Our commitments
- 01
We never read your mail
Waystone has no permission to read any mailbox. Not one, not any.
- 02
We can't send as your people
Waystone holds no Mail.Send permission. If you want emails from your own address, Exchange limits it to one mailbox you choose.
- 03
A person behind every request
Everyone signs in with their Microsoft work account, so your MFA and Conditional Access apply. Waystone refuses app-only tokens.
- 04
Your data stays separate
Every read and write is scoped to your organization, and your content is never used to train AI models.
- 05
Leave cleanly
When you cancel, you have 30 days to export. Then everything is permanently deleted, call recordings included.
The details
- Waystone and your Microsoft 365The exact permissions, the exact fields we read, and how to revoke access.
- How Waystone handles your dataWhat we store, where it lives, how organizations are kept apart, AI, and deletion.
- Sending email from your own addressOptional. Let Waystone send as one mailbox, enforced by Exchange, and check it yourself.
Quick facts
- Hosting
- Microsoft Azure, North Central US
- Encryption at rest
- Yes, Azure's built-in encryption for the database and file storage (Microsoft-managed keys)
- Encryption in transit
- HTTPS (TLS) for every page, API call and file
- Sign-in
- Microsoft Entra ID work accounts. Waystone never sees a password
- Microsoft 365 permissions
- Directory read only: User.Read.All and GroupMember.Read.All
- Mail permissions
- None in Entra ID
- AI processing
- Azure OpenAI in Underhill Systems' own Azure subscription, East US 2 region
- Deletion after cancelling
- Everything, 30 days after service ends
- Certifications
- No SOC 2 or ISO 27001 report yet. We answer security questionnaires directly
Reviewing Keystone Desk instead? Ask us and we'll send you the same detail for it.
Have a security questionnaire?
Send it over. An engineer who builds Waystone answers it, not a sales team.