Original CSV
Selected and parsed on this device. The original file, file name, row values, and sender or recipient addresses are not included in probe events.
Data and access boundaries
Know what stays local and what is saved
The public analyzer keeps CSV values on your device. The separate private workspace saves selected structured data only after confirmation. Neither requests Microsoft tenant credentials.
Probe events
Fixed events distinguish tracked page views, analyzer opening, sample completion, real-file selection, second-tenant completion, export and controlled errors. They do not send tenant labels, file names, file fingerprints, CSV contents, row values, sender or recipient addresses, free-form error text, or self-reported profile fields.
Browser marker
On the first tracked page load or probe action, the browser stores one random UUID for up to 60 days to avoid counting the same browser twice. It is not created from device fingerprinting and is not used for profiling.
Server retention
Raw probe event rows are deleted after 90 days. Aggregate counts without the browser identifier may be retained for up to 13 months.
No tenant connection
The probe does not sign in to Microsoft 365, call Graph, run PowerShell, or change Exchange, DNS, ACS, HVE, SMTP, or ESP settings.
Human decisions
The route fields organize review. They do not authorize or execute a change.
Separate private workspace
When enabled, workspace imports send only the selected source/count/status/window fields after your confirmation. This structured data is stored in Cloudflare D1. The original CSV file is still parsed in the browser; do not confuse private workspace storage with the public analyzer's local-only data boundary.
Workspace access
Email links expire after 10 minutes and require confirmation in the requesting browser. Sessions use Secure, HttpOnly cookies and expire after 8 hours. The server checks current organization membership for each business request; an object ID alone does not grant access.
Audit and deletion
Action changes append a version with the submitting user and server time. Administrators can delete tenants; account closure and retention rules also apply. Deletion from the active database is not an instant wipe of provider backups. See the Privacy Notice for export and retention windows.
Payments and email
Purelymail delivers sign-in links. Creem hosts checkout when enabled. SenderOwner does not collect card numbers in its own forms, and a checkout return URL does not grant subscription access. Payment events are signature-checked before entitlement processing.
No certification claim
SenderOwner does not currently claim SOC 2, HIPAA, GDPR compliance, US-only data residency, a breach SLA, or affiliation with Microsoft.
Report security issues to security@senderowner.work. Read the Privacy Notice before saving private workspace data.
Open the local analyzer