
Complete release checks before customer access.
Customer signup is not open yet. Final legal documents and live acceptance checks must be completed before customer access opens. Live paid subscriptions are also awaiting release checks. Self-service setup and trial start are implemented; the administrator must review a useful workspace after sync and AI preparation. A website inquiry does not connect Outlook.
No unsupported certifications
Ashby does not currently claim SOC 2, ISO 27001, PCI certification, a penetration-test result, a guaranteed uptime level, or legal compliance certification for Smart Inbox.
No blanket location promise
East US 2 is the current staging resource region, not a blanket promise for production storage, backups, support access, Microsoft 365 processing, or future AI processing.
Three access levels, chosen per person and per mailbox
Read-only
Smart Inbox reads and organizes. Nothing changes in Outlook. This is the default, and anyone can return to it at any time.
Read and reply
Reply, reply all and forward. Smart Inbox creates the draft in Outlook, shows the sender, recipients and message, and sends only after a separate Send confirmation. Once sent, delivery may occur and recall is not guaranteed.
Full access
Also archive, move, mark read or unread, flag and delete, one message or a confirmed selection. Delete moves mail to Deleted Items; Smart Inbox never deletes permanently. Most changes can be undone for a few minutes.
Each level above read-only needs its own disclosure and a Microsoft permission screen for delegated read/write and send access. Those Microsoft permissions are broader than what Smart Inbox does with them. Payment or being an admin never raises anyone's access. On shared mailboxes, the admin decides whether members may delete. Every change is recorded with who made it and when.
Retention enforcement and backup recovery checks remain release requirements. See the app privacy notice under review for the proposed retention policy. Outlook's own retention rules decide when Deleted Items is emptied.
New mailbox connections default to read-only. Read and reply, and full access, are implemented for users who explicitly choose them and complete separate Microsoft consent. Shared-mailbox use still needs live acceptance checks.