Security & trust
What we ask for. What we don't.
Half the trust signal is the scopes we deliberately do NOT request. We document both, in plain English.
OAuth scopes
Google (Gmail)
What we request
- gmail.send: to send pitches (and auto-replies, if you turn them on) from your own Gmail address
- gmail.readonly: used only to read the replies in threads of pitches we sent. Google has no narrower scope that can read replies, so our code enforces the limit
- openid, email, profile: to identify your account
What we deliberately do NOT request
- We do NOT request gmail.modify, gmail.compose, or gmail.labels
- We do NOT read any message that is not a reply in the thread of a pitch we sent
- We do NOT access your contacts, calendar, drive, or any other Google service
- We do NOT keep reply text for more than 12 months, or use it to train AI models
Microsoft (Outlook)
What we request
- Mail.Send: to send pitches (and auto-replies, if you turn them on) from your own Outlook address
- Mail.Read: used only to read the replies in threads of pitches we sent. Microsoft has no narrower permission, so our code enforces the limit
- User.Read, openid, email, profile: to identify your account
- offline_access: to keep sending without asking you to sign in again
What we deliberately do NOT request
- We do NOT request Mail.ReadWrite or Mail.Send.Shared
- We do NOT read any inbound message that is not a reply to a pitch we sent
- We do NOT access your contacts, calendar, OneDrive, or Teams
Data residency
Hosted on Microsoft Azure in the United States, encrypted at rest (AES-256) and in transit (TLS). Inbox tokens are also encrypted by our app, passwords are scrypt hashes, and sign-in sessions are stored only as fingerprints.
GDPR & DPA
We are GDPR-ready. A signed Data Processing Addendum (DPA) is available on request. Email security@pitchcentric.com.
Subprocessors
Incident response
In the event of a security incident affecting customer data, we will notify the primary admin of every affected workspace within 72 hours of confirmed detection. We will publish a public post-mortem within 14 days for any incident classified as High or Critical.
Security documentation
Security documentation, a signed DPA, and our subprocessor list are available on request. Email security@pitchcentric.com.
Security disclosure
Found something? Email security@pitchcentric.com We will acknowledge within one business day.