Security
Last updated October 19, 2026
FollowUp emails a company's vendors about ship dates on purchase orders. To do that it needs one mailbox and the POs, and nothing more. This page says what we can reach, where your data lives, who can see it and what we haven't done yet. If something here isn't clear, write to security@vendorfollowup.com.
At a glance
- Access to one mailbox only, granted by your Exchange admin and limited to that address. We never ask Microsoft for tenant-wide mail access.
- Your people sign in with their Microsoft work accounts, so your MFA and Conditional Access policies apply. FollowUp holds no passwords for them, unless an Admin gives someone a passphrase (stored only as a one-way hash).
- Your data isn't used to train AI models, ours or anyone else's.
- Our staff can't open your account unless one of your Admins allows it, for a set time, read-only, and every view is shown to your Admins.
- You can remove FollowUp at any time from Microsoft Entra; nothing on our side can stop that.
What FollowUp asks of your Microsoft 365
| Access | How | Who approves | What it gives FollowUp |
|---|---|---|---|
| Sign-in | Delegated: openid, email, profile | Approved once by a Global or Cloud Application Administrator | The signed-in person's name, email and organisation ID. No mail, files or calendars. |
| One shared mailbox | Application Mail Full Access, through Exchange RBAC for Applications, limited by a management scope to one address | Granted by an Exchange Administrator with PowerShell we fill in | Send from, and read, that one mailbox (e.g. purchasing@), including its Sent Items folder. Nothing else in Exchange. |
Why the mailbox grant works this way. Microsoft's app permission for mail (Mail.Send, Mail.ReadWrite in Entra) covers every mailbox in an organisation. We don't ask for it. Instead your Exchange admin grants FollowUp one mailbox with RBAC for Applications, Microsoft's current way to scope an app to specific mailboxes. The last command, Test-ServicePrincipalAuthorization, lets you confirm it can reach that mailbox and no other.
Why a shared mailbox. Vendors recognise one address for purchasing, it keeps working when people change jobs, and FollowUp never touches anyone's own inbox.
Sent Items. The same grant lets FollowUp read the shared mailbox's Sent Items, to pick up POs sent from it. Anything that isn't a PO is skipped and not kept.
Optional: a mail flow rule to catch POs. Your Exchange admin sets this up once, for the whole company in Exchange, not person by person in Outlook: a mail flow (transport) rule that BCCs outgoing PO emails from a chosen group to your company's own address, intake+<token>@vendorfollowup.com (a variant of our intake address, intake@vendorfollowup.com). It gives FollowUp no access to anyone's mailbox. We accept those emails only if they pass DMARC and the sender is on your verified domain, and we ignore anything that isn't a PO without keeping it. The rule is yours to change or remove (see below).
No DNS changes. Mail goes out through your own Microsoft 365, so your SPF, DKIM and DMARC are unchanged and every message shows in your Exchange message trace and audit logs.
FollowUp's application (client) ID is 26b855b5-bc98-41ed-8371-c441dc95c6ae. It's how FollowUp appears in Entra → Enterprise applications, so you can check you're approving the right app.
Step-by-step setup, with the commands: FollowUp for IT admins.
Removing FollowUp
In Microsoft Entra → Enterprise applications → FollowUp → Delete. That stops FollowUp signing in to your organisation at once, so the mailbox grant can no longer be used. To also remove the grant's records from Exchange:
Get-ManagementRoleAssignment | Where-Object { $_.CustomResourceScope -eq "FollowUp - one mailbox" } | Remove-ManagementRoleAssignment
Remove-ManagementScope "FollowUp - one mailbox"
Remove-ServicePrincipal -Identity "FollowUp"
Remove-TransportRule -Identity "Vendor FollowUp - pick up POs"Inside FollowUp, an Admin's Disconnect (Settings → Email connection) stops it using the mailbox straight away. The last command applies only if you added the optional mail flow rule.
Where your data lives
- FollowUp runs on Railway, with a managed Postgres database encrypted at rest by the host. We plan to move to Microsoft Azure in the US.
- All traffic to FollowUp is over HTTPS.
- Mailbox tokens, where a provider uses them, are encrypted again by FollowUp (AES-256-GCM) with a key kept outside the database.
- Each company's data is kept apart in the database, and every request is checked against the signed-in person's company.
- Sign-in sessions use a random token; we store only its hash, so a copy of the database can't be used to sign in.
AI
- An AI model reads uploaded POs and vendor replies, and words messages when a company chooses AI assisted. Our software, not the AI, decides whether, when and to whom anything is sent.
- We send it only what one task needs: that PO, that reply, those facts.
- Our AI provider's commercial terms don't allow it to train on what we send, and we don't train models on your data either.
- Our record of AI calls holds the purpose, model and counts, never the text sent or received.
- Companies can use Standard messages (fixed templates) instead of AI-worded ones.
Who at FollowUp can see your data
- Nobody, by default. Support can look at a company's account only when one of its Admins allows it: for one named staff member for up to 72 hours, or, if the Admin turns it on, for our support team.
- Support views are read-only and end after 8 hours at most, or as soon as the Admin ends access.
- Every view is logged and shown to the company's Admins.
- Staff work in a separate console with its own roles, and every staff change is recorded in an audit log.
Keeping and deleting data
- An Admin can export the company's data at any time.
- When a company cancels, its account is read-only for 30 days so nothing is lost by mistake. After that one of our Owners confirms the deletion, there is a 7-day undo, and then the data is deleted.
- A company can ask us to delete its data sooner.
Who processes data for us
| Company | What for | What it sees |
|---|---|---|
| Railway Corporation | Hosting: runs FollowUp and its database | Everything FollowUp stores |
| Microsoft | Sign-in, and email: check-ins go out from, and replies arrive in, the customer's own Microsoft 365 mailbox; FollowUp's own notices go out from ours | Names and email addresses; the text of messages sent and received |
| Anthropic | AI: reads uploaded POs and vendor replies, and words messages when a company chooses AI assisted | The PO, reply or facts needed for that one task |
We tell customers before adding a new one.
What we haven't done yet
FollowUp is a young company, and we'd rather say so than imply otherwise. We don't have a SOC 2 report or an outside penetration test yet; both are planned. Until then we're glad to answer your security questionnaire and walk your team through how FollowUp is built.
Reporting a security issue
Write to security@vendorfollowup.com. We reply within one business day, tell you what we find, and won't take action against good-faith research that avoids other people's data and doesn't disrupt the service. If we find a breach affecting your data, we tell you without undue delay.