Confluo for IT and security teams
A five-minute brief on what Confluo accesses, what it stores, and how to approve it for a Microsoft 365 or Slack tenant.
What Confluo does
Confluo reads a user's Outlook mail, Microsoft Teams chats and Slack messages via the user's own OAuth grant, and distils each message into an action item — who is waiting, what is owed, and by when. It shows the user a briefing three times a day. Nothing is posted, sent or modified on the user's behalf; access is read-only.
What we access
| Source | Scopes requested | Why | Read-only? |
|---|---|---|---|
| Microsoft 365 | User.Read, Mail.Read, offline_access | Profile and mail, to extract asks | Yes |
| Teams | Chat.Read; optionally ChannelMessage.Read.All and Team.ReadBasic.All (only if the user grants the extra permission for team channels) | Chats and channels | Yes |
| Slack | Read scopes for channels, DMs and threads the user is a member of (channels:history, groups:history, im:history, mpim:history, users:read) | Channels, DMs and threads | Yes |
No write, send, delete or admin scopes are ever requested.
What we store, and for how long
- Message content is processed in transit and discarded. It is never written to disk or to a database.
- The only stored artefacts are the extracted action items — title, sender name, source, timestamp, and a one-to-two-sentence summary — plus the user's account record and OAuth tokens.
- Extracted items are deleted on a rolling 30-day cycle; nothing in history is retained beyond 90 days.
- OAuth tokens are encrypted at rest and revoked immediately on disconnect or account deletion.
- Users can delete their account and all associated data from Settings at any time, effective immediately.
Where data lives
Infrastructure runs on AWS in the EU (London and Ireland regions). Transactional email is sent via Resend (EU). No data is sold, shared with advertisers, or used to train models.
Sub-processors
- AWSHosting and infrastructure (EU regions).
- AnthropicAction-item extraction from message text in transit, via the Claude API under zero-data-retention terms (anthropic.com).
- ResendTransactional email (EU).
- RevenueCatSubscription entitlement management.
- ApplePayments and subscription billing.
Security
- TLS 1.2+ for all data in transit.
- Encryption at rest for stored data and OAuth tokens.
- Secrets held in AWS Secrets Manager.
- Least-privilege IAM across all services.
- Two independent security reviews completed before launch.
- Automated tests that assert no message body is persisted, run on every release.
How to approve Confluo for your tenant
Microsoft 365
An administrator can grant tenant-wide consent using the admin consent URL:
https://login.microsoftonline.com/organizations/adminconsent?client_id=2c2ab35e-4aa2-4c76-b280-9a7a87bb868cReplace "organizations" with your tenant ID if your admin prefers a tenant-specific link.
Alternatively, approve the user's request in Entra > Enterprise applications > Admin consent requests. Confluo is a verified Microsoft publisher [pending verification].
Slack
Approve the app in Workspace settings > Manage apps when a user requests it.
Contact
Security and compliance questions: security@confluoapp.com. General support: support@confluoapp.com.
A Data Processing Agreement and a completed security questionnaire are available on request.