This page describes the security measures Steward Agents uses today, in plain language. It is an overview, not a contract. We do not currently hold third-party security certifications such as SOC 2 or ISO 27001.
1. Sign-in with Microsoft
- Staff sign in with their organization's Microsoft work account, so your organization's own policies apply, including multi-factor authentication and conditional access.
- Accounts are by invitation only. Signing in with a Microsoft account that hasn't been invited doesn't create an account.
- Connecting Microsoft 365 is a separate, explicit step. Your organization's Microsoft 365 administrator can approve or remove Steward Agents' access in Microsoft Entra at any time.
2. Limited Microsoft 365 permissions
- Steward Agents asks for permission to read files and calendars and to create email drafts. It does not ask for permission to send email from your mailbox, so agents cannot send email.
- Agents act with the signed-in person's own Microsoft permissions. They can only reach what that person can already open.
- In Excel, the add-in only adds rows below your data or creates a new sheet. It does not change existing cells. In Word and Outlook, text goes in only when the person clicks to insert it, and "Remove what was added" takes it back out.
- Optional features are off until turned on: mailbox search (turned on per organization), Teams transcripts (each person opts in, with administrator approval), and the morning summary (each person opts in).
3. Access controls and separation
- Each organization's data is kept separate, and each person's agents and conversations are private to them. The database enforces this on every request with row-level security, not just the application.
- Steward Agents staff work through an operations console that shows usage, cost and error information. They can see conversation content only if your organization turns that access on. Changing where an organization's AI processing happens, or turning mailbox search on or off, requires a recorded reason.
- Agent instructions change only through a reviewed change request, and their history is kept.
4. Encryption and hosting
- All connections use HTTPS (TLS).
- Microsoft 365 access tokens are encrypted with AES-256-GCM before they are stored.
- The application runs on DigitalOcean servers in Toronto. The database runs on Supabase in Canada (Montréal). AI processing is described in the Privacy Policy: by default it happens mainly in the United States, with a Canada-only option available on request.
- The database provider encrypts stored data at rest. [Confirm against Supabase's current documentation.]
5. Logging and audit
- Every AI request is logged with the time, person, agent, model, cost and any error.
- Every action the Office add-in takes is logged: what it read (by file, range or email label) and where it put text. These logs never contain the text itself. Each person can see their own log in the app and download it as a CSV.
- Changes to an organization's AI processing location and mailbox search setting are recorded with who made them and why.
6. Human review by design
Agents draft and analyze; people decide. Nothing is sent, published or submitted by an agent. See AI Use & Human Review.
7. Safeguards against sensitive information
- Before text is sent to the AI, both the add-in and the server check it for signs of client or family health information, and refuse to send it if found.
- Email and file search results that look like they contain such information are held back and counted, not shown.
- These checks are safeguards, not guarantees. Staff remain responsible for not putting this information into the service. See the Acceptable Use Policy.
8. Usage limits
Each organization has daily request limits and can set a monthly budget, so unexpected use is capped.
9. Reporting a security issue
If you think you've found a security vulnerability, or that your account or data has been misused, email [security contact email]. Please give us enough detail to reproduce the issue, and give us reasonable time to fix it before sharing it publicly. Please don't access other people's data, disrupt the service or test against accounts that aren't yours. We'll acknowledge your report within [number] business days.