Security
Least privilege, verifiably.
SynaMark runs inside your Microsoft 365 tenant. Your administrators configure it; your data stays with you and Microsoft. It requests no access to mailboxes, calendars, chats or files outside its own site, and the add-in never reads the message being written.
Microsoft Graph permissions
| Permission | Type | Why |
|---|---|---|
| User.Read | Delegated | Sign in, and read the signed-in user’s own profile for their signature. |
| GroupMember.Read.All | Delegated | Work out which signature rules apply to the user. |
| Sites.Selected | Delegated | Read (users) or edit (admins) the SynaMark site in your tenant — and no other site. |
| User.Read.All | Delegated (admins) | Preview a signature as another user in the admin portal. |
Controls
Tenant-resident
Templates, brand assets, campaigns and audit history are stored in a SharePoint site in your tenant. Directory details are read live from Entra ID. Nothing is copied to us.
Locked to Microsoft
The add-in and admin portal can only connect to graph.microsoft.com and login.microsoftonline.com — enforced by Content Security Policy and verifiable in any browser.
Safe signature content
Templates pass an allow-list sanitiser; directory values are encoded before insertion; uploads are type-checked and re-encoded. A malicious job title cannot become script in an email or the portal.
Delegated only
No application permissions: SynaMark acts as the signed-in user and has no access when nobody is signed in. SharePoint access is scoped to the SynaMark site alone.
Secure development
Built to OWASP ASVS Level 2 and NIST SP 800-218. Static analysis, dependency and secret scanning on every change, signed releases from an automated pipeline, and independent penetration testing.
Fail-safe client
If Microsoft Graph or our code hosting is unreachable, Outlook inserts the cached or a plain-text signature. Composition is never blocked.
Where your data lives
In your own Microsoft 365 tenant. SynaMark stores its configuration, templates and images in a SharePoint site you control, reads directory details live from Entra ID, and caches each user’s rendered signature in their own mailbox. We host only the application code (Microsoft Azure, United Kingdom (UK South)). See the sub-processor list and the Data Processing Agreement, whose Annex II sets out our technical and organisational measures in full.
Vulnerability disclosure
If you believe you have found a security vulnerability in SynaMark or this website, email security@kamsoft.tech with steps to reproduce. We will acknowledge within 3 business days, keep you informed, and credit you on request once the issue is fixed.
Safe harbour. We will not pursue legal action against research conducted in good faith that: tests only your own tenant or accounts you are authorised to use; does not access, modify or retain other customers’ data; avoids degrading the service (no denial-of-service or volumetric testing); and gives us reasonable time to remediate before disclosure.
Out of scope: social engineering, physical attacks, findings in Microsoft services, and reports from automated scanners without a demonstrated impact. Our security.txt follows RFC 9116.