This connector stores no mailbox, calendar, file, or message content, and never stores your
Microsoft sign-in tokens. To operate a fair-use limit on this free service it does keep a
small usage record about you, described below.
- Your Microsoft 365 sign-in tokens are issued to and held by the Claude client and presented to the
connector on each request. The connector uses each token in memory only to call
Microsoft Graph as the signed-in user, and does not write your OAuth access or refresh
tokens to disk, database, or keychain.
- Your mailbox content, calendar data, OneDrive/SharePoint files, and Teams messages are relayed
through the connector in memory to serve your request and are not written to any
persistent store. (Where the connector extracts text from a file for you, it does so in memory and
returns only the text. Where it creates or changes a file for you, the content is turned into the file
in memory and sent straight to Microsoft 365.)
- Usage record (stored). This service is free and applies a monthly fair-use limit on
the number of requests each person may make. To count that, the connector stores, per user: your
Microsoft user identifier and organization (tenant) identifier, your
email address, the number of requests you have made in the current calendar
month, any limit set for you, how many limit notifications you have been sent and when,
when the operator's team was last notified about you (see below), and the first and last time you
used the service. It stores no record of what you asked for or what
was returned.
- Document writing (only if your organization turns it on). When an administrator grants
the optional document-writing permissions, the connector can create files and change files you can
already edit, when you ask Claude to. To keep that safe it stores a few more counters, still with no
file content and no file names: how many document changes you and your organization made today and how
many bytes of content were sent for them (kept until the end of the day, UTC); and, for each file
changed in the last 24 hours, the times it was changed through the connector, filed under a one-way
keyed hash of the organization, drive and file identifiers rather than the identifiers themselves (kept
24 hours). The operator can also list organizations for which document writing is switched off. To let
you undo a change, the component that talks to Microsoft 365 remembers in memory only, for up to 7 days
or until it restarts, which earlier version of a file it replaced for you, under a one-way hash. New
Word, PowerPoint and Excel files are built from the content you supply in a separate component that has
no network access and no access to your sign-in tokens, and keeps nothing after each file.
- Why, and for how long. The usage record exists to enforce the fair-use limit, to tell
you when you have reached it, and to let the operator support the service. When you reach the limit,
the operator's own team may also be notified by email, sent through Mailgun (your
email address, organization identifier, and this month's usage), so it can contact you about more
capacity. It is not used for advertising and is not sold or shared with third
parties for their own purposes. Records for users with no activity for
13 months are automatically deleted.
You may ask the operator to delete your usage record at any time.
- Email. If you reach the monthly limit, the connector may email you to tell you and to offer a way to request
more: normally once in a month in which you reach it, and no more than 3 times in
total, though you may get another if the operator changes your limit or resets this count. That
email is sent through Mailgun, which processes your email address and the message
on our behalf under its own terms. You will not receive marketing email from the connector
itself.
- Short-term rate limiting (per-minute, per-hour and per-day limits, plus a cap on simultaneous
requests) is held only in memory, is never written to disk or logged, and resets on restart. It is
keyed on your verified Microsoft user identifier or, for requests not yet verified, on the source IP
address (IPv6 grouped by /64); an entry is discarded after about 24 hours without use. (The
document-writing counts described above are the exception: they are stored, as stated there.)
- Operational and error logs are written to exclude personal identifiers such as your
username, email address or full IP address (for errors only, our web server behind Cloudflare keeps the time, the site
and page requested without its query string, the error, and a shortened IP address). The component that calls Microsoft 365 on your behalf keeps its logs only
in memory, wiped whenever it restarts. Other components keep size-limited, rotating
log files on the server (about 30 MB each), deleted when that component is redeployed. We do not
guarantee that diagnostic output will never contain limited technical error detail.
- The onboarding wizard keeps no session or database. The admin-consent step uses only a short-lived,
HMAC-signed token for CSRF protection, receives no Microsoft token, and does not store or log the
organization id shown on its confirmation page.
- The operator's own administrators sign in to a separate, access-controlled console to view usage
counts and adjust limits. That console shows the usage record described above and each
organization's document-change counts; it provides no access to your mailbox, files, or
messages.
- The connector acts only with the delegated Microsoft Graph permissions you or your administrator
consent to. You can review those permissions before consenting and revoke them at any time
in the Microsoft Entra admin center (Enterprise applications → this application → Permissions / Delete).
- Traffic to this Service passes through Cloudflare, which provides its network edge and
encryption (TLS) and therefore processes every request and response, including sign-in tokens and
the content returned to you, on our behalf and under its own terms. It does not store that content
for us.
- The Service depends on Microsoft, Anthropic and Cloudflare, whose own privacy practices govern the data
they handle. Koine Ventures does not control those services and is not responsible for their data handling.
This statement describes the connector's current design and posture, which may change. It is provided
for information only and is not legal advice.
