Security
Trusted with your inbox.
Built to deserve it.
Quoflow handles some of your most sensitive information: customer emails, plans and pricing. Here’s exactly how we look after it.
Access
Read-only by default
The Microsoft 365 connection reads mail. It never sends, replies, deletes or marks anything as read. Filing into folders is optional and needs your Microsoft admin’s approval.
Business systems, read-only
Quoflow reads products, customers and pricing from your connected business system. It doesn’t create orders or change records.
Only what you connect
Quoflow sees the mailboxes and systems an admin chooses to connect, and nothing else. Disconnect any time from Settings.
Roles
Admins manage connections, keys and limits. Estimators review, price and export.
Protection
Encrypted in transit
Every connection uses HTTPS with HSTS, so data between you, Quoflow and our providers is always encrypted.
Sealed credentials
Mailbox tokens and system credentials are encrypted with AES-256 before they’re stored, and never shown again.
Strict separation
Every workspace is isolated. Each request is checked against the workspace it belongs to.
Careful sign-in
Passwords are hashed with bcrypt. Sessions use secure, same-site cookies, and sign-in attempts are rate limited.
People and AI
A person signs off
Quoflow prepares. Nothing is priced until someone on your team reviews the job, and nothing reaches a customer unless you send it.
No training on your data
We use AI providers under business terms that bar them from training on your data, with storage turned off where the provider allows.
Never sold
Your plans, emails and prices are used to prepare your quotes. We never sell them or share them with other customers.
Spending limits
Every workspace has an AI spending limit that admins control, so usage can’t run away.
Where your data goes
Quoflow runs on established cloud providers. Customers can ask for the current list of providers, and we’ll give at least 30 days’ notice before adding a new one.
Your data, your call
You own your workspace data. You can disconnect a mailbox or system at any time, and when you close your account your workspace data is deleted within 90 days. Read more in our privacy policy and data processing agreement.
Reporting a security issue
If you think you’ve found a vulnerability, please email us with the details. We’ll acknowledge your report within two working days, keep you updated, and won’t take action against good-faith research that avoids harm to our customers and their data.
Questions from your IT team
Happy to answer them. If your organisation needs to approve Quoflow in Microsoft 365, our Help Centre article explains exactly what we ask for and why.