Security

• We never see your password. Every connection uses OAuth 2.0. You authenticate on Google’s or Microsoft’s own login page and we receive only a scoped access token.
• Per-user tokens, stored encrypted server-side. Each user’s tokens are held individually, encrypted at rest with a server-held key, and are only ever decrypted inside our server-side code to make a call on that user’s behalf. Tokens are never sent to the browser and never appear in logs.
• Delegated, read-only scopes. Microsoft: Contacts.Read, User.Read, offline_access. Google: read-only Gmail metadata plus your account email. We request nothing that can send, delete or modify data.
• Revocable at any time. Disconnecting a source deletes its stored tokens immediately. You can also revoke access from your Google or Microsoft account settings, and an administrator can revoke tenant-wide approval at any time.

If you choose to connect Google so we can work out who you actually correspond with, we read message headers — who a message was from, who it went to, and when. We do not read subjects as content, message bodies, attachments or drafts, and the scope we hold does not permit sending. Nothing about your mail is stored beyond the names and email addresses you decide to keep in your list. This connection is entirely optional: you can build your list by importing an address book, a CSV, or by typing people in.

• Every record is scoped to your account and enforced at the database level with row-level security, so one customer’s data cannot be read by another.
• We never publish, share or sell who you follow. There is no social graph, no shared directory, and no notification to the people you track.
• Access to production data by our team is restricted, and we look at customer records only when you ask us to help with a specific problem.

• All traffic is served over HTTPS/TLS; data is encrypted in transit and at rest.
• Application secrets and OAuth client credentials live in a managed secret store, injected at runtime — never committed to source control and never exposed to the browser.
• Authentication, database and hosting run on managed, industry-standard cloud infrastructure with automated backups; payments run entirely through Stripe, so full card numbers never reach our servers.
• Server-side code is the only thing that talks to third-party APIs; the browser never holds a provider credential.

Briefings are sent from a verified sending domain (hello@naturaltouchpoint.com) with domain authentication configured, so your mail gateway can confirm the message genuinely came from us. Briefings go only to the address on your account and contain no tracking pixels sold to third parties.

Deleting your account permanently removes your profile, preferences, contact list, imported contacts, stored signals, briefing history and every connected-account token. Disconnecting a single source removes just that source’s credentials. You can also request deletion by email and we will confirm when it is done.

Many firms require an administrator to approve third-party apps. When we detect that, the app shows you a ready-to-send note for your IT team listing exactly which read-only scopes we request, plus the official Microsoft admin-consent link so an administrator can approve Natural Touchpoint for the whole organization at once. In the meantime you can import contacts from your iPhone or a CSV file and use the product fully.

If you believe you have found a security issue, email hello@naturaltouchpoint.com with the details. We will acknowledge your report, keep you updated, and will not pursue action against good-faith researchers who avoid privacy violations and service disruption.