Security & data handling
This page is maintained by BeforNine to answer common security and privacy questions. It describes app-visible controls and current practices, not an independent certification.
Microsoft OAuth
BeforNine connects to Microsoft 365 using standard OAuth 2.0. You are always redirected to Microsoft to authenticate — BeforNine never sees your Microsoft password. We request only the scopes needed to read your calendar for today's meetings and to send email on your behalf from your own Outlook mailbox. You can revoke access at any time from your Microsoft account settings, and BeforNine immediately loses access when you do.
Personal Microsoft accounts (@outlook.com, @hotmail.com) are not supported because Microsoft restricts the required Graph API scopes to work and school accounts.
CRM permissions
When you connect a CRM (Salesforce, HubSpot, or others), BeforNine uses each provider's native OAuth flow and requests the minimum permissions required to read accounts, contacts, and opportunities you already have access to. BeforNine does not modify your CRM records unless you explicitly ask it to. If your organization blocks OAuth for third-party apps, you can use CSV import as a first-class alternative — no admin required.
AI privacy
BeforNine uses OpenAI and Google models via the Lovable AI Gateway for sales brief generation, email drafting, and account analysis. Provider agreements prohibit training on your data. Prompts contain only the account context needed for the specific task — typically the company name, industry, and any notes you have added.
Every AI output labels its source (Verified Provider, User Provided, or AI Inferred) and shows a confidence value so you always know what to trust.
Customer data ownership
Your data is yours. You can export or delete your companies, contacts, opportunities, notes, and briefs at any time from Settings. If you cancel your account, we delete your data on request within 30 days.
Encryption
- All traffic between your browser and BeforNine is encrypted with TLS 1.2+.
- Data at rest is encrypted using AES-256 on managed Postgres storage.
- Secrets and OAuth tokens are stored encrypted and never exposed to the browser.
What we never do
- We never sell your customer data.
- We never share your CRM data with third parties for advertising.
- We never let one customer see another customer's data — every table is isolated by row-level security.
- We never train shared AI models on your data.
Reporting a vulnerability
If you believe you have found a security issue, please email security@befornine.com. We respond to every report and will keep you updated as we investigate.