Question 1

What is MailBreach?

Accepted Answer

MailBreach is an email security SaaS that continuously scans Microsoft 365 and Google Workspace tenants to detect hidden forwarding rules and inbox configurations that could silently leak your company's email data to external attackers. We find the breach before it becomes a headline.

Question 2

What problem does MailBreach solve?

Accepted Answer

When attackers compromise an email account, they often create hidden inbox rules that forward sensitive emails (invoices, wire transfers, password resets) to external addresses. These rules run silently — the user never sees the forwarded emails, and IT has no alerts. MailBreach finds and fixes these hidden threats.

Question 3

What email providers do you support?

Accepted Answer

We support Microsoft 365 (Exchange Online via Graph API) and Google Workspace (Gmail API with Domain-Wide Delegation). Both can be connected simultaneously for organizations using hybrid setups.

Question 4

How is MailBreach different from my existing email security?

Accepted Answer

Most email security tools focus on inbound threats (spam, phishing, malware). MailBreach focuses on outbound exfiltration via hidden mailbox rules — a blind spot in traditional security. We scan the configuration layer, not email content, to find rules that forward data externally.

Question 5

Who is MailBreach designed for?

Accepted Answer

MailBreach is designed for SMBs (10-999 employees) who use Microsoft 365 or Google Workspace. Our sweet spot is organizations with 20-500 users who need automated security without a dedicated security team. MSP support with multi-tenant management is coming in Phase 2.

Question 6

Do you read email content?

Accepted Answer

No. We only access configuration metadata — forwarding rules, inbox rules, and filter settings. We never read, store, or process the content of any emails. Your data stays yours.

Question 7

What data does MailBreach access?

Accepted Answer

We access: (1) User directory to enumerate mailboxes, (2) Inbox rules and their conditions/actions, (3) Gmail filters and forwarding settings, (4) Auto-forwarding configurations, (5) Rule creation/modification timestamps. We do NOT access email content, attachments, or message bodies.

Question 8

How do you store our data?

Accepted Answer

All data is stored in isolated, encrypted databases with strict tenant separation. Every database query is scoped by tenant ID. We use industry-standard encryption at rest and in transit. Secrets and credentials are stored in encrypted vaults with automatic key rotation.

Question 9

What permissions do you need in Microsoft 365?

Accepted Answer

We request the minimum permissions needed: MailboxSettings.ReadWrite and Mail.Read (for rules only, not content). An admin must grant consent via OAuth. We follow Microsoft's least-privilege best practices.

Question 10

What permissions do you need in Google Workspace?

Accepted Answer

We use a Service Account with Domain-Wide Delegation and request only the Gmail settings and filters scopes. An admin must authorize the service account in the Google Admin console. We never request full Gmail access.

Question 11

Is MailBreach SOC 2 compliant?

Accepted Answer

We're designed with SOC 2 compliance in mind. Full audit logging, tenant isolation, encryption, and access controls are built in. Our weekly evidence reports provide the documentation auditors need. Formal SOC 2 certification is on our roadmap.

Question 12

Can I use MailBreach for HIPAA compliance?

Accepted Answer

MailBreach can help healthcare organizations detect email-based data leaks. Since we never access email content (only configuration metadata), we minimize PHI exposure. However, you should review with your compliance team and we can provide a BAA upon request.

Question 13

How long does onboarding take?

Accepted Answer

Most customers are scanning within 15 minutes. M365 requires admin consent (OAuth flow), Google requires creating a service account with Domain-Wide Delegation. Our wizard guides you through both processes step-by-step.

Question 14

Do I need to install any software or agents?

Accepted Answer

No. MailBreach is 100% cloud-based and connects to your email provider via API. There's nothing to install on user devices, mail servers, or anywhere else. Just authorize the connection and we handle the rest.

Question 15

Can I connect both M365 and Google Workspace?

Accepted Answer

Yes. Many organizations use both providers (e.g., post-merger or during migration). You can connect both simultaneously and see unified findings across all mailboxes.

Question 16

What if I have thousands of users?

Accepted Answer

MailBreach is designed to scale. We batch API calls, implement exponential backoff for rate limits, and checkpoint scans to resume if interrupted. Our Plus plan supports unlimited users with enterprise-grade performance.

Question 17

Can I test MailBreach before buying?

Accepted Answer

Yes. Contact us for a free trial where you can connect your tenant and run a scan. You'll see real findings from your environment before committing.

Question 18

What threats does MailBreach detect?

Accepted Answer

We detect 12 threat patterns including: external forwarding to non-allowlisted addresses, forward-and-delete rules (evidence destruction), forward-and-hide rules (mark read, move to junk), recently created rules (post-compromise), rules targeting sensitive keywords (invoice, wire, ACH), catch-all forwarding, and tenant policy drift.

Question 19

How does MailBreach know a rule is malicious?

Accepted Answer

We analyze rule configurations against 12 known-bad patterns. Key signals include: external destination not on your allowlist, actions that hide evidence (delete, mark read), recent creation date, targeting of financial keywords, and combinations of suspicious behaviors. Our AI classifies findings by severity and confidence.

Question 20

What are the severity levels?

Accepted Answer

Severity 1 (Critical): High-confidence exfiltration patterns eligible for auto-remediation. Severity 2 (Suspicious): Needs human review — could be legitimate or malicious. Severity 3 (Monitor): Weak signals and hygiene issues that warrant attention but not immediate action.

Frequently Asked Questions

General

Privacy & Security

Setup & Onboarding

Detection & Scanning

Remediation

Reporting & Compliance

Pricing & Plans

Technical Details

MSPs & Partners

Still have questions?